Client Alerts, News Articles & Blog Posts

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

Changes to Physician Assistant Statutes in Florida

In the last year, there have been many changes to the scope of practice and collaboration/supervision requirements for advanced practice providers such as APRNs and physician assistants in the state of Florida. In a previous Client Alert we discussed House Bill 607, which expanded the autonomous practice of APRNs providing primary care services in Florida.

Ohio Senate Bill 49 – Ohio Expands Lien Rights for Design Professionals

Effective September 30, 2021, Ohio granted limited lien rights to design professionals, including architects, landscape architects, engineers, and surveyors. Ohio Governor Mike DeWine signed Senate Bill 49 into law on July 1, 2021. This new law established a statutory right to lien commercial real estate by Ohio design professionals who, until now, could not file a lien for non-payment of professional services. Senator Vernon Sykes, a primary sponsor of Senate Bill 49, stated that the “legislation ensures that architects, engineers and other designers will get paid for their work, regardless of the outcome of their projects . . . It will support hardworking Ohioans by protecting the value of their labor . . ..”

Primary Care Practice Officially Defined in Florida for APRNs Practicing Autonomously

As many providers in Florida are aware, House Bill 607 (the “Bill”), which was passed in February of last year, gives certain APRNs in Florida the ability to practice autonomously. The only catch is that they must work in primary practice. When the Bill was initially passed, there was question as to what was exactly considered primary care, absent a definition from the Florida Board of Nursing. However, as of February 25, 2021, “primary care practice” has officially been defined.

Part II of the No Surprises Act

The Department of Health and Human Services (“HHS”) published Part II of the No Surprises Act on September 30, 2021, which will take effect on January 1, 2022. The new guidance, in large part, focuses on the independent dispute resolution process that was briefly mentioned in Part I of the Act. In addition, there is now guidance on good faith estimate requirements, the patient-provider dispute resolution processes, and added external review provisions.

Safer Federal Workforce Task Force - Guidance for Federal Contractors and Subcontractors

The Safer Federal Workforce Task Force has issued its Guidance for Federal Contractors and Subcontractors (Guidance). Note that the Guidance applies only to “covered contracts,” which are contracts that include the clause (Clause) set forth in Sec. 2(a) of Executive Order 14042 (Ensuring Adequate COVID Safety Protocols for Federal Contractors). The Federal Acquisition Regulatory Council (FARC) is to conduct rulemaking and take related action to ensure that the Clause is incorporated into federal contracts. Until that happens, federal contractors likely will not see the Clause in its contracts. Following is a broad summary of the Guidance.