Data Strategy, Privacy and Security

With the increased regulatory focus and media attention on privacy issues related to vendor management, we assist clients in negotiating privacy provisions in payments, marketing, cloud services and analytics contracts, as well as in transactions involving:

• Electronic health records systems
• Equipment
• Medical billing systems
• Point of sale (POS) systems
• Radio frequency identification (RFID) tags
• Software licenses
• Technology services

Our work also includes advising clients on:

• Emerging opportunities relating to analytics and big data
• Privacy and data security challenges related to the Internet of Things (IOT)
• Emerging legal issues surrounding online and e-commerce business operations
• Practical methods to minimize privacy and data security risks
• Negotiating cyber insurance policies covering data breaches and other cyber issues

We help our clients ensure that their marketing campaigns and other promotional activities are compliant with state and federal laws, regulations and guidelines.

Our attorneys have substantial experience advising on consumer disclosures and disclaimers relating to:

• Accessibility
• Advertising
• Biometrics
• Direct mail campaigns
• Email marketing
• Escheat issues
• Gift card and customer loyalty programs, contests and promotions
• Infomercials
• Merchandise return policies
• Mobile applications
• Order fulfillment
• Rebates
• Restrictions on card expiration and loss of value
• Telemarketing
• Text messaging
• Transaction processing

Our experience extends to the unique joint marketing, customer service and contracting issues that are raised by private label and affinity credit card programs.  We also negotiate third-party provisions of email marketing and call center services, as well as contracts for the services of actors, musicians, models and other talent hired for marketing initiatives.

When claims of deceptive or unfair trade practices arise, we help clients respond to consumer complaints, investigations and enforcement actions brought by federal and state regulators. 

With deep experience in the developing area of health information privacy and security, our attorneys advise clients on the confidentiality of medical information, including compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the patchwork of state laws.

We help clients navigate the rapidly changing fields of health information exchanges and data sharing, electronic health records, telehealth services, paper and electronic data privacy and security, health information management, and state and federal discovery rules for electronically stored information (ESI).

We have advised large health care providers and trade associations on the full spectrum of legal issues pertaining to HIPAA and privacy compliance, including: 

• Developing HIPAA privacy policies and procedures
• Federal financial incentives for the development of electronic health records HIPAA/privacy compliance training
• Health information exchange (HIE) issues
• Interoperability and information blocking
• Production of individually identifiable health information in response to discovery requests, court orders, law enforcement investigations and public health concerns
• State and federal notice of breach requirements
• Telehealth privacy issues
• Third-party service vendors’ information systems and related privacy issues

Every employer holds some form of sensitive information about their employees, whether it’s human resources data, employee health records or employee email accounts.  We help our clients protect that data while retaining their own ability to access information when they need it, whether data is stored on their own servers, on their employees’ personal devices or in the cloud.

Backed by an international network of local counsel, Vorys spearheads the creation and coordination of global privacy programs for clients’ international businesses.  We advise on best practices for collecting data in foreign jurisdictions, such as the European Union (EU), Canada and the Asia-Pacific Economic Cooperation (APEC) regions, and counsel clients on transferring and sharing data across international borders.  Vorys is a member of Ally Law, a network of more than 70 select, business-oriented law firms operating in more than 50 countries.

Preparing for a data breach is an essential element to any cybersecurity strategy, particularly now that some incidents are required to be reported to certain regulators within hours of discovery.  We train our clients’ directors, executives, and employees on relevant privacy and information security issues and use tabletop exercises that simulate crisis situations to test plans, identify potential gaps and develop muscle memory to position clients’ incident response teams to efficiently and effectively manage future incidents.

We customize our tabletop exercises based on our clients’ goals, which often include:

• Introducing Response Plans: educate and train stakeholders on their roles and responsibilities when a data breach occurs
• Testing Response Plans: simulate how a particular department or the entire enterprise adheres to existing incident response plans, including internal information security teams and third-party vendor investigations of potential incidents
• Refining Response Plans: identify gaps in a response plan and modify it to facilitate improvements

What To Expect

Prior to a tabletop exercise, we thoroughly vet which participants to include in the simulation, we ask questions that allow us to maximize our customization of the program and fit the exercise to the organization’s IT environment.

The Exercise

The objectives of our exercises are three-fold:

• We observe your incident response plan in action and discuss revisions
• We consider appropriate roles and responsibilities for each of the participants involved
• We document, discuss and share the lessons we have collectively learned to make appropriate changes

Although completely customizable, our exercises operate under the guidance that all key stakeholders must participate and respond to the scenario as if it is a real event, and participants must help create an environment in which all questions and input are welcome.

Vorys regularly partners with technical experts and moderators to facilitate realistic exercises based on current threats and often records training sessions to track issues as we progress through the exercise.

Group Discussion

After each exercise, we facilitate a discussion covering lessons learned and recommended changes.

Questions discussed may include:

• Who are the stakeholders who need to be included in incident response?
• Does the client’s insurance policy require notification of potential events in a certain timeframe and/or use of certain vendors?
• Are there other parties that would require notice of a potential event?
• Have all stakeholders been trained on invoking attorney-client privilege?
• What is the organization’s risk tolerance in these scenarios?
• What are the appropriate escalation protocols, including escalation to senior management and the board?
• Is the organization fully aware of its potential legal obligations in these situations?
• How can the organization best protect itself during these crises?

After a tabletop exercise is completed, we produce specific deliverables as discussed with each client, which typically include detailed recommendations to strengthen incident response plans.

• Representing payment processors in data breach cases of first impression in the First, Third and Fifth U.S. Circuit Courts of Appeals – each resulting in precedent-setting opinions that are largely upheld today
• Representing one of the nation’s largest financial institutions in litigation stemming from one of the largest-ever data breaches, which involved the reported theft of nearly 50 million payment cards from a group of T.J. Maxx stores
• Advising a large university and its special response committee in responding to a data breach involving 700,000 individuals
• Guiding a restaurant chain through a data breach and working with a forensic investigator to identify the cause of the breach involving approximately one-third of its locations, resulting in the significant reduction of loss assessments by payment card brands
• Conducting a multiyear desktop incident response training for an international energy company and amending its incident response plans
• Representing a national food and beverage chain before the FTC during a data breach investigation and negotiating consent decrees with no monetary liability to our client
• Persuading a judge to dismiss claims brought by a proposed class of shoppers – before significant discovery occurred – in a consolidated multidistrict litigation (MDL) alleging harm when hackers installed malicious software on a national grocer’s in-store payment-processing network