1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar

New ABA Opinion – Attorneys Must Take Reasonable Cybersecurity Measures To Protect Client Data

On May 11, 2017, the American Bar Association (ABA) issued Formal Opinion 477, making clear that a lawyer may transmit information relating to the representation of a client over the Internet without violating the Model Rules of Professional Conduct so long as the lawyer takes reasonable efforts to prevent inadvertent or unauthorized access to client information. Lawyers may also be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information when required by an agreement with the client or by law, or when the nature of the information requires a higher degree of security. This new opinion updates a prior opinion issued by the ABA in 1999 (Formal Opinion 99-413), in which the ABA concluded that attorneys may use the Internet to transmit unencrypted communications relating to a client without running afoul of the Model Rules of Professional Conduct.

According to the ABA, in the “technical landscape of Opinion 99-413,” unencrypted email posed “no greater risk of interception or disclosure than other non-electronic forms of communication.” Although this premise remains true today for routine communication with clients, and the use of unencrypted routine email generally remains an acceptable method of lawyer-client communications, cyber-threats and the proliferation of electronic communications devices have “changed the landscape and it is not always reasonable to rely on the use of unencrypted email.” As an example, the ABA notes that electronic communication through certain mobile applications or on message boards or via unsecured networks may lack the basic expectation of privacy afforded to email communications. Lawyers must therefore, on a case-by-case basis, constantly analyze how they communicate electronically about client matters.

Although the ABA does not provide specific steps for attorneys to take in this regard, it does provide the following considerations as guidance:

Understand the Nature of the Threat

The ABA says that understanding the nature of the threat includes consideration of the sensitivity of the client’s information and whether the client’s matter is a higher risk for cyber intrusion. Client matters involving proprietary information in highly sensitive industries such as industrial designs, mergers and acquisitions or trade secrets, and industries like healthcare, banking, defense or education, may present a higher risk of data theft.

Understand How Client Confidential Information is Transmitted and Where It Is Stored

The ABA says a lawyer should understand how their firm’s electronic communications are created, where client data resides, and what avenues exist to access that information. Every “access point is a potential entry point for a data loss or disclosure.” Every access point, and each device, should therefore be evaluated for security compliance.

Understand and Use Reasonable Electronic Security Measures

Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. What is “reasonable” will vary depending on the facts of each case. The ABA indicates that making reasonable efforts may include “analysis of security measures applied to both disclosure and access to a law firm’s technology system and transmissions.” A lawyer should also understand and use electronic security measures to safeguard client communications and information, including using secure internet access methods to communicate, access and store client information, using unique complex passwords, changed periodically, implementing firewalls and anti-malware/spyware/antivirus software on all devices, and applying necessary security patches and updates to software when required.

Determine How Electronic Communications About Client Matters Should Be Protected

Different communications require different levels of protection. The ABA recommends that the lawyer and client discuss what levels of security will be necessary for each electronic communication about client matters. For example, if client information is of sufficient sensitivity, the ABA says a lawyer should encrypt the transmission and determine how to do so to sufficiently protect it, and consider the use of password protection for any attachments. Lawyers can also consider the use of well vetted and secure third-party cloud based file storage systems to exchange documents normally attached to emails. Lawyers should also be cautious in communicating with a client if the client uses computers or other devices subject to the access or control of a third party.

Label Client Confidential Information

The ABA recommends lawyers follow the “better practice” of marking privileged and confidential client communications as “privileged and confidential” and using disclaimers in client emails.

Train Lawyers and Nonlawyer Assistants in Technology and Information Security

The ABA recommends lawyers establish policies and procedures, and periodically train employees, subordinates and others assisting in the delivery of legal services, in the use of reasonably secure methods of electronic communications with clients.

Conduct Due Diligence on Vendors Providing Communication Technology:

The ABA recommends lawyers examine a vendor’s reference checks and credentials, security protocols and policies, hiring practices, and the use of confidentiality agreements when determining which vendors to use in supplying communications technologies.

Takeaways

Although most enterprises and firms use some level of protection in their electronic communications, this new opinion highlights the growing focus on cybersecurity across all industries and professions. Encryption is increasingly becoming the industry standard in securing electronic data and communications, and is often the first line of defense when facing a data breach scenario.

New ABA Opinion – Attorneys Must Take Reasonable Cybersecurity Measures To Protect Client Data

HHS Plans To Launch Cybersecurity Center Focused On Medical App Security

The US Department of Health and Human Services (HHS) announced on April 20 that it plans to launch a cybersecurity initiative modeled on the US Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) that will be aimed at educating healthcare organizations and consumers about the risks of using mobile applications and data. The new center, which will be called the Health Cybersecurity and Communications Integration Center (HCCIC), is intended to be a collaborative effort between public and privacy industry. A similar cybersecurity initiative is being developed by the Centers for Medicare & Medicaid Services (CMS).

