Tracking Health Information Using Online Technologies: New OCR Guidance, HIPAA Obligations for Regulated Entities

Mr. Blaney’s practice focuses on regulatory compliance, enforcement, litigation and transactions in the areas of data privacy, cybersecurity, healthcare, and emerging technologies. He advises private equity, asset managers, healthcare, life sciences, retail and technology clients on privacy and cybersecurity compliance, cybersecurity incidents and government investigations, including acting as lead counsel in defending clients in regulatory investigations by HHS-OCR, DOJ, FTC, FCC and State Attorneys General. Mr. Blaney counsels clients on federal, state, and international privacy and security laws including California Consumer Privacy Act, EU GDPR, and HIPAA, among others. He has expertise counseling clients on emerging artificial intelligence, digital health, healthcare fraud and abuse, third-party reimbursement and FDA regulatory matters. He also has substantial experience in defending healthcare clients in False Claims Act qui tam matters and has obtained several declinations and dismissals

Ms. Brennan focuses her practice on matters relating to intellectual property, information technology, software licensing and procurement, advertising technologies and digital marketing solutions, data privacy and security, and data breach and incident response. She advises clients on a variety of data governance regulations, including GDPR, HIPAA, and state laws governing personally identifiable information, such as CCPA. She also counsels clients on compliance with various information security standards, including HIPAA/HITECH, NIST, and ISO, and represents clients in responding to information security incidents.

Prior to joining Taft, Ms. Brennan was an associate at the largest health care-focused law firm in the country and focused her practice on information privacy and security as well as emerging technologies in health care, such as telemedicine, medical apps, and artificial intelligence. She holds the Certified Information Systems Security Professional (CISSP) certification and has presented and written extensively on the topics of cybersecurity and third-party risk management.

Mr. Swearingen has practiced in the area of health information privacy and security for over 20 years, with particular focus on HIPAA compliance, data breach response, government investigations, HIPAA audits and 42 C.F.R. Part 2. Since the HIPAA Breach Notification Rule was issued in 2009, he has handled a substantial number of healthcare data breaches, including cases involving ransomware, email phishing, lost/stolen devices, insider threats and medical devices. Mr. Swearingen regularly guides clients through government investigations of privacy and security incidents and has successfully negotiated resolutions and settlements with both federal and state agencies. He also advises clients on issues relating to emerging technologies, such as telemedicine, medical apps and artificial intelligence. He has worked with a broad spectrum of organizations, including health systems, hospitals, physician practices, health plans, governments, technology companies and business associates. Mr. Swearingen speaks and writes frequently, both regionally and nationally, on healthcare privacy and security matters.