Client Alerts, News Articles & Blog Posts

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

November 15, 2018

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

Client Alert

Investment Training for the Second and Third Generations

January 19, 2021Consider this scenario. Mom and Dad started the business from the ground up. Over the decades it has expanded into a money-making machine. They are able to sell the business and it results in a multimillion-dollar payday for their labors. The excess money has allowed Mom and Dad to invest with various financial advising firms, several fund management groups, and directly with new startups and joint ventures. Their experience has made them savvy investors, with a detailed understanding of how much to invest, when, and where. They cannot justify formation of a full family office with dedicated investors to manage the funds, but Mom and Dad have set up a trust fund for the children to allow these investments to continue to grow over the years. Eventually, Mom and Dad pass. Their children enjoy the fruits of their labors, and, by the time the grandchildren are adults, Mom and Dad's savvy investments are gone.Client Alert

Provider Relief Funds – Continued Confusion Regarding Reporting Requirements and Lost Revenues

January 15, 2021In Fall 2020, HHS issued multiple rounds of guidance and FAQs regarding the reporting requirements for the Provider Relief Funds, the most recently published notice being November 2, 2020 and December 11, 2020. Specifically, the reporting portal for the use of the funds in 2020 was scheduled to open on January 15, 2021. Although there was much speculation as to whether this would occur. And, as of the date of this article, the portal was not opened.Client Alert

Ohio S.B. 310 Loosens Practice Barrier for Advanced Practice Providers

January 14, 2021S.B. 310, signed by Ohio Governor DeWine and effective from December 29, 2020 until May 1, 2021, provides flexibility regarding the regulatorily mandated supervision and collaboration agreements for physician assistants, certified nurse-midwives, clinical nurse specialists and certified nurse practitioners working in a hospital or other health care facility. Originally drafted as a bill to distribute federal COVID funding to local subdivisions, the healthcare related provisions were added to help relieve some of the stresses hospitals and other healthcare facilities are facing during the COVID-19 pandemic.Client Alert

HHS Issues Opinion Regarding Illegal Attempts by Drug Manufacturers to Deny 340B Discounts under Contract Pharmacy Arrangements

January 14, 2021The federal 340B discount drug program is a safety net for many federally qualified health centers, disproportionate share hospitals, and other covered entities. This program allows these providers to obtain discount pricing on drugs which in turn allows the providers to better serve their patient populations and provide their patients with access to vital health care services. Over the years, the 340B program has undergone intense scrutiny, particularly by drug manufacturers who are required by federal law to provide the discounted pricing.Client Alert

S.B. 263 Protects 340B Covered Entities from Predatory Practices in Ohio

January 14, 2021Just before the end of calendar year 2020 and at the end of its two-year legislative session, the Ohio General Assembly passed Senate Bill 263, which prohibits insurance companies and pharmacy benefit managers (“PBMs”) from imposing on 340B Covered Entities discriminatory pricing and other contract terms. This is a win for safety net providers and the people they serve, as 340B savings are crucial to their ability to provide high quality, affordable programs and services to patients.
Older posts