Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

Client Alert
November 15, 2018

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

Cybersecurity
Client Alert

Department of Education Proposes Redefinition of “Professional Degree,” Excluding Nursing and Limiting Graduate Loan Borrowing

February 20, 2026The U.S. Department of Education has issued a Notice of Proposed Rulemaking that would redefine “professional degree” programs under the One Big Beautiful Bill Act. The proposal excludes nursing from the recognized list and would impose new borrowing limits for graduate students while eliminating the Grad PLUS program. Public comments are due by March 2, 2026.Client Alert

First-of-Its-Kind Federal Ruling Finds Use of Consumer AI Tool May Destroy Attorney-Client Privilege

February 17, 2026On February 10, 2026, Judge Jed Rakoff of the U.S. District Court for the Southern District of New York issued a first-of-its-kind ruling finding that documents generated by a criminal defendant using a consumer AI platform were not protected by attorney-client privilege after being shared with counsel. The court treated the AI tool as a third party, concluding that entering sensitive information into a publicly available platform may waive confidentiality. The ruling also suggests that the work product doctrine may not apply where AI-generated materials are created independently by a client rather than at counsel’s direction. The decision signals that parties should exercise caution when using consumer AI tools in connection with legal matters.Client Alert

Your Golden Chance for H-1B Lottery Registration - March 2026

February 16, 2026USCIS H-1B registration opens March 4–19, 2026. U.S.-based employees on valid nonimmigrant status are exempt from the $100,000 fee for change of status petitions. The new weighted lottery favors higher-skilled and higher-paid employees, improving odds for advanced degree holders and Wage Level 3 or 4 workers.Client Alert

Invisible Algorithms: The Hidden Role of Artificial Intelligence in USCIS Immigration Processing

February 10, 2026The Department of Homeland Security has confirmed that artificial intelligence and machine learning tools are now integrated into numerous operational functions within U.S. Citizenship and Immigration Services (USCIS). These tools are described as mechanisms to improve efficiency, reduce backlogs, and assist officers in managing an unprecedented volume of applications. DHS emphasizes that human adjudicators retain decision-making authority and that AI systems do not independently grant or deny immigration benefits. Find out how AI affects the U.S. immigration process.Client Alert

OAAPN | Year In Review: 2026 Ohio Board of Nursing and Ohio Law Rules

February 9, 2026Find out key changes to Ohio law and the Ohio Board of Nursing rules that have directly impacted APRN practice over the past year, including Psychiatric Inpatient Documents, Intimate Examinations, Signature Authority, Duties Related to Fetal Death, Retail IV Therapy Clinics, Release from Permanent Restrictions, Disciplinary Action, Course on Drugs and Prescriptive Authority, Overdose Reversal Drugs, Office Based Opioid Treatment, Withdrawal Management for Substance Use Disorder, Safe Haven Program, and more.
Older posts