Chris Wlaschin, the chief information security officer for HHS, says this type of collaborative center is needed because approximately 50% of US healthcare organizations lack the adequate tools to deter and manage cyber breaches. As mobile health applications become more prevelant, the HHS sees the HCCIC as an opportunity to help developers secure patient data.

The new HHS center represents a continual effort by the federal government to address healthcare app cybersecurity. In December 2016, the FDA released guidance on “Mobile Medical Applications.” The HHS Office of Civil Rights and Federal Trade Commission  have also launched online resources for medical app cybersecurity. And HHS’s Health Care Industry Cybersecurity Task Force recently submitted a draft report to Congress that laid out six “imperatives” for lawmakers and executive branch officials to consider when seeking to secure patient data, including security surrounding applications.

If you or your company is developing, or has implemented a medical app, the Dentons Privacy and Cybersecurity Group can help you navigate this constantly developing federal landscape. We will also provide further updates as the HCCIC becomes operational this summer.

HHS Plans To Launch Cybersecurity Center Focused On Medical App Security

NIST Releases Draft Guidance On Securing Wireless Infusion Pumps In The Healthcare Industry

On May 8, 2017, the National Institute of Standards and Technology (NIST), through its National Cybersecurity Center of Excellence (NCCoE), released a new draft NIST Cybersecurity Practice Guide (SP 1800-8) entitled “Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.” The purpose of the new guidance is to address the security flaws in external infusion pumps in the healthcare industry, and provide engineers and IT professionals a roadmap for how they can securely configure and deploy wireless infusion pumps by using “standards-based commercially available technologies and industry best practices[.]” NIST Cybersecurity Practice Guides (Special Publication Series 1800) target specific cybersecurity challenges in the public and private sector, and are intended to serve as practical, user-friendly guides that facilitate the adoption of standards-based approaches to cybersecurity. They do not describe regulations or mandatory practices. Nor do they carry statutory authority. NIST is accepting public comment on the new draft guidance through July 7, 2017.

Overview Of Draft Guidance

Infusion pumps are defined by the FDA as a medical device that delivers fluid into a patient’s body in a controlled manner. Once standalone instruments that interacted with the patient or medical provider only, infusion pumps are now connected to a variety of systems and networks, contributing to what NIST calls the Internet of Medical Things (IoMT). This new connectivity brings with it benefits and challenges. Although connecting fusion pumps to point-of-care medication systems and electronic health records can improve the healthcare delivery process, it can also create significant cybersecurity risk that could lead to operational or safety risks. Specifically, tampering with the wireless infusion pump ecosystem can expose a healthcare provider to:

  1. Access by malicious actors;
  2. Loss or corruption of enterprise information and patient data and health records;
  3. A breach of protected health information;
  4. Loss or disruption of healthcare services; or
  5. Damage to an organization’s reputation, productivity, and bottom-line revenue.

Key Takeaways From New Draft Guidance

The new guidance is written from a how-to perspective, providing details on how to install, configure and integrate components. It is therefore primarily intended for professionals implementing security solutions within a healthcare organization, such as biomedical, networking and cybersecurity engineers and IT professionals who are responsible for securing and configuring wireless infusion pumps. The new guidance maps out the security characteristics of wireless infusion pump ecosystems to currently available cybersecurity standards and the HIPAA Security Rule, and applies “security controls to the pump’s ecosystem to create a ‘defense-in-depth’ solution for protecting infusion pumps and their surrounding systems against various risk factors.”

NIST claims organizations will, if they adopt the new guidance:

  • Reduce cybersecurity risk, and potentially reduce impact to safety and operational risk, such as the loss of patient information or interference with the standard operation of a medical device;
  • Develop and execute a defense-in-depth strategy that protects the enterprise with layers of security to avoid a single point of failure and provides strong support for availability; and
  • Implement current cybersecurity standards and best practices, while maintaining the performance and usability of wireless infusion pumps.

A copy of the draft guidance is here. If you or your business are interested in submitting public comments in response to the new draft guidance, the Dentons Privacy and Cybersecurity Group can help. We are also prepared to assist your organization in navigating the new draft guidance and securing your networked devices against the constantly evolving threat landscape.

 

NIST Releases Draft Guidance On Securing Wireless Infusion Pumps In The Healthcare Industry

DHS Warns Congress On Mobile Device Security

On May 4, 2017, the US Department of Homeland Security (DHS) submitted a new study to Congress that detailed current and emerging threats to the Federal government’s use of mobile devices and provided recommendations for security improvements. The DHS Science and Technology Directorate in coordination with the National Institute of Standards and Technology (NIST) and its National Cybersecurity Center of Excellence were responsible for the study.

Overview of Study

The study found that threats to the mobile device ecosystem are growing, and that security of mobile computing is improving. The study also found that threats to the Federal government’s use of smartphones and tablets running mobile operating systems were prevalent across the mobile device ecosystem, and presented a separate and distinct threat from those impacting desktop workstations. The study found that threats to mobile devices range from those perpetrated by nation-states to those committed by organized crime or hackers, and that Federal government mobile devices may be targeted specifically because of their public nature.

