Expert Analysis

• Readying Cybersecurity Protocols For The Quantum Age

  

  As there is a significant likelihood that quantum computers will be able to break the majority of current encryption methods within the next decade, organizations should make preparations now to transition to post-quantum security mechanisms, says Ryan McKenney at Orrick.

• 2 FCA Settlements Highlight Gov't Cyber Liability Focus

  

  Recent False Claims Act settlements with Comprehensive Health Care Services and Aerojet Rocketyne illustrate government contractors' growing cybersecurity liability, and underscore how important it is for companies to comply with new incident reporting regulations and live up to standing contractual obligations, say attorneys at O'Melveny.

• What CMS E-Records Proposal Means For Hospitals

  

  The Centers for Medicare & Medicaid Services has proposed significant changes to the Medicare Promoting Interoperability Program — including increasing transparency through public reporting and requiring history queries of prescription drug monitoring programs — that will have far-reaching ramifications for participating hospitals, say Christine Moundas and Gideon Palte at Ropes & Gray.

• How To Protect Health Care Trade Secrets With Covenants

  

  Post-employment restrictive covenants such as noncompetes are an effective way for health companies to protect confidential information and trade secrets, but employers must be cognizant of the rapidly changing state laws governing the enforceability of such agreements, say Erik Weibust and Katherine Rigby at Epstein Becker.

• HSR Statistics Show Increasing Scrutiny Of Health Care M&A

  

  Recent enforcement and Hart-Scott-Rodino statistics illustrate the Federal Trade Commission's growing interest in the application of federal antitrust law to health care transactions and the FTC's ability to test novel theories of harm in this area, say Amanda Wait and Vic Domen at Norton Rose.

• New Ariz. Cyberattack Info Sharing May Be Worth The Burden

  

  A recent amendment to Arizona’s data breach notification law, and similar state and federal cyber incident reporting rules, significantly burden companies that are attacked, but increased information sharing could help prevent and mitigate the damage from future data security incidents, say Christine Czuprynski and Kate Jarrett at McDonald Hopkins.

• Ransomware Risks For Health Cos. And How To Avoid Them

  Excerpt from Practical Guidance

  

  As the health care industry is a particularly valuable and vulnerable target of ransomware attacks, it's important for companies to understand possible attack methodologies and best steps for mitigating risks, says Nathan Kottkamp at Williams Mullen.

• What FDA Expects From Medical Device Cybersecurity Efforts

  

  The U.S. Food and Drug Administration's latest draft guidance on cybersecurity for medical devices highlights the distinction between safeguards that are "built in" rather than "bolted on," emphasizing the importance of robust design controls, say Jae Kim and Raymond Williams at DLA Piper.

• As Cyber Risks Surge, Remember Attorneys' Ethical Duties

  

  The prevalence of remote work and a greater threat of Russian cyberattacks should serve as a stark reminder of a lawyer's professional obligations to guard against unauthorized disclosure of client information and to protect client interests in the event of a cyberattack, says Alvin Mathews at Ulmer & Berne.

• Seeking Clarity On Medical Privacy In Fla. Class Actions

  

  When class actions are filed in Florida courts against medical service providers, even over issues other than medical treatment, and plaintiffs seek the names of other possible class members, the federal health privacy law and Florida's right to privacy are implicated — but the issue has yet to receive sufficient attention from the courts, says Aaron Weiss at Carlton Fields.

• Navigating Ambiguities In New Cyber Reporting Law

  

  The recently passed Cyber Incident Reporting for Critical Infrastructure Act requires increased cybersecurity defense and response disclosures, but owners and operators should take the law's lack of clarity on certain parameters into account as they prepare to comply, say attorneys at Holland & Knight.

• Preparing For New Mandatory Cyber Reporting Rules

  

  The requirements of a new federal law mandating cyber incident reporting for critical infrastructure will not become operational for several months, but affected companies should begin assessing whether their response plans incorporate critical policies and procedures to ensure compliance, say Steven Stransky at Thompson Hine and Lacy Rex at Oswald Companies.

• 5 Steps For Counsel Managing Health Care Data Breaches

  

  Considering the growing threat of data breaches and particular risks to health care providers and related companies, it is critical for counsel to take adequate steps to mitigate harm to patients, protect critical data, improve systems and navigate government investigations in the aftermath of a data security incident, say attorneys at K&L Gates.