Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Dena M. Castricone
The Crushing Cost Of HIPAA Security Rule Noncompliance
Law360 (October 1, 2020, 5:13 PM EDT) -- Between Sept. 21 and Sept. 25, the U.S. Department of Health and Human Services' Office for Civil Rights announced settlements totaling $10.6 million with three organizations for alleged systemic Health Insurance Portability and Accountability Act security rule violations. In each of the three cases, the entity self-reported a hacking incident. Combined, the hacking incidents compromised the health information of more than 16 million people.
It's Time To Scrap FTC's Health Breach Notification Rule
Law360 (June 1, 2020, 5:57 PM EDT) -- The Federal Trade Commission's Health Breach Notification Rule is a perfect example of a narrowly tailored regulation that only contributes to the cumbersome patchwork of privacy rules in this country without providing any real benefit.
HIPAA Compliance Lessons From 2019 Enforcement Trends
Law360 (January 22, 2020, 4:32 PM EST) -- While there is still a chance that the U.S. Department of Health and Human Services’ Office for Civil Rights will announce a 2019 enforcement resolution in early 2020, like it did last year,[1] it appears that the 2019 Health Insurance Portability and Accountability Act enforcement year is over with a lot less fanfare (and cash) than last year.
OCR Issues Anticipated RFI on HIPAA Modifications
You are responsible for reading, understanding and agreeing to the National Law Review's (NLR’s) and the National Law Forum LLC's Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only.
Six-Figure OCR Settlement for Three-Physician Practice Failing to Follow Policies
You are responsible for reading, understanding and agreeing to the National Law Review's (NLR’s) and the National Law Forum LLC's Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only.
OMB Seeking Feedback on Reducing HIPAA Burdens | JD Supra
JD Supra Privacy Policy Updated: May 25, 2018: JD Supra is a legal publishing service that connects experts and their content with broader audiences of professionals, journalists and associations.
OMB Seeks to Ease HIPAA Burdens on Health Care Providers
You are responsible for reading, understanding and agreeing to the National Law Review's (NLR’s) and the National Law Forum LLC's Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only.
Less is more: The Role of Data Retention Policies in Cybsesecurtity Preparedness
We’re all guilty of it. We keep things that we don’t need, like that pair of stone-washed jeans from 1992 that you hope will come back into style or your beanie baby collection that you blindly believe might be worth something someday. While our inability to purge old stuff from our closets may cost us closet space, the repercussions for an organization that hoards data are far more significant.
Your Cybersecurity Program is Only as Strong as Your Weakest Vendor
Dena M. Castricone is a member of the Long Term Care and Health Care practice groups. She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee. Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.
Anthem Agrees to Pay Largest HIPAA Settlement at $16M for Massive Breach
More than three years ago, Anthem, Inc. reported to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) that it suffered a cyber attack compromising the protected health information of nearly 79 million individuals. This breach continues to be the largest breach of protected health information to date. Yesterday, OCR announced its record-breaking $16 million settlement with Anthem related to the massive breach.
The Importance of Information Security Plans
In the first installation of our weekly series during National Cybersecurity Awareness Month, we examine information security plans (ISP) as part of an overall cybersecurity strategy. Regardless of the size or function of an organization, having an ISP is a critical planning and risk management tool and, depending on the business, it may be required by law. An ISP details the categories of data collected, the ways that data is processed or used, and the measures in place to protect it.
October is National Cybersecurity Awareness Month!
In recognition of National Cybersecurity Awareness Month, each Friday this October, we will highlight a different step that organizations can take to increase awareness of potential cyber threats, reduce the risk of a cyber attack or minimize damage from an attack. All four steps are solutions that all organizations, regardless of size or budget, can implement.
More FTC Privacy Shield Settlements, But Will It Be Enough For The EU?
Just days before the EU Commission reassesses the EU-US Privacy Shield program in light of the EU Parliament’s recent adequacy criticisms, the Federal Trade Commission (FTC) announced settlements with four companies allegedly falsely claiming participation in the program. One of the issues the EU Parliament cited this summer with the EU-US Privacy Shield program was lack of US oversight and enforcement.
CA Orders Uber to Pay Millions in Data Breach Payout
Dena M. Castricone is a member of the Long Term Care and Health Care practice groups. She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee. Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.
California Governor Approves Revisions to Consumer Privacy Act
On September 23, 2018, California’s governor signed into law the first round of revisions to the California Consumer Privacy Act (CCPA), the most sweeping privacy legislation in this country. California enacted the CCPA in June and it takes effect on January 1, 2020. Inspired by the European Union’s General Data Protection Regulation, the California legislature initially drafted the CCPA in haste to avoid a ballot initiative containing more onerous provisions for businesses.
