Data privacy and HIPAA
HIPAA Compliance Attorney
Work with a HIPAA compliance attorney licensed in California, Illinois, and Tennessee on how your medical, dental, or other healthcare practice or digital health company collects, stores, and shares patient data.
- 20+Years in-houseInside healthcare and life sciences companies
- 3State barsLicensed in California, Illinois, and Tennessee
- C-suiteFormer rolesChief Legal, Chief Compliance, and Chief Privacy Officer
- CIPP/USPrivacy credentialCertified Information Privacy Professional/United States
If your business touches patient information, HIPAA (the Health Insurance Portability and Accountability Act) and a growing set of state privacy laws may apply to you. We help advise on privacy programs, security safeguards, and what to do when something goes wrong, in plain language. Craig Clesson served as a Chief Privacy Officer and holds the Certified Information Privacy Professional/United States (CIPP/US) credential.
Who HIPAA applies to
HIPAA covers health plans, health care clearinghouses, and providers who send health information electronically in a standard transaction, such as an insurance claim. If you're a vendor that handles patient information for them, you're a business associate, and you're directly liable under parts of the rules.
If you run a digital health company, you may be a business associate. A consumer health app that people use on their own can sit outside HIPAA and still must comply with the Federal Trade Commission's Health Breach Notification Rule.
State privacy laws on top of HIPAA
Many states add their own medical privacy and breach notification laws on top of HIPAA, and some of those laws reach businesses that HIPAA does not. California, Illinois, and Tennessee each draw the line in a different place. This area of law continues to evolve, in the statutes and in how states enforce them.
Craig Clesson is licensed in California, Illinois, and Tennessee, so one counsel can help map which state rules apply to your data before you build.
Privacy programs and security safeguards
A privacy program usually covers these pieces:
- Privacy and security policies
- Security risk analysis
- Business associate agreements
- Workforce training
- Patient access and records requests
- Tracking pixels on websites, apps, and patient portals
- Vendor and app reviews
Contact us for a free consultation.
If you are a healthcare professional business owner or a healthcare business that is facing a tough question, maybe we can help. Contact us for a free consultation.
Contact us →When something goes wrong
A suspected breach starts a clock. HIPAA and state laws set deadlines for notifying affected individuals, and larger breaches can require notice to regulators and the media.
We help guide the investigation and each notification decision.
Substance use disorder records
Records from federally assisted substance use disorder programs follow 42 Code of Federal Regulations (CFR) Part 2, which adds consent rules beyond HIPAA. Part 2 has been revised to align it more closely with HIPAA, and we help programs review their consent forms and policies as the laws and enforcement in this area evolve.
Answers your whole team can use
You get privacy advice in plain terms that your front desk and your developers can both act on.
Craig Clesson served as Chief Privacy Officer inside healthcare and life sciences companies.