CLOSE X
RSS Feed LinkedIn Instagram Twitter Facebook
Search:
FMG Law Blog Line

Archive for the ‘Coronavirus – Cyber, Privacy & Security’ Category

FCC Confirms COVID-19 Pandemic Constitutes Emergency Under TCPA

Posted on: March 23rd, 2020

By: Matthew Foree

The Federal Communications Commission (“FCC”) has just issued a Declaratory Ruling confirming that the coronavirus pandemic constitutes an emergency under the Telephone Consumer Protection Act (“TCPA”). The Declaratory Ruling can be found here. Consequently, “hospitals, healthcare providers, state and local health officials, and other government officials may lawfully communicate information about the novel coronavirus as well as mitigation measures without violating federal law.”

The TCPA prohibits autodialed, pre-recorded, or artificial voice calls to wireless telephone numbers, with certain exceptions. The TCPA expressly exempts calls made for emergency purposes. The FCC’s rules define “emergency purposes” to mean “calls made necessary in any situation affecting the health and safety of consumers.” The exception is intended for “instances [that] pose significant risks to public health and safety, and [where] the use of prerecorded message calls could speed the dissemination of information regarding . . . potentially hazardous conditions to the public.”

The FCC recognized that a critical component of the nation’s efforts to address and contain the pandemic is the ability of healthcare and public safety organizations to communicate effectively with the public.  Therefore, it found that the current pandemic constitutes an imminent health risk to the public.  The FCC found that in determining whether a call relating to the pandemic qualifies as a call made for an emergency purpose, it looks to (1) the identity of the caller and (2) the content of the call. Under the first prong, “the caller must be from a hospital, or be a healthcare provider, state or local health official, or other government official as well as a person under the express direction a such an organization and acting on its behalf.” Under the second prong, “the content of the call must be solely informational, made necessary because of the COVID-19 outbreak, and directly related to the imminent health or safety risk arising out of the COFIC-19 outbreak.”

The FCC gave multiple examples of calls that would fall within the emergency exception. For example, “a call originating from a hospital that provides vital and time-sensitive health and safety information that citizens welcome, expect, and rely upon to make decisions to slow the spread of the COVID-19 disease would fall squarely within an emergency purpose.” The FCC also recognized that calls that contain advertising or telemarketing of services do not constitute calls for an emergency purpose. Furthermore, calls made to collect a debt, even if it arises from related healthcare treatment, are not made for an emergency purpose. Such calls still require the prior express consent of called party.

Finally, the FCC recognized that consumers have already received telemarketing and fraudulent robocalls related to the pandemic, including scam text messages and calls offering home testing kits and promoting bogus cures. The FCC stated that it would be vigilant in monitoring complaints about these calls and would not hesitate to enforce its rules when appropriate.

If you have any questions about the FCC’s Declaratory Ruling, or any obligations under the TCPA during this time, please do not hesitate to contact Matt Foree at [email protected].

Additional information: 

The FMG Coronavirus Task Team will be conducting a series of webinars on Coronavirus issues every day for the next week. We will discuss the impact of Coronavirus for companies in general, but also for business in insurance, healthcare, California specific issues, cybersecurity, and tort. Click here to register.

FMG has formed a Coronavirus Task Force to provide up-to-the-minute information, strategic advice, and practical solutions for our clients. Our group is an interdisciplinary team of attorneys who can address the multitude of legal issues arising out of the Coronavirus pandemic, including issues related to Healthcare, Product Liability, Tort Liability, Data Privacy, and Cyber and Local Governments. For more information about the Task Force, click here.

You can also contact your FMG relationship partner or email the team with any questions at [email protected].

