PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

Archive of Concurring Opinions Posts

Concurring Opinions Archive Daniel Solove Posts

It is sad to say goodbye to ConcurringOpinions.com, a law professor blog I co-founded in 2005.  The blog began when a group of us (Dave Hoffman, Kaimi Wenger, Nate Oman, and me) who were blogging at PrawfsBlawg decided we wanted more autonomy in blog governance, so we founded Concurring Opinions.   Over the years, we added many great permabloggers: Danielle Citron, Deven Desai, Frank Pasquale, Gerard Magliocca, Ronald K.L. Collins, Larry Cunningham, Naomi Cahn, Sarah Waldeck, Solangel Maldonado, Corey Yung, Jaya Ramji-Nogales, and others.

I have a few final thoughts about Concurring Opinions below, as well as a small piece of good news — I’ve archived most of my posts here on this special archive page. More on the archive later.

Continue Reading

The Internet of Bots

Bots

Much Internet traffic is not human.  According to the NY Times:

How much of the internet is fake? Studies generally suggest that, year after year, less than 60 percent of web traffic is human; some years, according to some researchers, a healthy majority of it is bot. For a period of time in 2013, the Times reported this year, a full half of YouTube traffic was “bots masquerading as people,” a portion so high that employees feared an inflection point after which YouTube’s systems for detecting fraudulent traffic would begin to regard bot traffic as real and human traffic as fake. They called this hypothetical event “the Inversion.”

The bots are starting to win.  Many websites and social media profiles are fake ones too.  Will the Internet soon largely be bots visiting content created by other bots?

Continue Reading

The Robocall Wars: The Rise of Robocalls and the TCPA Robocall Cops

Robocalls and the TCPA Robocall Cops 02

Move over robocop, there’s a new constable in town — the robocall cop. In the past decade, robocalls have surged.  There has also been a dramatic rise in litigation about these calls under the Telephone Consumer Protection Act (TCPA). The TCPA litigation is led by a small group of serial litigators, people who have assumed the role of private enforcers of the TCPA.  This is a fascinating story about how privacy law combats the growing scourge of robocalls.  We are seeing the effective use of private litigation as an enforcement tool, but there are differing interpretations about the virtues of the robocall cops. Also wrapped up on the story is the issue of harm. 

Robocop and RobocallsRobocalls are rising at an alarming rate.  In the month of September 2017 alone, there were 2.4 billion robocalls.  The number keeps rising per month, and September 2018 gave birth to 4.1 billion robocalls.  At this rate, there may be billions and billions more robocalls than stars in the universe!  Robocalls are definitely a problem.  I’ve never heard of anyone who likes robocalls; the mosquito probably ranks higher in popularity.  But robocalls persist and proliferate.  Annually, in the United States, the number of robocalls exceeds 100 per person.  There are 4.5 million robocall complaints per year to the FTC.

Along with the rise of robocalls, litigation has also been increasing.  Lawsuits are perhaps a bit more popular than robocalls or mosquitos, but not by much.  The TCPA, 47 U.S.C. § 227, passed in 1991, requires various forms of prior consent for robocalls, which are calls made with what the TCPA refers to as an “automatic telephone dialing system” (ATDS).  Violations of the TCPA can be enforced through a private right of action, and there are statutory damages of $500 per violation ($1,500 for willful violations).  The number of TCPA lawsuits has skyrocketed, from 14 federal cases in 2007 to 4,392 federal cases in 2017.

Continue Reading

HIPAA Enforcement: Employee Access and BAAs Matter

HIPAA Enforcement - Employee Access 01

Pagosa Springs Medical Center (PSMC) has agreed to pay $111,400 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) for an alleged violation of HIPAA. OCR found that the company failed to deactivate a former employee’s access to a web-based calendar that contained the protected health information (PHI) of 557 patients.  The company also failed to obtain a business associate agreement (BAA) with the calendar company (Google).

Continue Reading

Largest COPPA Penalty Ever – NY AG Settles with Oath (Formerly AOL)

COPPA - TeachPrivacy Privacy Awareness Training 01

On December 4, 2018, New York Attorney General Barbara D. Underwood announced a $4.95 million settlement with Oath, Inc. (formerly known as AOL), for violating the Children’s Online Privacy Protection Act (COPPA). This is the largest penalty in a COPPA enforcement case in U.S. history.

