$999,000 in HIPAA settlements for unauthorized disclosure of patients’ protected health information

Posted on by Federica Romanelli
On September 20, 2018, the Department of Health and Human Services, Office for Civil Rights (OCR) announced that it reached settlement with several medical centers after they allegedly compromised patients’ protected health information (PHI) by inviting film crews on premises to film an ABC’s television documentary series, without first obtaining authorization from patients. According to the settlements, to resolve potential HIPAA violations, the entities will pay around $1 million fine and Read more [...]

The California Consumers Privacy Act

Posted on by Federica Romanelli
On June 28, 2018, California passes Bill 375 (Chau, Hertzberg, Dodd), which will provide Californians with fundamental new consumer privacy rights. In summary, the broad private right of action in the initiative covers instances of data breach – violations are subject to enforcement by the Attorney General – the right to know all a consumer’s personal information for free twice a year, the right to delete, and opt-in for consumers under 16 years old. The legislation goes into effect in Read more [...]

Carpenter v. United States

Posted on by Federica Romanelli
Carpenter v. United States, 201 L. Ed. 2d 507, 2018 U.S. LEXIS 3844, 138 S. Ct. 2206, 86 U.S.L.W. 4491, 27 Fla. L. Weekly Fed. S 415, 2018 WL 3073916 SCOTUS decided Carpenter vs US: police needs a warrant to search past location data from a suspect’s cellphone  On June 22, 2018, the Supreme Court decided an important privacy case. The Supreme Court reversed and remanded the Sixth Circuit’s decision holding that the protection granted under the Fourth Amendment does prevent the government Read more [...]

The CLOUD Act: significant changes to cross-border access to data held by communication-service providers

Posted on by Federica Romanelli
On March 23, 2018, the omnibus spending bill was signed into law; a portion contains the Clarifying Lawful Overseas Use of Data Act (CLOUD Act). The CLOUD Act’s main goal is to grant governments timely access to electronic data stored by communication-service providers (such as email service providers, certain cloud service providers and social media providers). The Act allows US law enforcement authorities to access data stored abroad as well as foreign authorities to directly seek disclosure Read more [...]

South Dakota’s data breach notification statute

Posted on by Federica Romanelli
On March 21, 2018, South Dakota adopted a data breach notification statute. According to the South Dakota Statute, any “information holder” must comply. An “Information holder” is any person or business that conducts business in South Dakota and owns or licenses “personal information” or “protected information” of residents of South Dakota. The statute is added as a new section to SD Codified Laws Chapter 22-40 and it became effective July 1, 2018. 2018 South Dakota Read more [...]