First Healthcare Compliance CONNECT April 2023

Legal Risks
With Health
Data Sharing:
Q&A
Catherine Short
Iliana L. Peters, Shareholder at Polsinelli PC, believes
good data privacy and security is fundamental to
ensuring patients’ trust in the health care system, and to
helping health care clients succeed in an ever-changing
landscape of threats to data security. She is recognized
by the health care industry as a preeminent thinker and
speaker on data privacy and security, particularly with
regard to HIPAA, the HITECH Act, the 21st Century Cures
Act, the Genetic Information Nondiscrimination Act (GINA),
the Privacy Act, and emerging cyber threats to health data.
For many years, Iliana both developed health information
privacy and security policy, including on emerging
technologies and cyber threats, for the Department
of Health and Human Services, and enforced HIPAA
regulations through spearheading multi-million dollar
settlement agreements and civil money penalties pursuant
to HIPAA. Iliana also focused on training individuals in
both the private and public sector, including compliance
investigators, auditors, and State Attorneys General, on
HIPAA regulations and policy, and on good data privacy
and security practices.
As a member of the First Healthcare Compliance Editorial
Council, Iliana is a frequent presenter at educational
events. For more information regarding this topic please
view the related webinar for further discussion and
learning.
Below, Iliana answers some common questions
and provides explanations related to the education
surrounding Health Data, A Value Proposition: Legal Risks
with Innovative Data Sharing Projects.
Can you give us an overview of the health data value
proposition, what some of the legal risks are with
data sharing projects?
This is a new and evolving area of practice, particularly
because we have many different entities that are very
interested in engaging in innovative data sharing projects
that result from the need to do research of all different
types. This includes research with a small “r,” in terms
of research and development within entities, and the of
development of new products and services. And this also
includes Research with a big “R,” that is human subjects
research, as defined under the law, that may be used to
determine new therapies, new drugs, new devices for
patients, as well. There are all kinds of research projects
going on related to the use of data, and for many different
important reasons. And as a result, we’re seeing a lot
of questions about the legal requirements and risks
associated with those types of projects, and particularly
the agreements that are necessary and being put in place
between business partners related to those projects.
Can you give us a summary of the legal issues
involved in data sharing projects and do you think
there are serious legal risks associated with some of
these issues and projects?
8
Panacea Healthcare Solutions LLC © 2023