Health Law Advisor

On July 7, the Court of Justice of the European Union (ECJ) invalidated the EU-US Privacy Shield framework in its ruling in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (Case C-311/18). More than 5,000 organizations in the United States have certified their adherence to this framework, and have relied on it to receive personal data from organizations in the EU in compliance with the General Data Protection Regulation (GDPR) since 2016. The framework was a joint effort between the US Department of Commerce and the European Commission and Swiss Administration to provide companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data from the European Union and Switzerland to the United States in support of transatlantic commerce. The Department of Commerce released the following statement:

The United States shares the values of rule of law and protection of our democracies with our partners in the European Union (EU).  Therefore, we are deeply disappointed that the Court of Justice of the European Union (“ECJ”) has invalidated the EU-U.S. Privacy Shield framework.  The United States is reviewing this outcome and the consequences and implications for more than 5,300 European and U.S. companies, representing millions of transatlantic jobs and over $7.1 trillion in commercial transactions.

The United States and the EU have a shared interest in protecting individual privacy and ensuring the continuity of commercial data transfers.  Uninterrupted data flows are essential to economic growth and innovation, for companies of all sizes and in every sector, which is particularly crucial now as both our economies recover from the effects of the COVID-19 pandemic.  This decision directly impacts both European companies doing business in the United States as well as American companies, of which over 70 percent are small and medium enterprises.  The United States will continue to work closely with the EU to find a mechanism to enable the essential unimpeded commercial transfer of data from the EU to the United States.

Two announcements made by FDA in late October signal a marked change to FDA’s regulatory approach to “homeopathic” drugs. On October 25, 2019, FDA withdrew the 1988 Compliance Policy Guide (“CPG”) 400.400 Conditions Under Which Homeopathic Drugs May Be Marketed, and, concurrently, published revised draft guidance titled Drug Products Labeled as Homeopathic (the “Revised Homeopathic Draft Guidance”).

Homeopathy—an alternative medical approach that began in the late 18^th century—is based on the belief that (1) a substance that causes symptoms in a healthy ...

The Centers for Medicare & Medicaid Services (CMS) and the Department of Health and Human Services Office of Inspector General (OIG) issued their long-awaited proposed rules in connection with the Regulatory Sprint to Coordinated Care today.  Transforming our healthcare system to one that pays for value is one of the Department’s top four priorities, and the Deputy Secretary launched the Regulatory Sprint to remove potential regulatory barriers to care coordination and value-based care.

OIG’s proposed rule revising the safe harbors under the anti-kickback statute ...

One well-recognized way to protect patient privacy is to de-identify health data.  However, trends around increases in publicly-available personal data, data linking and aggregation, big data analytics, and computing power are challenging traditional de-identification models.  While traditional de-identification techniques may mitigate privacy risk, the possibility remains that such data may be coupled with other information to reveal the identity of the individual.

Last month, a JAMA article demonstrated that an artificial intelligence algorithm could re-identify ...