Key Recommendations

The study provides a series of recommendations to enhance the Federal government mobile device security measures. A number of these recommendations could be helpful for business to adopt as well:

  • Adopt a framework for mobile device security based on existing standards and best practices.
  • Coordinate the adoption and advancement of mobile security technologies into operational programs to ensure that future capabilities include protection and defense against mobile threats.
  • Develop cooperative arrangements and capabilities with mobile network operators to detect, protect against, and respond to threats.
  • Create a new defensive security research program to address vulnerabilities in mobile network infrastructure and increase security and resilience.
  • Develop policies and procedures regarding U.S. Government use of mobile devices overseas based on threat intelligence and emerging attacker tactics, techniques, and procedures.

This new study highlights the vulnerabilities present in mobile device usage in the workplace. The Dentons Privacy and Cybersecurity team can help you and your business develop a robust and comprehensive mobile defense strategy, and update your existing policies to guard against the growing threats presented to the mobile device ecosystem.

DHS Warns Congress On Mobile Device Security

Workplace Performance Concerns Lead to Privacy Violation

A recent Order of the Office of the Information and Privacy Commission of Alberta (OIPC) provides guidance on potential privacy traps when managing performance issues in the workplace.

Two coworkers of the complainant were concerned about the complainant’s workplace performance. The reasons are opaque but there may have been health issues such as substance abuse requiring rehabilitation. The coworkers who were friends of the complainant emailed and texted the parents of the complainant. At least one of the coworkers also provided information to the employer apparently at the request of the employer.

Ultimately, the adjudicator concluded that the coworkers were acting in a personal capacity when communicating with the parents (this was more by luck than design in one case). But, the employer was found to have violated the Alberta Personal Information Protection Act (PIPA) by failing to have a policy or otherwise notifying the complainant on the circumstances in which it might collect performance-related personal information from coworkers.

Were the communications to the parents in the course of employment?

If the coworkers communicated personal information about the complainant to her parents, this would have violated PIPA, as a disclosure without consent. The organization argued that the coworkers were not acting on behalf of the employer when they wrote to the complainant’s parents and disclosed information about her performance at work and their concerns about the complainant’s personal life. One of the emails was sent using the coworker’s work email address. However, the adjudicator concluded that this was not determinative since the coworker said that she was writing from that email account so that it would appear legitimate and provided her personal email account address as contact information.

The text messages were more complicated. The coworker sending those messages initially conveyed personal information about the complainant. However, in subsequent messages, this coworker relayed information about the steps the employer intended to take to address the complainant’s work performance and that the employer wanted to arrange a meeting with the complainant, the complainant’s mother and the coworkers. Ultimately the adjudicator concluded that the personal information that was disclosed in the text messages was done in the context as a friend of the coworker and not as a representative of the employer. As for the subsequent texts, the adjudicator concluded it was possible that the coworker was acting as an employee of the employer (with or without authority) but at that point the discussions were about a meeting and did not reveal further personal information.

Was providing the information to the employer done in the course of employment?

The adjudicator accepted that a coworker might provide personal information about another employee in their personal capacity rather than in the course of their employment. The adjudicator concluded that the key issue was the circumstances in which the information was provided. The adjudicator concluded that “[w]hen the information is provided in the workplace, and especially where it is solicited by someone in the organization that has the ability to deal with performance issues (as the employer does here), it seems to be reasonable to assume that the information is being provided as an employee, and not in a personal capacity.”

Did the employer violate the complainant’s privacy?

The adjudicator accepted that the complainant’s personal information at issue was information that would be useful in managing the employment relationship with the complainant and, therefore, the information was employee personal information. This was significant because there is more latitude to use and disclose employee personal information without consent. However, in order to use or disclose employee personal information without consent, the employer must provide reasonable notice to the individual. The notification must be given before the information is used and disclosed.

The adjudicator accepted that reasonable notice could include a policy on how an organization deals with performance or disciplinary issues or when feedback may be requested from coworkers, provided the policy was brought to the attention of employees. Alternatively, in this case, the employer could have approached the complainant first to discuss the performance concerns and advising the complainant that the employer may need to seek input from the coworkers. The employer failed to do so.

Key Takeaways

Employers should make sure that employee privacy policies or codes of conduct contain explicit reference to the need to gather information from coworkers in some cases in order to manage performance issues and how the employer will respond to unsolicited performance concerns by coworkers. This case did not involve an investigation into a harassment or other violation and so the exceptions for investigations did not apply.

This case also provides another reason to educate employees on obligations under personal information legislation. One could easily imagine other scenarios in which well-intentioned employees may be found to be acting in the course of their employment when communicating with family members or other friends of a coworker.

, ,

Workplace Performance Concerns Lead to Privacy Violation