Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

Client Alert
November 15, 2018

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

Cybersecurity
Client Alert

Enhancing Privacy Protections for Substance Use Disorder Patient Records

February 16, 2024On February 8, 2024, the U.S. Department of Health and Human Services (“HHS”) finalized updated rules to 42 CFR Part 2 (“Part 2”) for the protection of Substance Use Disorder (“SUD”) patient records. The updated rules reflect the requirement that the Part 2 rules be more closely aligned with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) privacy, breach notification, and enforcement rules as mandated by the Coronavirus Aid, Relief, and Economic Security Act of 2020.Client Alert

Columbus, Ohio Ordinance Prohibits Employers from Inquiries into an Applicant’s Salary History

January 30, 2024Effective March 1, 2024, Columbus employers are prohibited from inquiring into an applicant’s salary history. Specifically, the ordinance provides that it is an unlawful discriminatory practice to:Client Alert

The Ohio Chemical Dependency Professionals Board’s Latest Batch of Rules: What Providers Should Know

January 26, 2024The Ohio Chemical Dependency Professionals Board has introduced new rules and amendments, covering various aspects such as CDCA certificate requirements, expanded services for LCDCs and CDCAs, remote supervision, and reciprocity application requirements. Notable changes include revised criteria for obtaining a CDCA certification, expanded services for LCDCs and CDCAs, and updated ethical obligations for licensees and certificate holders, including non-discrimination, confidentiality, and anti-sexual harassment measures.Client Alert

Governor Mike DeWine and The Ohio State University Introduce the SOAR Study on Ohio Mental Illness

January 22, 2024On January 19, Ohio Gov. Mike DeWine and The Ohio State University announced a new research initiative, the State of Ohio Adversity and Resilience (“SOAR”) study, which will investigate all factors influencing Ohio’s mental illness and addiction epidemic.Client Alert

CHANGING TIDES: Summary and Effects of Burnett et. al. v. National Ass’n of Realtors, et. al.

January 17, 2024In April 2019, a class-action Complaint was filed in federal court for the Western District Court for Missouri arguing that the traditional payment agreements employed by many across the United States amounted to conspiracy resulting in the artificial increase in brokerage commissions. Plaintiffs, a class-action group comprised of sellers, argued that they paid excessive brokerage commissions upon the sale of their home as a result of the customary payment structure where Sellers agree to pay the full commission on the sale of their property, with Seller’s agent notating the portion of commission they are willing to pay to a Buyer’s agent at closing on the MLS or other similar system.
Older posts
Newer posts