Privacy, Security, and Artificial Intelligence

Organizations of all sizes and across all industries encounter extraordinary challenges in managing their data — from personally identifiable information, trade secrets, intellectual property, and other confidential information. This critical data must be securely managed in compliance with constantly evolving laws and regulations and in a manner consistent with a company’s best practices. In a dynamic legal landscape, businesses need a legal team that can help mitigate risks and respond to the unexpected. However, businesses must also have strategic counsel on how to leverage such data more effectively in growing their business, creating value for their customers, and further distinguishing themselves from the competition.

Taft’s Privacy, Security, and Artificial Intelligence Practice attorneys draw on experience that spans industries, practice areas, and jurisdictions. Our attorneys keep at the forefront of up-and-coming state, federal, and international privacy laws and regulations concerning the collection of personal/sensitive data. We advise clients on data privacy and cybersecurity issues, data security breaches, mergers and acquisitions, joint ventures, marketing programs, consumer protection, outsourcing, compliance and regulatory matters, information management, and information sharing. We help clients plan and ensure the necessary safeguards are in place.

Our team is also focused on assisting clients of all sizes on the responsible development, deployment, and governance of artificial intelligence (AI) systems, including compliance with emerging state, federal, and international AI regulations. As with all aspects of our business counseling, we bring a risk-based approach to helping clients both capitalize on the power of AI, while properly managing and balancing the very real risks associated with this powerful technology.

• Advise hospitals and physician groups with respect to security audits.
• Advise technology companies on leveraging AI internally and with products and services
• Representing and defending against claims under the California Information Privacy Act
• Assisting clients as data brokers, including registration with state authorities
• Prepare HIPAA/HITECH privacy and security policies and procedures for health care providers and for business associates.
• Provide HIPAA/HITECH training for health care providers and for business associates.
• Act as outside counsel to a large academic medical practice providing guidance on HIPAA and HITECH matters, including advising on potential breaches and drafting notice of violations.
• Draft privacy policies and terms of use for websites and applications.
• Draft and review agreements involving the access, use, and disclosure of personal information to address data privacy and data breach concerns.
• Conducted a HIPAA risk assessment and risk analysis for a large U.S. health care corporation with nationwide operations.
• Represented a large health care provider in a multistate data breach, including coordination with the Office of Civil Rights (HHS) and states attorneys general.
• Represented a large physician group practice in connection with a data breach HIPAA/HITECH analysis (breach originating with the vendor) and investigation, patient notification, and HHS OCR notification.
• Represented a hospital in connection with a data breach analysis and investigation, HIPAA/HITECH analysis, and advice.
• Successfully represented an industry-leading company against a former employee who had electronically transferred trade secrets and other company confidential information before leaving to join a competitor.
• Successfully defended a company accused of misappropriating trade secrets.
• Drafted policies and provided training to numerous companies related to the human resources aspect of privacy and data security, including bring your own device policies.
• Drafted policies and provided training to companies relative to implementing reasonable precautions to protect trade secrets and other nonpublic, business-sensitive information.
• Assisted educational institutions when student information may have been improperly disclosed.