Continue Reading

Vendor Management Matters: HIPAA Enforcement for $500K for Lack of a Business Associate Agreement

HIPAA Enforcement - Business Associate Agreement 01

Advanced Care Hospitalists PL (ACH) has agreed to pay $500,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) for an alleged violation of HIPAA. OCR found that the company shared protected health information (PHI) with an unknown vendor without a business associate agreement (BAA).  According to the Resolution Agreement, “ACH impermissibly disclosed the PHI of 9,255 of its patients to a third party for billing processing services without the protections of a business associate agreement in place.”  The PHI later turned up on the vendor’s website.

This was clearly an unforced error in compliance — and an expensive one!   So easy to avoid too!  Providing PHI to a vendor without a business associate agreement is like going to work without your clothes on.  Vendor management is incredibly important, and organizations that fail to have proper agreements with their vendors that receive personal data are often punished severely by many privacy laws beyond HIPAA. The GDPR requires vendor agreements, and the FTC has found that companies engage in an unfair practice under the FTC Act Section 5 when they lack an adequate vendor agreement.

The main lesson from most privacy enforcement cases, whether HIPAA or otherwise: Do the basics!  So many cases involve failing to do obvious things.  There’s not much muddy ground in the land of enforcement.

The press release can be viewed here.  The Resolution Agreement can be viewed here.

Also of Interest Regarding HIPAA

HIPAA Enforcement Guide

HIPAA Training Guide

HIPAA Enforcement 2017: Another Big Year for HIPAA Enforcement

Why Is HIPAA Data Breach Enforcement Increasing? An Insurer’s View from Katherine Keefe

HIPAA Training Courses

HIPAA Training Requirements FAQ

HIPAA Whiteboard

HIPAA Resources

Continue Reading

Speaking at the FTC Hearing on Data Security on December 12

12/13/18 Update: Here is the video from the session described below.

On Wednesday, December 12, 2018, I’ll be speaking at the Data Security hearing, part of the FTC Hearings on Competition and Consumer Protection in the 21st Century.  My panel begins at 1:00 PM:

The U.S. Approach to Consumer Data Security

Wednesday, December 12, 2018 from 1:00 PM to 2:30 PM

Participants:

Chris Calabrese
Center for Democracy & Technology

Daniel J. Solove
George Washington University Law School

David Thaw
University of Pittsburgh

Janis Kestenbaum
Perkins Coie LLP

Lisa J. Sotto
Hunton Andrews Kurth LLP

Moderator: James Cooper
Federal Trade Commission, Bureau of Consumer Protection

I previously spoke at an earlier hearing in this series back in September on a panel about consumer privacy protection (video / transcript).  The upcoming hearing focuses on data security.

Continue Reading

The Persistent Problems with Access to Records Under HIPAA

HIPAA Access to Medical Records

A study released last month in Jama Open Network entitled Assessment of US Hospital Compliance With Regulations for Patients’ Requests for Medical Records demonstrates that compliance with HIPAA’s right to access medical records remains woeful.  In the second half of 2017, researchers contacted 83 US hospitals and conducted a simulated patient experience to ask for medical records. Among the hospitals, the researchers found that “there was discordance between information provided on authorization forms and that obtained from the simulated patient telephone calls in terms of requestable information, formats of release, and costs.”  On forms, “only 53% provided patients the option to acquire the entire medical record.”  The study concluded that “Requesting medical records remains a complicated and burdensome process for patients despite policy efforts and regulation to make medical records more readily available to patients. Our results revealed inconsistencies in information provided by medical records authorization forms and by medical records departments in select US hospitals, as well as potentially unaffordable costs and processing times that were not compliant with federal regulations.”

I addressed this topic in a blog post about 2 years ago. At that time, I said:

HIPAA doesn’t handle patient access to medical records very well. There are many misunderstandings about patient access under HIPAA that make it quite difficult for patients to obtain their medical information quickly and conveniently. Getting records is currently like a scavenger hunt. Patients have to call and call again, wait seemingly forever to get records, and receive them via ancient means like mail and fax. I often scratch my head at why fax is still used today — it’s one step more advanced than carrier pigeon.  Many covered entities do not send records by email, and getting electronic copies can be quite difficult. Many healthcare providers still maintain paper records in handwriting, and healthcare lags far behind most other industries in the extent to which it has moved to digital records.

Sadly, as this study confirms, little has changed.

Continue Reading

Yes, HIPAA Requires Medical Records to Be Emailed to Patients if Requested

Email Medical Records

Have you ever asked your healthcare provider to send you medical records by email?  Most likely, you’ve received the reply: “We can’t do that.  We can only fax them to you or provide you with a paper copy.”  This answer is wrong.

HIPAA’s right for individuals to access their health information, 45 CFR § 164.524, provides:

The covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable hard copy form or such other form and format as agreed to by the covered entity and the individual.

Continue Reading