law firm

Orrick Law Firm Reports HIPAA Breach

A successful law firm with a sterling reputation is not immune to cyberattacks. In fact, hackers are targeting law firms more frequently because they possess so much valuable private information. When a law firm represents a covered entity and receives protected health information (PHI) during their work, the law firm is a HIPAA business associate.

On July 20 Orrick, Herrington & Sutcliffe LLP (Orrick) reported a data breach affecting 153,000 individuals to several state regulators. It also reported a HIPAA breach to the U.S. Department of Health and Human Services on June 30, noting that the PHI of 40,823 individuals was compromised. Orrick is a global law firm focusing on technology and innovation, energy and infrastructure and finance.

Orrick discovered suspicious activity on its network on March 13. In a press statement Orrick explains that between February 28 and March 13, 2023, an unauthorized third party obtained files containing personal and protected health information.

Vision Benefits Plan Members and Dental Patients Affected

Although we don’t know details of the cyber incident, public reports indicate that members of vision benefit plans and dental patients of Delta Dental California have been affected. Orrick held vision benefits PHI because it had worked on a case involving a 2020 security event at EyeMed Vision Care. As a result, this 2023 hack on Orrick caused the data to be breached a second time. The vision benefits PHI taken in the breach included names, addresses, birth dates, and Social Security numbers.

Orrick held dental PHI because it has provided legal services to Delta Dental of California and had received personal and protected health information about plan participants. The dental PHI taken during the breach may have included names, addresses, date of birth, dental insurance policy, health care provider information and limited dental diagnosis and treatment-related information. The event was isolated to Orrick’s system and did not involve Delta Dental of California’s network or systems.

Attorney-Client Privilege Not Enough for HIPAA

Confidentiality is fundamental to the practice of law, so lawyers are used to maintaining privacy. But law firm business associates have specific HIPAA compliance requirements for special policies and procedures that go well beyond routine attorney-client privilege safeguards.

For example, the HIPAA Security Rule requires administrative, physical and technical safeguards for electronic PHI. Both the Privacy and Security Rules mandate that only the minimum necessary PHI be used or disclosed, so minimizing personal data received and stored is key. Cybersecurity defenses need to be strong and constantly updated. Business associates must conduct an annual HIPAA risk analysis and provide workforce training.

The HIPAA E-Tool® understands business associates and has special provisions for law firm business associates. The HIPAA E-Tool® Business Associate Edition explains what you need to do and how your responsibilities compare to covered entities. A self-guided Risk Analysis and workforce training are included. And The HIPAA E-Tool® updates all the policies, templates and forms are every time the law changes.

Don’t wait for an embarrassing cyber attack to uncover your cybersecurity weaknesses and reveal protected health information. Shore up your defenses and protect your reputation with targeted preventive HIPAA compliance instead.

Share This Post

Maggie Hales

Maggie Hales is a lawyer focusing on health information privacy and security. As CEO of ET&C Group LLC she advises health care providers and business associates in 36 states, Canada, Egypt, India and the EU, using The HIPAA E-Tool® to deliver up to date policies, forms and training on everything related to HIPAA compliance.

Copyright © 2023 ET&C Group LLC.

The HIPAA E-Tool® and Protecting Patient Privacy is Our Job®
are registered trademarks of ET&C Group LLC

Terms & Conditions | Privacy Policy | Cookies Policy | Privacy Settings | HTML/XML Sitemap

Mailing Address
The HIPAA E-Tool
PO Box 179104
St. Louis, MO 63117-9104

8820 Ladue Road Suite 200
St. Louis, MO 63124