Brandon C. Ge

Brandon C. Ge is an associate in Crowell & Moring’s Washington, D.C. office, where he is a member of the firm’s Privacy & Cybersecurity and Health Care groups.

Brandon advises clients on a wide range of privacy and cybersecurity laws, regulations, and standards. His practice has a particular focus on advising clients – from start-up digital health companies to large health plans – on all aspects of compliance with the Health Insurance Portability and Accountability Act (HIPAA). Brandon regularly assists clients with responding to security incidents and has successfully represented clients in Office for Civil Rights investigations.

Firm/Organization: Crowell & Moring LLP

Blogs: C&M Health Law, Data Law Insights, International Trade Law, Retail & Consumer Products Law Observer

Latest Articles

Retail & Consumer Products Law Observer

California’s Landmark Privacy Law Now in Effect

By Jeffrey L. Poston, Paul Rosen, Kristin Madigan, Jarno Vanto, Brandon C. Ge & Lee Matheson CIPP/US, CIPP/E, CIPP/A, CIPM

January 23, 2020

On January 1, 2020, California’s landmark privacy law, the California Consumer Privacy Act (CCPA), took effect. The CCPA imposes various obligations on covered businesses and provides extensive rights to consumers with respect to controlling the collection and use of their personal information. While some companies have largely completed their CCPA compliance efforts, many others are still digesting the CCPA and draft proposed regulations, and taking steps to meet the CCPA’s myriad compliance obligations. Confusion persists…

C&M Health Law

OCR Announces First Enforcement Action Under Its Right to Access Initiative

By Brandon C. Ge & Jodi G. Daniel

September 11, 2019

On Monday, the Office for Civil Rights (“OCR”) at the U.S. Department of Health & Human Services (“HHS”) announced an enforcement action against Bayfront Health St. Petersburg (“Bayfront”) for allegedly failing to provide a mother timely access to her unborn child’s prenatal medical records. The enforcement action is noteworthy in that it marks OCR’s first enforcement action under its Right of Access Initiative, announced earlier this year to focus more on enforcing patients’ rights to…

C&M Health Law

New Proposed Rules on Confidentiality of Substance Use Disorder Data Would Address Care Coordination and Law Enforcement Challenges

By Jodi G. Daniel, Stephanie Willis, Brandon C. Ge & Maya Uppaluru

August 28, 2019

HHS’s Substance Abuse and Mental Health Services Administration (“SAMHSA”) proposed updated rules to clarify the scope of perceived barriers to sharing information regarding treatment for substance use disorders (SUDs) among providers, with research entities, and for law enforcement purposes. The proposed changes to the 42 C.F.R. Part 2 (“Part 2”) regulations appear in two Notices of Proposed Rulemaking (“NPRMs”), which are also summarized in a Fact Sheet. These proposals are part of HHS’s…

Data Law Insights

Ninth Circuit Rejects Facebook’s Article III Argument; Biometric Lawsuit Will Proceed

By Laura Foggan, Jeffrey L. Poston, Nathanial J. Wood & Brandon C. Ge

August 21, 2019

On August 8, 2019, the U.S. Court of Appeals for the Ninth Circuit issued yet another decision adopting relaxed standing requirements in privacy litigation, this time in a decision permitting a plaintiff to pursue claims under Illinois’s Biometric Information Privacy Act (BIPA). In Patel v. Facebook, the Ninth Circuit rejected arguments from Facebook Inc. (Facebook) that claims under the BIPA require assertions of real-world harm, and that BIPA claims only apply to conduct within Illinois.…

International Trade Law

Privacy & Cybersecurity – New York Enacts the SHIELD Act

By Jarno Vanto, Evan D. Wolff, Kate M. Growley, CIPP/G, CIPP/US & Brandon C. Ge

August 20, 2019

Late last month, New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act). In doing so, it has become the latest state to impose additional data security and breach notification obligations on businesses handling private data. The breach notification amendments take effect on October 23, 2019, while the data security requirements take effect on March 21, 2020. Expanded Breach Notification Requirements The SHIELD Act revises various definitions and increases the scope…