Boston-Area Hospitals Pay Nearly $1M in Penalties for Permitting Filming of “Boston Med”
On September 20, the Department of Health and Human Services Office for Civil Rights (OCR) announced separate settlements with Boston Medical Center (BMC), Brigham and Women’s Hospital (BWH) and Massachusetts General Hospital (MGH) with penalties totaling $999,000.
Report on Cyber Readiness of Connecticut Utility Companies
On September 18, 2018, Connecticut’s governor released an annual report on the cybersecurity sophistication and readiness of the state’s electric, natural gas and major water companies. The four participating utility companies were Aquarion, Avangrid, Connecticut Water and Eversource. The report sets the stage for the current threat level by highlighting the federal government’s warnings earlier this year about Russian involvement in cyber attacks on US utility companies.
NIST and NCCoE Offer Guidance on Mobile Device Security in Health Care
Dena M. Castricone is a member of the Long Term Care and Health Care practice groups. She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee. Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.
Compliance With Established Cybersecurity Standards Provides Protection From Liability in Ohio
Dena M. Castricone is a member of the Long Term Care and Health Care practice groups. She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee. Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.
Cybersecurity Tips for the Digital Age
The following are five cybersecurity tips: Practicing good password management can help secure your information. Password requirements have evolved over time with routine password changes and increasingly complicated rules to achieve “strong password” status. In June 2017, National Institute of Standards and Technology (NIST) released new guidelines signaling a deviation in the approach to password management.
Data Breaches Are Expensive, Especially In The Health Care Industry
The much-anticipated Ponemon Institute 2018 Cost of Data Breach Study: Global Overview is out and, not surprisingly, the cost of a data breach continues to rise. In this country, the cost is up $8 per record, going from $225 per record last year to $233 per record this year. A more alarming jump, however, is the cost of a data breach in the health care sector, which is up to $408 per record from $340 just one year ago.
EU Commission Recommends Suspension of Privacy Shield; Recent FTC Efforts May Be Too Little Too Late
On July 5, 2018, the EU Parliament passed a non-binding resolution encouraging the European Commission to suspend the EU-US Privacy Shield Program unless the US is fully compliant by September 1, 2018. The EU Parliament believes that the current Privacy Shield program does not provide an adequate level of protection required by European law. This comes roughly two years after the European Commission deemed the EU-US Privacy Shield Framework adequate to enable data transfers under EU law.
California Gets Its Very Own GDPR with Statutory Damages
You could almost hear the cheers of plaintiffs’ class action lawyers in California last night, as California’s governor signed the most sweeping privacy law this country has seen to date. Notably, the law gives consumers the right to statutory damages in the event of a breach if the company holding the consumer’s information failed to implement reasonable security measures.
FTC Settles with Children’s Electronic Toy Maker for Security Program Issues
Dena M. Castricone is a member of the Long Term Care and Health Care practice groups. She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee. Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.
Ninth Circuit, First Amendment, Glassdoor.com, grand jury subpoena, associational privacy and anonymous speech, common cause
At the end of last week, three U.S. Democratic Senators, including Connecticut’s Richard Blumenthal, proposed the 44-page Data Security and Breach Notification Act (“Proposed Act”). The Proposed Act would preempt the laws of the 48 states that currently have data breach notification laws and the Federal Trade Commission (“FTC”) would have enforcement authority.
Vulnerabilities to Most Computer Processors Revealed
In the first week of the New Year, we learned that most computer processor chips sold over the past 10 years are vulnerable to side-channel attacks. These vulnerabilities, dubbed Spectre and Meltdown, could grant a hacker access to sensitive information, such as passwords and other personal information.
SCOTUS Requires Warrant for Cell Phone Location Records
Today, in a 5-4 decision, the US Supreme Court ruled that the government’s acquisition of information regarding an individual’s location based on a cell phone record amounts to a Fourth Amendment search and generally requires a warrant. In , the government obtained nearly 13,000 location points on Carpenter’s movements over a 127-day period from Carpenter’s wireless carrier under the Stored Communications Act (SCA).
OCR Issues Guidance on the Use of HIPAA Authorizations for Research
This week, the Department of Health and Human Services Office for Civil Rights (OCR) issued guidance on the use of HIPAA-compliant authorizations for research based on a mandate in the Cures Act for such guidance. The guidance addresses authorizations and expiration language for future research as well as revocation of the authorization. A copy of the guidance can be obtained here.
