Partner Kristen Rosati Shares Health Data Privacy Insights as Panelist at 43rd National HIPAA Summit

Partner Kristen Rosati was recently invited to present at the 43rd National HIPAA Summit, a three-day virtual conference convening leaders in health data privacy, security, and compliance from across the country to discuss key regulatory and operational issues impacting today’s health care organizations. Kristen participated in the session, “HIPAA at 30: Lessons Learned and What’s Next for Healthcare Privacy and Security.” The panel examined how HIPAA has evolved over the last three decades and the emerging issues shaping the future of health information governance. Considered one of the nation’s leading “Big Data” and HIPAA compliance attorneys, Kristen has deep experience in data governance and strategy, data sharing for research and innovation, and biobanking and genomic privacy. Kristen is a Past President of the American Health Law Association...

Read MoreRead More

Mel Soliz Examines Legal and Policy Implications of CMS’ Health Technology Ecosystem on AHLA Podcast

Partner Mel Soliz recently joined an AHLA podcast exploring the CMS Health Technology Ecosystem — a new federal effort to modernize digital infrastructure and expand health data exchange beyond clinical settings. Alongside David Lee of Leavitt Partners, Mel discussed the initiative’s potential impact on privacy, governance, enforcement, and liability as interoperability standards evolve.  In the podcast, Mel assessed the legal significance of a more standardized FHIR-based exchange environment, noting that organizations may face greater scrutiny as data becomes more structured and exchangeable. She also spoke on potential interoperability challenges in an increasingly complex data privacy landscape, where HIPAA is only one part of an equation that also includes Part 2, Medicaid confidentiality requirements, federal privacy rules, and state-based laws.  Additionally, Mel addressed how these risks play out for providers, EHRs, payers, and patient-facing apps, with a focus on breach exposure in multi-party environments; downstream reliance on exchanged data; sensitivity around claims and clinical data; and gaps between consumer expectations and legal protections outside HIPAA-regulated settings. She encouraged organizations to align agreements and governance models with broader exchange goals...

Read MoreRead More

Kristen Rosati Examines New Token-Based Data Privacy Weaknesses in HealthVerity Panel Discussion

Partner Kristen Rosati recently joined a panel to assess newly discovered vulnerabilities in token-based methods used to de-identify health information. The discussion, hosted by HealthVerity, was prompted by an October article published in the Journal of the American Medical Informatics Association, which revealed critical weaknesses in common privacy-preserving record linkage techniques. The panelists explored which tokens appear most susceptible to re-identification attacks. The discussion also outlined practical risk mitigation strategies and emerging innovations aimed at strengthening privacy architecture to support more secure, compliant data exchange. In addition to Kristen, the panel included Andrew Kress, CEO of HealthVerity; Austin Eliazar, PhD, Chief Data Scientist at HealthVerity; and Bradley Malin, PhD, Accenture Professor and Vice Chair for Research Affairs at Vanderbilt Medical Center. HealthVerity, a technology company that provides one...

Read MoreRead More

Kristen Rosati Shares Insight on Rising Threats of Ransomware Mailed Physically to Health Care Organizations

A recent string of mailed extortion demands has caught health care organizations off guard, signaling a shift in ransomware tactics. Partner Kristen Rosati was featured in a Healthcare Risk Management article, emphasizing the importance for health care organizations to prepare for these emerging threats. The paper ransomware letters claimed sensitive data had been stolen and demanded more than $250,000 in Bitcoin within 10 days. Although an increasing number of health care staff now receive training to avoid suspicious links and spot phishing emails, physical letters tend to feel more legitimate and urgent than these digital phishing tactics. This method also bypasses the expensive email filters and security systems set up to catch digital threats, making it even more difficult to detect. “Snail mail doesn’t leave a digital...

Read MoreRead More

Mel Soliz joins SHARES Advisory Board as Group Awarded National Institute of Health Grant

Mel Soliz has joined the Substance use HeAlth REcord Sharing (SHARES) Advisory Board as it kicks off its $3.2 million, five-year National Institute of Health (NIH) grant. Formed under ASU’s College of Health Solutions, SHARES uses feedback from patients and providers on substance use disorder (SUD) data sharing and health care to inform policies on data privacy and confidentiality. The board also analyzes the implementation and impact of automated SUD data segmentation to improve data sharing and interoperability between healthcare institutions and service delivery. Mel ― who is also recognized by Chambers USA©️, Best Lawyers©, and Southwest Super Lawyers: Rising Stars© ― practices regulatory health law, focusing on compliance with health data privacy, access and interoperability laws (such as the Information Blocking Rule and CMS interoperability mandates,...

Read MoreRead More
Attorneys Kristen Rosati and Nate Kunz

Kristen Rosati & Nate Kunz Share Insights with the Arizona Society of Healthcare Attorneys on Online Tracking Tools for Health Care Organizations

After STAT Health News published an investigation into health care organizations' use of online tracking technologies, such as Meta Pixel, the Office for Civil Rights and the Federal Trade Commission launched their own investigations. The FTC has issued substantial fines, and now class actions are being filed across the U.S. The Arizona Society of Healthcare Attorneys hosted Kristen Rosati and Nate Kunz to provide insights on the regulatory and legal issues arising from health care organizations’ use of online tracking technologies. They explained online tracking compliance requirements for HIPAA, Federal Trade Commission regulations, and state data privacy laws. They also discussed best practices for protecting attorney-client privilege and the attorney work product while conducting internal investigations. Kristen, a past President and Fellow of the American Health Law...

Read MoreRead More