C&M Health Law

FDA Issues New Guidance for the Management of Cybersecurity in Medical Devices

By John Fuson, Jodi G. Daniel, Amber Mulcare & Brandon C. Ge

October 19, 2018

Yesterday, the FDA released draft guidance on the management of cybersecurity in medical devices submitted to the agency for premarket review. Noting that cybersecurity threats to the healthcare sector have increased in number and severity, the FDA offered new recommendations for device design, labeling, and documentation that medical device manufacturers will need to consider during premarket submission processes. The guidance comes shortly after the FDA’s launch of its Medical Device Cybersecurity Playbook, which provides…

Data Law Insights

Political Data Firm Improperly Accessed Facebook Users’ Data

By Jeffrey L. Poston, Peter B. Miller, CIPP/G/US, CIPP/E, CIPM, CIPT & Brandon C. Ge

March 27, 2018

Facebook faces government investigations on both sides of the Atlantic after recent revelations that Cambridge Analytica, a British political data firm with ties to President Trump’s 2016 campaign, collected and used the personal information of more than 50 million Facebook users in a manner that violates Facebook’s stated policy regarding access, disclosure, and use of personal information. Legislators in the U.S. and the UK have called for hearings. The Federal Trade Commission (“FTC”) has confirmed …

Data Law Insights

Ninth Circuit Revives Data Breach Class Action, Finds Risk of Identity Theft Without Actual Harm Sufficient to Establish Standing

By Brandon C. Ge, Nathanial J. Wood & Jeffrey L. Poston

March 13, 2018

Last week, the U.S. Court of Appeals for the Ninth Circuit revived a class action lawsuit related to a 2012 data breach, determining that the future risk of identity theft suffices to establish Article III standing, even where there has been no actual harm. At issue in the case, In re Zappos.com, was whether the plaintiffs had standing to bring claims based on a January 2012 data breach where hackers allegedly stole the personal information…

Data Law Insights

PayPal Settles FTC Claims Regarding Venmo’s Disclosure, Privacy, and Security Practices

By Brandon C. Ge & Peter B. Miller, CIPP/G/US, CIPP/E, CIPM, CIPT

March 2, 2018

On February 27, 2018, the Federal Trade Commission (“FTC”) announced a proposed administrative settlement with PayPal, Inc. over allegations that the company failed to make adequate disclosures to users regarding its Venmo peer-to-peer payment service. The settlement underscores the importance of effectively disclosing material information to consumers, including accurately communicating privacy and security practices and user control over optional settings. Specifically, the FTC alleged that Venmo…

Data Law Insights

New Texas Law Explicitly Allows Driverless Cars

By Jeffrey L. Poston & Brandon C. Ge

June 28, 2017

On June 15, Texas Gov. Greg Abbott signed a bill that explicitly allows self-driving cars on the state’s roads and highways, regardless of whether a human is physically present. While there was no ban on driverless cars, Texas law did not explicitly permit them either. This created a grey area of the law that fueled apprehension among manufacturers about testing self-driving cars in Texas. Senate Bill 2205 allows driverless vehicles to operate in the state…

Brandon C. Ge

California’s Landmark Privacy Law Now in Effect

OCR Announces First Enforcement Action Under Its Right to Access Initiative

New Proposed Rules on Confidentiality of Substance Use Disorder Data Would Address Care Coordination and Law Enforcement Challenges

Ninth Circuit Rejects Facebook’s Article III Argument; Biometric Lawsuit Will Proceed

Privacy & Cybersecurity – New York Enacts the SHIELD Act

FDA Issues New Guidance for the Management of Cybersecurity in Medical Devices

Political Data Firm Improperly Accessed Facebook Users’ Data

Ninth Circuit Revives Data Breach Class Action, Finds Risk of Identity Theft Without Actual Harm Sufficient to Establish Standing

PayPal Settles FTC Claims Regarding Venmo’s Disclosure, Privacy, and Security Practices

New Texas Law Explicitly Allows Driverless Cars

Stay Connected

Company

Support

New to the Network