Offshoring Patient Health Data: Navigating Complex Federal and State Privacy Regulation, Mitigating Client Risk

Ms. Metnick advises healthcare organizations and digital health companies on regulatory and data governance challenges at the intersection of privacy, security and artificial intelligence. She focuses on HIPAA, other health information laws, data strategy and security incident response—helping clients deploy innovative technologies while managing compliance risks across federal and state privacy frameworks. As the founder and leader of Sheppard Healthy AI, Ms. Metnick brings together a cross-disciplinary team dedicated to the compliant development, deployment and use of AI in healthcare. The initiative guides stakeholders through governance, vendor contracting, notice/consent and risk allocation—aligning emerging technologies with evolving laws, regulations and industry best practices. Ms. Metnick counsels hospitals, health systems, physician organizations, payors and technology companies on the full life cycle of health information and all related issues. Her work includes structuring data-sharing collaborations, developing privacy and security programs, responding to security incidents and navigating federal and state privacy laws. She is a Certified Information Privacy Professional/United States and a Certified Information Privacy Professional/Europe.

Mr. Sutton specializes in health care privacy, digital health and related regulatory compliance and transactional matters. With a deep understanding of HIPAA, data usage and emerging health care technologies, he helps clients navigate complex legal landscapes as they leverage the latest innovations in the health care space. Mr. Sutton focuses on HIPAA and privacy related regulations and their interplay with technological developments both inside and outside of the healthcare and consumer spaces. He is well versed in negotiations centered on data usage and derivative ownership rights. Mr. Sutton maintains significant experience in guiding clients seeking to market or integrate technological innovations, such as ordering and support platforms, remote patient monitoring tools, electronic medical record systems, artificial intelligence, and other offerings centered on collecting, storing, and transmitting patient data to support care, reimbursement, and related activities.