**DISCLAIMER: The attorneys at Freeman Mathis & Gary, LLP (“FMG”) have been working hard to produce educational content to address issues arising from the concern over COVID-19. The webinars and our written material have produced many questions. Some we have been able to answer, but many we cannot without a specific legal engagement. We can only give legal advice to clients. Please be aware that your attendance at one of our webinars or receipt of our written material does not establish an attorney-client relationship between you and FMG. An attorney-client relationship will not exist unless and until an FMG partner expressly and explicitly states IN WRITING that FMG will undertake an attorney-client relationship with you, after ascertaining that the firm does not have any legal conflicts of interest. As a result, you should not transmit any personal or confidential information to FMG unless we have entered into a formal written agreement with you.  We will continue to produce educational content for the public, but we must point out that none of our webinars, articles, blog posts, or other similar material constitutes legal advice, does not create an attorney client relationship and you cannot rely on it as such. We hope you will continue to take advantage of the conferences and materials that may pertain to your work or interests.** 

HHS Waives Some HIPAA Sanctions During the Coronavirus Pandemic

Posted on: March 20th, 2020

By: David Cole

The HHS Office for Civil Rights (OCR) issued two important bulletins this week in response to the coronavirus pandemic. Each one announced that OCR will temporarily waive certain sanctions and penalties for noncompliance with HIPAA Rules to help deliver care to people in need.

Limited Waiver for Privacy Rule Requirements

First, OCR issued a Limited Waiver of HIPAA Sanctions and Penalties for not complying with certain parts of the Privacy Rule. Specifically, the Waiver says that healthcare providers will not be sanctioned or penalized for not complying with the following usual requirements:

  • The requirement to obtain a patient’s consent before speaking with family members or friends involved in the patient’s care;
  • The requirement to honor a request to opt-out of the facility directory;
  • The requirement to distribute a Notice of Privacy Practices;
  • The patient’s right to request privacy restrictions; and
  • The patient’s right to request confidential communications.

The Waiver became effective on March 15, 2020, but currently only applies (1) in the emergency area identified in the public health emergency declaration; (2) to hospitals that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol. It is unclear if OCR will extend the time for this Waiver given the widespread and potentially prolonged nature of the coronavirus outbreak. A copy of the bulletin is available here.

Video Technology Allowed for Telemedicine

Second, OCR issued a Notification of Enforcement Discretion allowing healthcare providers to use “any non-public facing remote communication product that is available” to communicate with patients to provide telehealth during the coronavirus national emergency. As examples, OCR said it will allow healthcare providers to use video chat application like Apple FaceTime, Facebook Messenger, Google Hangouts, or Skype, to provide telehealth without risk of penalty for noncompliance with HIPAA Rules. However, Facebook Live, Twitch, TikTok, and other similar public-facing video applications are not allowed. Healthcare providers are still expected to enter into Business Associate Agreements with the technology companies providing the video communication services, but OCR says it will not impose penalties for failing to do so during the time of the national emergency. A copy of the Notice is available here.

Additional information: 

The FMG Coronavirus Task Team will be conducting a series of webinars on Coronavirus issues every day for the next week. We will discuss the impact of Coronavirus for companies in general, but also for business in insurance, healthcare, California specific issues, cybersecurity, and tort. Click here to register.

FMG has formed a Coronavirus Task Force to provide up-to-the-minute information, strategic advice, and practical solutions for our clients. Our group is an interdisciplinary team of attorneys who can address the multitude of legal issues arising out of the Coronavirus pandemic, including issues related to Healthcare, Product Liability, Tort Liability, Data Privacy, and Cyber and Local Governments. For more information about the Task Force, click here.

You can also contact your FMG relationship partner or email the team with any questions at [email protected].

**DISCLAIMER: The attorneys at Freeman Mathis & Gary, LLP (“FMG”) have been working hard to produce educational content to address issues arising from the concern over COVID-19. The webinars and our written material have produced many questions. Some we have been able to answer, but many we cannot without a specific legal engagement. We can only give legal advice to clients. Please be aware that your attendance at one of our webinars or receipt of our written material does not establish an attorney-client relationship between you and FMG. An attorney-client relationship will not exist unless and until an FMG partner expressly and explicitly states IN WRITING that FMG will undertake an attorney-client relationship with you, after ascertaining that the firm does not have any legal conflicts of interest. As a result, you should not transmit any personal or confidential information to FMG unless we have entered into a formal written agreement with you.  We will continue to produce educational content for the public, but we must point out that none of our webinars, articles, blog posts, or other similar material constitutes legal advice, does not create an attorney client relationship and you cannot rely on it as such. We hope you will continue to take advantage of the conferences and materials that may pertain to your work or interests.** 

