Ray Everett

That's a wrap on another week in #healthcare. Highlights from an active week in regulatory developments across the country include: + The California Privacy Protection Agency proposes updates to the California Consumer Privacy Act regulations including new provisions regarding cybersecurity audits, risk assessments, and automated decision-making technology. Final rules are set to be in effect by summer 2025. https://lnkd.in/e-9KFMbp + OIG issues Advisory Opinion 24-5, a mixed opinion regarding proposed assistance for: (i) travel, lodging, meals, and associated expenses; and (ii) fertility preservation services for qualifying patients receiving one of two gene therapy treatments developed by a publicly traded biotechnology company. https://lnkd.in/eEA32jDF + OIG issues Advisory Opinion 24-06, an unfavorable opinion regarding proposed assistance for fertility services for qualifying patients receiving a gene therapy treatment developed by a biotechnology company. https://lnkd.in/eH2DbbxN + A U.S. District Court Judge for the Eastern District of Pennsylvania upheld the FTC’s noncompete rule in ATS Tree Services, LLC v. FTC, diverging from an earlier ruling by the Northern District of Texas https://lnkd.in/eKDth2dz + New York Cancer & Blood Specialists obtained an arbitration award of $22M against Caremark as a full return of all direct and indirect remuneration fees https://lnkd.in/d62SUuY8 + The National Community Pharmacists Association along with dozens of providers file a class action lawsuit against UnitedHealth Group regarding losses stemming from the Change Healthcare cybersecurity breach https://lnkd.in/eUPbQj9m + CVS Caremark is set to pay the State of Illinois $45M to settle allegations that the company did not pass through rebates during a four-year period, Stat News reports https://lnkd.in/erfMfYZm + Prime Healthcare acquires 13 Ascension Illinois facilities https://lnkd.in/e_gFfcyu + Molina Healthcare acquires ConnectiCare, a subsidiary of EmblemHealth, for $350M https://lnkd.in/ec4bkavS + Atlanta-based startup Loyal, a healthcare technology company centered on digital patient engagement, raised $33.5m in Series B funding https://lnkd.in/emnBWyxF

4

Thank you IAPP - International Association of Privacy Professionals for this important update on the new Colorado Privacy Act draft rules: "Colorado's attorney general released new draft rules under the Colorado Privacy Act. Among the proposed regulations are the establishment of a process for attorney general opinion letters and interpretive guidance as well as clarifications around children's and biometric privacy provisions following 2024 legislative action. There will be a public consultation beginning 25 Sept. that culminates with a formal rulemaking hearing 7 Nov." (link below) #DataPrivacy #Regulations #ColoradoPrivacyAct #CPA #PrivacyLaw

4

1 Comment

'Covered data' under the proposed American Privacy Rights Act: A cursory search of the American Privacy Rights Act discussion draft does not yield the term "personal data." IAPP Westin Research Fellows Andrew Folks, CIPP/E, CIPP/US, CIPM, and Luke Fischer explain how drafters "eschewed attaching the modifier 'personal' to the elemental definition of the data it covers," instead using a "covered data" terminology that "draws heavily from privacy and data protection regimes in the states and abroad." Full story #dataprotection #dataprivacy #privacy

2

(JDSUPRA) On May 24, 2024, Minnesota’s governor signed an omnibus bill, HF4757 which included the new Consumer Data Privacy Act. The state joins Kentucky, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island in passing consumer data privacy laws this year. 🔹 Minnesota’s law takes effect July 31, 2025, except that postsecondary institutions and nonprofit corporations governed by Minnesota Statutes, chapter 317A, are not required to comply until July 31, 2029. #state #data #dataprivacy #law #consumerprivacy #regulations #regulatorycompliance #Minnesota #statutes https://lnkd.in/eiqMyj_E

