Marcy Wilder

Firm/Organization: Hogan Lovells

Blogs: Focus on Regulation, Global Media and Communications Watch, HL Chronicle of Data Protection

Latest Articles

New York Regulators Lead the Charge to Fill Health Data Protection Gaps Left by Federal Law

By Marcy Wilder, Donald DePass & Shee Shee Jin

April 27, 2017

New York AG Settles Data Protection Enforcement Against Mobile Health Apps After a year-long investigation into mobile health apps claiming to be able to measure vital signs or health indicators through smartphone sensors, the New York Attorney General (NY AG) settled claims against three developers alleged to have engaged in “misleading” marketing claims and “irresponsible” privacy practices. Mobile health apps Cardiio and Runtastic claimed that their apps effectively and accurately measured heart rate after vigorous…

Global Media and Communications Watch

New HHS Guidance Makes Clear HIPAA Applies in the Cloud

By Marcy Wilder, Donald DePass & Brian Kennedy

November 8, 2016

Cloud service providers are on notice: you are HIPAA business associates, even if you are unable to access the HIPAA protected information in your cloud. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released guidance making clear that cloud service providers (CSPs) that create, receive, maintain, or transmit electronic protected health information (PHI) are covered by HIPAA. The guidance is notable for its broad scope. Whether a CSP offers a…

HL Chronicle of Data Protection

New HHS Guidance Makes Clear HIPAA Applies in the Cloud

By Marcy Wilder, Donald DePass & Brian Kennedy

October 26, 2016

Global Media and Communications Watch

ONC Report Identifies Gaps in Data Protection for Health, Wellness, and Fitness Data

By Marcy Wilder & Donald DePass

August 11, 2016

A new report from the Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC) highlights data protection gaps in the U.S. for health data from wearable devices, social media, and emerging technologies. The report, “Examining Oversight of the Privacy & Security of Health Data Collected by Entities Not Regulated by HIPAA,” identifies several areas in which privacy and security protections for health data have lagged…

Global Media and Communications Watch

HHS Issues New Guidance on Ransomware and HIPAA

By Marcy Wilder, Madeline Gitomer & Brian Kennedy

August 5, 2016

The Department of Health and Human Services (HHS) released guidance on July 11, 2016, intended to help the healthcare industry prepare for and respond to ransomware attacks. Specifically, this guidance clarifies: (1) that a ransomware attack is considered a “security incident” under HIPAA, and (2) that a ransomware attack will typically be considered a “breach” by HHS unless entities are able to demonstrate that there is a “low probability of compromise.” The guidance also clarifies…

HL Chronicle of Data Protection

ONC Report Identifies Gaps in Data Protection for Health, Wellness, and Fitness Data

By Marcy Wilder & Donald DePass

August 3, 2016

HL Chronicle of Data Protection

HHS Issues New Guidance on Ransomware and HIPAA

By Marcy Wilder, Allison Bender, Madeline Gitomer & Brian Kennedy

July 29, 2016

HL Chronicle of Data Protection

FTC Releases Web Tool for Mobile Health App Developers

By Marcy Wilder, Madeline Gitomer & Katherine Gasztonyi

April 6, 2016

The FTC released this week a web-based tool to assist mobile app developers in determining which federal privacy laws apply to their mobile health applications. The tool asks developers a series of ten targeted questions that help a user determine whether HIPAA, FTC, and/or FDA rules and regulations might apply. The interactive developer tool presents users with questions that include topics such as: the type of information the app will create, receive, maintain, and transmit…

HL Chronicle of Data Protection

OCR Releases Updated Audit Protocol

By Marcy Wilder, Paul Otto & Madeline Gitomer

April 4, 2016

The revamped audit protocol for the upcoming HIPAA Phase 2 audits has been released by the US Department of Health and Human Services Office for Civil Rights (OCR). The audit protocol, which is posted on the HHS website, includes new requirements added by the 2013 Omnibus Final Rule for HIPAA covered entities and business associates. The Phase 2 audits will be more focused, and the stakes will be higher: the agency has indicated that audits…

Global Media and Communications Watch

OCR Highlights Priorities as it Steps Up HIPAA Enforcement

By Marcy Wilder & Madeline Gitomer

April 1, 2016

Last week, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) launched the long-awaited Phase 2 HIPAA Audit Program. Earlier this month, the agency posted two resolution agreements that continue the trend toward big dollar settlement amounts and a focus on security risk assessments and business associate agreements. With Phase 2 HIPAA Audits underway and more full-scale compliance reviews triggered by data breach reports, it is more important than ever to appropriately…

Marcy Wilder

New York Regulators Lead the Charge to Fill Health Data Protection Gaps Left by Federal Law

New HHS Guidance Makes Clear HIPAA Applies in the Cloud

New HHS Guidance Makes Clear HIPAA Applies in the Cloud

ONC Report Identifies Gaps in Data Protection for Health, Wellness, and Fitness Data

HHS Issues New Guidance on Ransomware and HIPAA

ONC Report Identifies Gaps in Data Protection for Health, Wellness, and Fitness Data

HHS Issues New Guidance on Ransomware and HIPAA

FTC Releases Web Tool for Mobile Health App Developers

OCR Releases Updated Audit Protocol

OCR Highlights Priorities as it Steps Up HIPAA Enforcement

Stay Connected

Company

Support

New to the Network