Cyber Attack on HHS is a Reminder for Businesses to Remain Vigilant About Cybersecurity During the COVID-19 Pandemic

Posted on: March 17th, 2020

By: Renata Hoddinott

Amidst all the information and news flooding the internet regarding COVID-19, another troubling headline emerged this morning: an unknown actor launched a cyber attack on the Department of Health and Human Services (HHS) on Sunday. The attack was not a hack in the traditional sense, and no data was stolen from HHS’s systems. Rather it was an attempt to slow down HHS’s COVID-19 response by flooding the site with millions of requests over the course of several hours. It was a distributed denial of service – or DDOS – attack. The distinction is important because there was no apparent breach of the system of the lead agency responding to the coronavirus pandemic, and none of HHS’s critical functions were interrupted. HHS’s system was largely able to repel the intrusion, the agency was fully functioning at all times, and its site never crashed. But while the attack was unsuccessful, it is a harbinger of things to come and businesses should take note.

Most corporations and firms with the capability to do so have permitted, encouraged, or even mandated their employees to work from home for an extended amount of time to limit the spread of the virus. All of that remote access may be on potentially less secure networks should raise some concerns for those businesses. Bad actors will no doubt use the opportunity to gain access to less secure devices and networks to penetrate systems they may not have had access to previously due to the security in place for devices “in-house.”

Now is the time to remind remote employees to practice basic sense and security in ensuring they are only accessing company systems on private, password-protected networks. Employees also need to be watching for social engineering and phishing attacks. It may seem as though the email from the boss asking for password information or the firm’s credit card number is legitimate because employees do not have the ability to walk down the hall and ask.

And, for some smaller enterprises who may be new to remote-access, some systems may have been rolled out untested in certain circumstances to ensure business continuity. In those cases, it will be important to ensure that when restrictions are lifted and employees are able to return to work that those remote system are analyzed and secured from future threats.

This pandemic has unexpectedly and almost immediately changed the way business is conduct day-to-day around the globe. It remains to be seen whether those changes will be permanent. While most people are pulling together in this outbreak, malicious actors will always be looking for every opportunity to take advantage of the situation. During the period of social distancing and self-quarantining, individuals are desperate for up to the minute information on the crisis. Businesses need to be aware that attackers will attempt to exploit the human element now more than ever. And, as we all know, there is almost always a human element – whether an honest mistake or negligence – in most cybersecurity incidents.

In addition, FMG has formed a Coronavirus Task Force to provide up-to-the-minute information, strategic advice, and practical solutions for our clients. Our group is an interdisciplinary team of attorneys who can address the multitude of legal issues arising out of the coronavirus pandemic, including issues related to Healthcare, Product Liability, Tort Liability, Data Privacy, and Cyber and Local Governments. For more information about the Task Force, click here.

You can also contact your FMG relationship partner or email the team with any questions at [email protected].

**DISCLAIMER: The attorneys at Freeman Mathis & Gary, LLP (“FMG”) have been working hard to produce educational content to address issues arising from the concern over COVID-19. The webinars and our written material have produced many questions. Some we have been able to answer, but many we cannot without a specific legal engagement. We can only give legal advice to clients. Please be aware that your attendance at one of our webinars or receipt of our written material does not establish an attorney-client relationship between you and FMG. An attorney-client relationship will not exist unless and until an FMG partner expressly and explicitly states IN WRITING that FMG will undertake an attorney-client relationship with you, after ascertaining that the firm does not have any legal conflicts of interest. As a result, you should not transmit any personal or confidential information to FMG unless we have entered into a formal written agreement with you. We will continue to produce educational content for the public, but we must point out that none of our webinars, articles, blog posts, or other similar material constitutes legal advice, does not create an attorney client relationship and you cannot rely on it as such. We hope you will continue to take advantage of the conferences and materials that may pertain to your work or interests.**