2

The Oregon Consumer Privacy Act (OCPA) was signed into law on July 18, 2023, and is set to take effect on July 1, 2024, aligning with the new Texas privacy law. However, for non-profit organizations, compliance is required starting July 1, 2025. https://lnkd.in/eNyybXu9 Is your organization prepared for these changes? Stay ahead of the curve with our comprehensive guides! Request your copy Clarip's Oregon Consumer Privacy Act white paper today to ensure you're ready for compliance. 📄 Get your copy now: https://lnkd.in/eNygKN8x #OCPA #PrivacyLaw #DataGovernance #DataRights #Compliance #OregonLaw #NonProfit #Clarip

11

Check out the IAPP - International Association of Privacy Professionals updated APRA cheat sheet summarizing the key points of the discussion draft. #APRA #PrivacyLaw #DataPrivacy #IAPP

3

🗓️ Mark your Calendars! 🗓️​​​​​​​​​ Whether you’re a seasoned forensic scientist or new to crime scene investigations, this webinar will equip you with the knowledge and confidence to recognize, document, and leverage impression evidence to enhance your case outcomes. Just a few key takeaways from this webinar: ✔️ Learn where to find often-overlooked shoe and tire impressions at crime scenes. ✔️ Discover why this type of evidence is crucial for building stronger cases. ✔️ Gain practical tips for documenting and collecting impression evidence with limited resources. ✔️ Understand how to make the case for collecting impression evidence, even when others don’t see its value. All the Deets: Instructor: Sam Marso Date: Monday, November 18, 2024 Times: 2:00pm – 3:00pm EDT Location: Wherever you can login! Tuition Cost: $75.00 Register Here: https://lnkd.in/eeUvqQC4 #GapScience #ImpressionEvidence #VirtualLearning #ProfessionalDevelopment #ForensicScience

4

NEW FROM CIPL: Automated Decisionmaking and Profiling Requirements in U.S. State Privacy Laws, and Current State of Play in State AI Regulations In this paper, we examine requirements regarding automated decisionmaking and profiling included in comprehensive state privacy laws. This report also explores notable state-level AI regulations. Our goal is to help state lawmakers and policymakers in the US advance the principles of privacy and data protection in a more consistent and manageable way.   Key recommendations include: - Lawmakers and regulators should avoid forcing organizations to create separate opt-out mechanisms for each state, resulting in inefficient use of resources and time that could be better allocated for implementing meaningful privacy protections.   - Lawmakers and regulators should clarify whether and to what extent human intervention in the automated process will exempt the processing activity from falling within the scope of profiling rules, with the aim of greater consistency between global and domestic requirements.   - Organizations need illustrative examples of profiling producing legal or similarly significant effects and parameters for the threshold to be reached. This will provide clarity and consistency to organizations, although they should also be able to rebut the presumption of those examples producing legal or similarly significant effects in practice.   - States’ transparency and notice disclosure requirements should be principles-based, given that there are countless AI contexts and appropriate transparency may look very different for different AI applications.   - Privacy rules should not be interpreted by state lawmakers and regulators in a way that requires organizations to provide “full transparency” of algorithms (i.e. disclosure of source code or extensive descriptions of the inner workings of algorithms, including scoring models) when responding to a consumer's access request.   - As additional states begin to pass AI regulations, organizations are proactively working to develop and implement a global AI baseline that considers emerging requirements, as well as leading regulations and standards such as the EU AI Act and the NIST Risk Management Framework. However, there is growing concern about the feasibility of managing such a strategy in the near future, particularly with signals of a forthcoming wave of state-level AI regulation, each with unique definitions, requirements, and standards.   For more information about our findings, recommendations, and other insights, download the full discussion paper here: https://lnkd.in/eymcBSwX #ai #artificialintelligence #usa #research #adm #profiling

28

2 Comments

#eDiscovery technology can automate many steps in the FOIA workflow, such as data retrieval, analysis, redaction, and processing. It can also provide intelligent data analysis and decision support, ensuring accuracy and compliance. Explore best practices, innovative solutions, and the future of FOIA management in an increasingly digital world.

