Paul Otto

Firm/Organization: Hogan Lovells

Blogs: Focus on Regulation, Global Media and Communications Watch, HL Chronicle of Data Protection

Latest Articles

OCR Provides Insight into Enforcement Priorities and Breach Trends

By Marcy Wilder, Paul Otto & Katherine Kwong

October 21, 2019

Regulators, industry experts, and researchers provided insight into health privacy and security enforcement trends, emerging threats, and new tools at a recent conference focused on the Health Insurance Portability and Accountability (HIPAA) regulatory framework. Moving into 2020, organizations with health data should be aware of: Shifting OCR enforcement priorities; Regulators’ continued attention to key HIPAA compliance activities; The changing threat landscape for health data; and New guidance and frameworks for health data not…

Global Media and Communications Watch

New York Enacts New Data Security Laws

By Paul Otto, W. James Denvil, Julian Flamant & Peter Marta

August 12, 2019

On July 25, New York Governor Andrew Cuomo signed into law a pair of bills establishing new requirements for businesses that process certain personal information related to New York residents. The changes include expanding the scope of information covered by New York’s data breach notification law; defining breaches to include incidents involving unauthorized access to covered information, even where the information is not acquired; and requiring consumer reporting agencies who suffer breaches of social security…

HL Chronicle of Data Protection

New York Enacts New Data Security Laws

By Paul Otto, Peter Marta, James Denvil & Julian Flamant

August 8, 2019

Global Media and Communications Watch

IoT Webinar Series: Cyberthreats in the Internet of Things

By Paul Otto, Allison Holt-Ryan & Nathan Salminen

July 19, 2019

On July 16, 2019, Nathan Salminen, Allison Holt, and Paul Otto from the Hogan Lovells Privacy and Cybersecurity and Litigation teams presented a webinar, “Cyberthreats in the Internet of Things” where they explored some techniques that can be used to exploit potential vulnerabilities in connected devices and how those types of events impact organizations from a regulatory and litigation perspective. Many of the nearly 20 billion Internet of Things (IoT) devices deployed worldwide perform critical…

HL Chronicle of Data Protection

NIST Continues to Make Progress on its Privacy Framework

By Harriet Pearson, Paul Otto, Laurie Lai & Julian Flamant

May 20, 2019

While eyes focus on the privacy legislative debate now underway in the United States, the development of a new Privacy Framework by the influential National Institute of Standards and Technology (“NIST”) is also worthy of attention. On May 13-14, 2019, NIST hosted its second workshop on the recently released discussion draft of its “Privacy Framework: An Enterprise Risk Management Tool” (“Privacy Framework”). The workshop brought together stakeholders to provide feedback on the draft and suggest…

HL Chronicle of Data Protection

HIPAA Penalty Caps to Be Reduced and Tied to Culpability Level

By Marcy Wilder, Scott Loughlin, Paul Otto, Shee Shee Jin & Jonathan Hirsch

April 29, 2019

In a dramatic turn, the US Department of Health and Human Services (HHS) has announced that effective immediately, penalties for many HIPAA violations will be subject to substantially reduced limits. After a record year of collecting high-dollar settlements, the agency has pulled back and tied its own hands through a Notification of Enforcement Discretion that will likely result in lower penalties and settlement agreement amounts.…

HL Chronicle of Data Protection

FTC Seeks Comment on Proposed Changes to GLBA Implementing Rules

By Timothy Tobin, Paul Otto & Roshni Patel

March 14, 2019

The Federal Trade Commission (“FTC”) issued notices on March 5 seeking public comment on proposed amendments to the regulations implementing the Gramm-Leach-Bliley Act (“GLBA”), commonly known as the Safeguards Rule and Privacy Rule. Once the notices are published in the Federal Register comments must be received within 60 days. The proposed changes to the Safeguards Rule add a number of more detailed security requirements, whereas the proposed changes to the Privacy Rule are more…

HL Chronicle of Data Protection

California Consumer Privacy Act: The Challenge Ahead – The CCPA’s “Reasonable” Security Requirement

By Bret Cohen, Paul Otto, Nathan Salminen & Morgan Perna

February 7, 2019

This is the eleventh installment in Hogan Lovells’ series on the California Consumer Privacy Act. Much of the focus on the California Consumer Privacy Act (“CCPA”) has been on the new rights that it affords California consumers, including the rights to access, delete, and opt out of the sale of their personal information. But arguably the greatest risk to covered businesses involves data security, as the CCPA creates for the first time a private right…

HL Chronicle of Data Protection

Recap of the OCR/NIST Conference on Safeguarding Health Information

By Marcy Wilder, Paul Otto & Asmaa Awad-Farid

November 16, 2018

Regulators provided key insights into enforcement trends and potential changes to HIPAA regulations at the 11th Annual “Safeguarding Health Information: Building Assurance Through HIPAA Security” conference in October co-hosted by the National Institute of Standards and Technology (NIST) and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR).…

HL Chronicle of Data Protection

Proposed Changes to FDA Guidance for the Content of Premarket Submissions for Management of Cybersecurity in Medical Devices: What you Should Know

By Yarmela Pavlovic, Randy J. Prebula, Jodi Scott, Danielle Humphrey, Lina R. Kontos, Paul Otto & W. Alex Smith

October 25, 2018

October is National Cybersecurity Awareness Month and the Food and Drug Administration (FDA or the agency) has been busy. On October 18, 2018, FDA issued a long-awaited draft revision to its existing guidance “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices“(premarket cybersecurity guidance). This coincided with release of the FDA-supported “Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook” for health delivery organizations (HDOs), the announcement of two…

Paul Otto

OCR Provides Insight into Enforcement Priorities and Breach Trends

New York Enacts New Data Security Laws

New York Enacts New Data Security Laws

IoT Webinar Series: Cyberthreats in the Internet of Things

NIST Continues to Make Progress on its Privacy Framework

HIPAA Penalty Caps to Be Reduced and Tied to Culpability Level

FTC Seeks Comment on Proposed Changes to GLBA Implementing Rules

California Consumer Privacy Act: The Challenge Ahead – The CCPA’s “Reasonable” Security Requirement

Recap of the OCR/NIST Conference on Safeguarding Health Information

Proposed Changes to FDA Guidance for the Content of Premarket Submissions for Management of Cybersecurity in Medical Devices: What you Should Know

Stay Connected

Company

Support

New to the Network