SCOTUS Requires Warrant for Cell Phone Location Records | JD Supra
JD Supra is a legal publishing service that connects experts and their content with broader audiences of professionals, journalists and associations. This Privacy Policy describes how JD Supra, LLC ("JD Supra" or "we," "us," or "our") collects, uses and shares personal data collected from visitors to our website (located at www.jdsupra.com) (our "Website") who view only publicly-available content as well as subscribers to our services (such as our email digests or author tools)(our "Services").
May 25, 2018 - Privacy and Cybersecurity Group News: Three Important Considerations For All Businesses in Light of GDPR
Today, the European General Data Protection Regulation ("GDPR") takes effect. The GDPR is the most comprehensive and complex privacy regulation currently enacted. The GDPR can apply to a business or organization (including a non-profit organization) anywhere in the world and its potential financial impact is huge; fines can reach up to € 20 million Euros (over $23 million USD) or 4% of an entity’s total revenue, whichever is .
Homeland Security Worked Out Cybersecurity Plan
Dena M. Castricone is a member of the Long Term Care and Health Care practice groups. She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee. Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.
Canada Releases New Data Breach Regulations
In a recent post, we discussed the Canadian Cabinet’s announcement that Canada’s new data breach regulations go into effect on November 1, 2018. Despite announcing the effective date, Canada had not yet finalized these regulations. However, on April 18, 2018, Canada unveiled the Breach of Security Safeguard Regulations: SOR/2018-64 (“Regulations”).
Cybersecurity Three Minute Check In Series: Does the GDPR Apply to a US Business? [VIDEO]
Dena Castricone is member of the Long Term Care/Health Care Practice Group and is also an experienced litigator who has been with Murtha Cullina LLP since 2003. As part of the Long Term Care/Health Care Practice Group, she assists nursing homes, assisted living communities, CCRCs, hospitals, physician groups and home health care and hospice agencies with a wide range of regulatory, compliance, litigation and risk management issues.
GAO Says CMS Must Do More to Protect Medicare Info
In a report released on April 5, 2018, the Government Accountability Office (GAO) concluded that the Centers for Medicare and Medicaid Services (CMS) has not done enough to adequately protect the electronic data of Medicare beneficiaries. There are over 59 million Medicare beneficiaries and beneficiary information contains some of the most sensitive personal information, making it very attractive to criminals. Therefore, CMS’s protection of that data is critically important.
And Alabama Makes 50 States with Data Breach Notification Laws
On March 28, Alabama’s governor signed into law a data breach notification law. It is the last state in the country to do so, closely trailing South Dakota. Fifteen years ago, California was the first state to enact a data breach notification law.
D.C. Circuit Reigns in FCC’s Overbroad TCPA Interpretations
On March 16, a year and a half after hearing oral argument, the D.C. Circuit Court of Appeals issued a long-awaited decision overturning two of the Federal Communications Commission’s (FCC) far-reaching interpretations of the Telephone Consumer Protection Act of 1991 (TCPA). A number of regulated entities filed an action against the FCC challenging several of the FCC’s conclusions in a 2015 order related to cell phones.
Facebook In Hot Water With Latest Privacy Missteps
Facebook is the subject of a recent media blitz due to the allegations that 50 million people had their information improperly disclosed to Cambridge Analytica, a data research firm that may have played a role in the 2016 election. The premise of the allegations is that Cambridge Analytica sent out a personality test to roughly 270,000 of Facebook’s users, stating that it would use the test for academic purposes.
South Dakota is the 49th State to Enact a Breach Notification Law
Yesterday, South Dakota’s Governor signed into law “An Act to provide for the notification related to a breach of certain data and to provide a penalty therefor.” Under the Act, when a “breach of system security” involves personal or protected information, the holder of the information must notify affected residents within 60 days and, if more than 250 individuals are affected, the holder must notify the state attorney general.
Data & Security Breach Litigation in Eighth & Ninth Circuit
Two courts. Two days. Two different results. On March 7, on remand from the U.S. Court of Appeals for the Eighth Circuit, a federal district court judge in Minnesota granted a motion to dismiss a consumer class action suit involving a 2014 data breach affecting over 1,000 grocery stores. The court found that the allegations of possible future identity theft or fraud because of the breach were not sufficient to establish a substantial risk of future harm.