3

📣 Just Released! The 2024 Link Index™ for Privacy and Consent Management features the top 15 vendors, making it easier for businesses to manage data privacy, consent tracking, and regulatory compliance. 🔗 https://hubs.ly/Q02FTvSK0 As regulatory pressures increase and legacy data systems risk data breaches and reduce security, businesses need advanced solutions that leverage analytics such as AI and machine learning, offer real-time compliance monitoring, and provide data governance tools to enhance compliance, streamline operations, and mitigate risks. Access the Link Index™ to determine where the vendors rank and which solutions lead in product execution and strategy. #PrivacyManagement #DataGovernance #Compliance #TechInnovation #BusinessGrowth #AI #MachineLearning #DataPrivacy #ConsentManagement #RegulatoryCompliance

19

FCC to Consider Formal Rules for Use of Artificial Intelligence and Robocalls - The National Law Review: FCC to Consider Formal Rules for Use of Artificial Intelligence and Robocalls  The National Law Review http://dlvr.it/T9zgCk #ai #artificialintelligence

1

Tired of the same old options? Check out the GigaOm Radar Report for E-Discovery to learn why OpenText should be on your shortlist. #AI #eDiscovery #LegalTech

22

Should hyperlinks in email be treated as "modern attachments"? It's the eDiscovery debate of the moment. Level Legal Vice President of Digital Forensics David A. Greetham, CEDS, CIGO, CFE helps you make up your mind. 👇 https://lnkd.in/gTqerdvQ #eDiscovery #Hyperlinks #LegalInnovation

2

#NEW: FPF’s resource covers over twenty state privacy laws and their key dates. It is intended to serve as a one-stop shop for assisting stakeholders in tracking the emerging state privacy landscape. The resource covers critical information and answers questions such as: ➡️When does enforcement begin? ➡️When do cure periods expire? ➡️When are the deadlines for controllers to begin recognizing opt-out preference signals? Read the updated chart now:  https://fpf.org/statelaws

7

Check out these insights! Thanks, James E. Lee, for your suggestion.

3

California's Privacy Regulator Issues Enforcement Guidance on How To Avoid "Dark Patterns" in Obtaining Consumer Consent: On September 4, 2024, the California Privacy Protection Agency ("CPPA") announced that it issued an Enforcement Advisory ("Advisory") providing guidance on how to avoid using prohibited "Dark Patterns" to obtain consent from consumers. Businesses subject to the California Consumer Privacy Act (CCPA) routinely request consent from consumers related to their personal information and in handling consumer requests to exercise their statutory rights regarding their personal information...... By: Davis Wright Tremaine LLP #dataprotection #dataprivacy #privacy

4

𝗖𝗮𝗹𝗶𝗳𝗼𝗿𝗻𝗶𝗮 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗔𝗴𝗲𝗻𝗰𝘆 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝘀 𝗔𝗜 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻𝘀 The California Privacy Protection Agency (CPPA) has signaled it will advance rulemaking at its upcoming November 8 board meeting to place restrictions on the use of automated decision-making technology (ADMT) and impose new obligations to require businesses to conduct cybersecurity audits and risk assessments. The agency has grappled with these issues for more than two years, including soliciting formal comments in a February 2023 invitation for preliminary comments and conducting other stakeholder outreach. For more details on the upcoming regulations, check out the latest Ad Law Access article from Alysa Hutnik, Aaron Burstein, and Alexander Schneider: https://lnkd.in/e3zNVDE7 #CaliforniaPrivacy #CyberSecurity #AI #CPPA #RegulatoryUpdates #ADMT #DataProtection #KelleyDrye

11

CPPA AI Rules Cast Wide Net for Automated Decisionmaking Regulation: Originally published by Truyo. Written by Dan Clarke.At the end of 2023, the California Privacy Protection Agency (CPPA) unveiled draft regulations aimed at automated decision-making technology (ADMT), including artificial intelligence (AI), to bolster consumer protections in the state. This step underscored California’s commitment to individual privacy rights and represents a critical development in the ever-evolving landscape of data governance and AI ethics.At the most recent CPPA meeting,...

1