Blog

Bangor Hospital in Bangor, Maine, outsourced the storage of patients’ personal information to a third-party vendor Blue Cloud. Hackers accessed Blue Cloud’s cloud storage, exfiltrated the personal information of the patients at Bangor Hospital, and then encrypted the information left on Blue Cloud’s servers. Hackers then requested a ransom from Blue Cloud related to the data from Bangor Hospital. Blue Cloud paid the ransom, but the patients’ personal information was not returned. These patients sued Bangor Hospital. Are the patients likely to be successful in their lawsuit against the hospital?

Steven Stellar, an internationally known rock star, checked himself into a drug rehabilitation clinic after publicity related to unflattering videos on social media. These videos showed Steven using illegal drugs immediately prior to a public performance, meaning that he was under the influence of illegal drugs while performing on stage. While at the clinic, Steven acknowledged his significant cocaine problem. During group therapy, Steven discussed in detail the drug dealer he frequented to obtain his cocaine while in his hometown of New York City. During one of his break-through sessions, Steven expressed great remorse for harming his 3-year-old daughter on multiple occasions while under the influence of cocaine. Dr. Gloria Galaxy, Steven’s therapist, is concerned about whether she should report the drug-related crimes and the child abuse. Under the Confidentiality of Substance Use Disorder Patient Records Rule, is it likely that Dr. Galaxy can report Steven’s behavior to proper authorities without Steven’s consent?

Select the correct answer: A 42-year-old adult presents to the primary care nurse practitioner for evaluation of “heartburn” symptoms after meals. Symptoms have been present for about the past two months but “came and went” in the past based upon meal composition. The discomfort is worse when lying down or when eating late. The patient’s partner has made comments describing halitosis and that a dentist has noticed some wearing on the tooth enamel. The patient has noticed worsening of asthma symptoms in the past several months.  Which of the following first-line treatments should be incorporated into the clinical management plan of this patient?

Blue Skies, a tech company providing online streaming video services, has experienced a dramatic increase in traffic on its website since its launch in 2020. The company receives numerous requests from law enforcement officers in different states in the United States to view customers’ video streams as they are occurring. The law enforcement requests are not asking for records of customers that are stored. Blue Skies’ privacy officer advocates for hiring an attorney to assist with responding to these requests. The Chief Compliance Officer decides to:

Are X and Y independent? Choose your answer below and state the reason on the scratch paper. No credit will be given without the justification.

Just Learn, a university that opened in 2020, wants to make sure that people at the university have ready access to healthcare. Just Learn has plans to open a healthcare clinic that can be used by both students and faculty. The President of Just Learn asks you, as the privacy officer, what privacy requirements the healthcare clinic likely should follow. You respond:

Doctor Yasmine Yellow specializes in surgeries that are not medically necessary such as face lifts. Since most of the procedures Doctor Yellow performs would not be covered under health insurance, she only accepts credit cards for payment and does not bill insurance. Billy Blue, a potential patient, looks online for a doctor to perform a facelift and finds Doctor Yellow’s website. When Billy visits Doctor Yellow’s office, Billy does not receive a privacy notice with his initial paperwork. Billy asks Doctor Yellow for a copy of the privacy notice and is told that the office does not maintain a privacy notice. Is it likely that Doctor Yellow has violated HIPAA?

After law enforcement officers in Atlanta, Georgia, located no eyewitnesses to an armed robbery that occurred in a parking lot after a Major League Baseball game, these officers obtained a geofence warrant. This warrant compelled Big Tech Company to provide these officers with access to the names and phone numbers of individuals who were within close proximity of the victim near the time of the crime. Based in part on the information obtained from the geofence warrant, the officers arrest Ben Yogi for the crime of armed robbery. At Ben’s criminal trial, his attorneys file a motion to exclude the information obtained pursuant to the geofence warrant, asserting violations of the defendant’s rights under the Fourth Amendment to the U.S. Constitution. Which exceptions to the Fourth Amendment’s warrant requirement is the judge likely to consider in making a decision on this motion:

Luke Lake, an experienced poker player, signs up to play in a national poker tournament at Cool Casino in Las Vegas, Nevada. After arriving at the casino, Luke decides to participate in 4 smaller tournaments in addition to the national poker tournament. To cover the entry fees, Luke pays the casino $20,000 in cash. Does this cash payment trigger a reporting requirement?

TalkTogether.com, a world-wide social media company, is based in San Francisco, California. TalkTogether.com had worldwide revenues of $100 billion in 2024. After numerous meetings of top officials, TalkTogether.com decides that the company should focus on the individual privacy rights of its users. Despite this decision, the CEO determines that data portability is not feasible for the company. What maximum fines could TalkTogether.com face under the GDPR?