Welcomed Draft Commentary from the Sedona Conference on BYOD
Many organizations struggle with whether to permit employees to use their own electronic devices (e.g., mobile phones, tablets, laptops) to conduct business on behalf of the organization. In addition to discovery challenges in the event of litigation, the use of individual devices can also present significant security concerns and regulatory compliance issues.
Yahoo to Pay $80 Million to Settle Securities Class Action Based on Data Breaches
Yahoo agreed to pay shareholders $80 million to settle a federal securities class action suit, as detailed in the parties’ March 2, 2018 proposed settlement agreement filed with the court. In that suit, the shareholders claimed that Yahoo failed to disclose a number of data breaches affecting more than 3 billion users, which caused Yahoo’s stock prices to fall. One of the named plaintiffs is not participating in the settlement.
Medical Records HIPAA Violations
Yesterday, DHHS’s Office for Civil Rights (OCR) announced a $100,000 settlement with a dissolved medical records moving and storage company in Illinois. This is another example of OCR bringing enforcement actions against a business associate under HIPAA. OCR investigated a complaint that the business associate brought medical records to a shredding and recycling facility in exchange for cash.
$3.5 Million OCR settlement
Yesterday, OCR announced its $3.5 million settlement with Fresenius Medical Care Holdings (“Fresenius”) to resolve alleged HIPAA violations. While the large settlement figure alone is eye-catching, the underlying facts require the complete attention of HIPAA covered entities. OCR is sending a message about HIPAA Security Rule compliance. Five Fresenius entities in five different states suffered five completely separate but relatively common breaches. Each breach involved stolen or missing equipment.
Connecticut Breach Of Confidentiality
Based on the decision in a recent Connecticut Supreme Court case, patients may now sue physicians for breaching confidentiality. Previously, Connecticut did not recognize breach of confidentiality as a cause of action. The unauthorized disclosure at the heart of Byrne v. Avery Center for Obstetrics and Gynecology, P.C. involved a provider’s response to a subpoena. Subpoena compliance has long been an area of confusion for providers.
No First Amendment Privacy Protection from Grand Jury Subpoena for Identity of Anonymous Reviewers on Glassdoor.com
On November 8, 2017, the Ninth Circuit concluded that the First Amendment did not protect the anonymity of Glassdoor.com users from a grand jury subpoena. Glassdoor operates the website Glassdoor.com, which permits employees to post anonymous reviews about their employers. An Arizona grand jury is investigating a government contractor that administers two VA healthcare programs for fraud and misuse of government funds.
Feds CT Warn of Cybersecurity Issues
According to Reuters, late on Friday, the Department of Homeland Security ("DHS") and the FBI issued a warning in a report, sent to firms at risk of an attack, that critical infrastructure industries may have been targeted in cyber-attacks as far back as May. The identified industries include nuclear, energy, aviation, water, critical manufacturing industries and government entities. The report indicates that hackers successfully compromised data at some of these targets.
Legislature Addresses Ransomware Threat With Criminal Penalties
It is fitting that on the first day of Cybersecurity Awareness Month, new legislation takes effect regarding one of the most destructive types of malware. In response to the rapidly increasing rate of computer extortion cases, the Connecticut Legislature has joined several states in creating a statute specifically targeting ransomware. Ransomware is a type of malicious software that prevents access to information in a computer system until a ransom is paid.
Protecting Data: Vendors May Be Your Weakest Link
Just last week, a Verizon Communications vendor misconfigured a cloud server that caused the information of 6 million Verizon customers to be exposed on-line. When a cyber incident or data breach occurs on your vendor’s watch, regardless of fault, you own the resulting legal obligations and costs. The best tools for managing the risk of using vendors are due diligence and adequate contract provisions. Before engaging a vendor, you should consider the vendor’s ability to protect your information.
Five Things You Can Do to Protect Your Business From a Cyber Attack
On Friday, May 12, 2017, a damaging ransomware attack swept across more than one hundred countries and infected tens of thousands of computers. As is becoming all too common, the hackers transmitted the ransomware via a phishing e-mail, and then, once the user clicked the bait, the hackers used a method thought to have been developed by the National Security Agency, and locked businesses out of their systems.
Phishing Alert: Employee W-2 Information at Risk
It's happening again. This time last year, there were a substantial number of phishing attacks all over the country targeting employee W-2 information. According to the IRS, phishing and other schemes jeopardizing tax information were up over 400% in 2016. The phishing attacks typically involve HR or payroll department employees sharing highly sensitive W-2 information with criminals who purport to be the CEO, CFO or other high ranking official using a spoofed email.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Dena M.
Contact Dena M., search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack