“I have a quick question…..”

quick question.png

The conversation starts with …. I have a quick question..It’s never quick to ask or quick to answer – especially when to really answer the question, more information is required. I should never say never. If your question is “Is it okay to kidnap a stranger and keep them locked up for ten years while I bilk all their life savings?” – the answer is really quick. No.

Otherwise, most of the time when someone wants to ask a quick question of an attorney, they are generally looking for a valid legal response, even if the attorney disclaims it is not legal advice.

Don’t get me wrong, most of us love intellectual debates and/or discussing our passions. Asking me about privacy is like asking a new mom about her babe – it’s a miracle if I ever shut up. (Those who know me..quit laughing! I am limited to one cup of coffee daily)

The point is – there is rarely a “quick question.” If you really do intend it to be a quick question, do your homework first and only ask the remaining issue. Here’s a good scenario:

Quick question: 
“Should I report my doctor for a HIPAA breach if they mailed me the wrong lab results?”

Why it’s not quick:

  • Who are you thinking you should report the doctor to – the medical board, the U.S. Office for Civil Rights, a non-US regulatory authority, state attorney general, state insurance office, employer, insurer? The list can be very long.
  • Is your doctor under any requirements that address privacy, other than the physician requirement for confidentiality? (HIPAA does not apply to everyone)
  • What information did you receive and how do you know it’s not you? – are the lab results for a test you did not have, is there another name on the test, is it not your patient ID, was the address wrong and the post office delivered it to the right address or post office delivered it to the wrong address? – lots of ways this could be wrong.
  • Did you discover this yourself or were you informed?
  • Why do you want to report it? (public obligation, anger, want to sue, etc.)
  • Have you been harmed? (not necessarily critical to being a breach, but is important)
  • Has the other patient been harmed? (or would they be)
  • Do you still have the information?
  • Have you reported this to the doctor? if so, what what his/her response?

and other questions would follow based on responses.

My quick answer would be – you should let the doctor know and return the information to him/her without keeping a copy, but take notes on the entire interaction. This may or may not be the correct answer depending on the responses to the questions above that I would not know if I did not ask. 

And the “quick questioner” will probably still ask a follow-up question or respond with more information. Making the quick question and quick-perhaps accurate- response still not so quick.

If people really wanted to ask a quick question – they would do the homework and come to the attorney (or privacy officer) with a really quick question –

“Hey, my doctor in Indiana mailed me the lab results for another patient with that patient’s name on it and it is HIV results. I know it is a breach under HIPAA, but it appears my address is connected to that name. I told the doctor’s office and I shredded it, but should I report this to the Office for Civil Rights?”

Quick answer:
“Oh, that’s bad. Yes, you can report to the Office for Civil Rights, although you don’t have to, and they can match it to your doctor’s breach disclosure list, which is not required until the year is over for one-offs. You can also follow up and ask your doctor if they let the other patient know, but they don’t have to tell you. Make sure they correct your address linked to that patient and make sure your name is not on his/her address and no information on you has been sent there.”

This is not unique to privacy or to attorneys. This happens to pretty much everyone. If the quick question is a conversation starter, because you are looking for a way to start chatting, fine. It could be awkward and you might get a rude response or create a bad impression.

If, however, you really do think that you can ask someone who knows (perhaps an “expert”) a question related to their knowledge and expertise and the person is a friend, good acquaintance, or close work colleague – sure, do it. But be respectful, do your homework, and provide concise, clear, and critical facts. Do not turn it into a verbal essay and please explain up front that if it is not so quick from their point-of-view just to say so – you get that there may be complexities that you don’t see.

If this person does answer, you should provide them with a thank you, such as a gift card to their favorite coffee or food place, flowers, thank you item, or effusive thank you card. They won’t expect it – cause who does that? – and it will become a pleasurable experience for them and you.

 

 

Advertisements

Explaining “Privacy Attorney”

privacy wutPeople often ask me what I do as an attorney (disclaimer….I do not take clients, I work for a company). When I say I’,m a privacy attorney, the reactions range from polite confusion to complete incomprehension to vague niceties.

My typical response is “Here in the US, you hear about HIPAA HIPAA HIPAA and patients patients patients, right? In all other countries with privacy laws, you don’t have protection because you’re a patient, but because you’re a person.”

It’s a much bigger deal.

Privacy is something that we have lost in this digital world. We need to reclaim our privacy.

The most  movement in personal data protection law is coming out of the European Union, but privacy (data protection) laws are prevalent in Asia-Pacific, Canada, and Latin America. And the level of protection varies greatly – from protecting only employee data, to everyone’s personal data, to online, mobile, financial, etc.

If you are an individual, pay attention to what you share online and how you maintain the security of your data (don’t write your passwords down on a post-it note and stick it to your computer and don’t email ID and credit cards without encryption…and that include efax). If you’re a business, pay attention to what data you collect, whether you need to collect it, how you use it, share it, and secure it – and for goodness sake, know how you long you retain it and DESTROY it.

That’s what a privacy attorney does. In a very small yet profound nutshell.

“I think I’m Doing Too Much”

I think I’m doing too much. My family had never heard me say those words. Never. And I don’t just mean my kids – my mom, everyone/no one. Those who know me might recognize that I am a hyper-personality, high spirited, too “damn” perky – pick your descriptor. I have always been busy. I started work at maybe 13, 14 years old. I know in one job, I lied about my age….could never get away with that now!

I never cared much for grades, so it is not that I was one of those over-achieving students. I wanted the knowledge, not the external recognition. Given that I generally scored in the top half percent of the top 1% of all those standardized tests, I was classified as a classic underachiever. You laugh now.

But I became too busy. Personally and professionally. privacy lawyer, silicon valley global med tech company check. BCRs (controller and processor – first ever dual application) check. HIPAA check. Emerging tech check. lawyer check. executive check. consulting check. blogging check. start writing a book (check, but leave unchecked that I finished it) – same with PhD  in dissertation phase for 3 years now. Check check check. Happily married finally. 2 amazing, accomplished daughters. Leadership roles in global professional organizations. volunteering with non-profits. great friends. good books. loving pets. awesome home. 150+ pairs of shoes. Mrs. Scottsdale America. Speaking on a variety of subjects to different audiences. teaching law classes. Mercedes AMG. money in savings. off most lupus meds. I even lost 30 pounds. checking all over the place. BUT….

– I was busy, but things were getting accomplished. Yet for the first time in my life – I was overwhelmed. I mean, hell – I survived things that killed others. I know I am lucky – and I give the praise to the God I trust and worship. But I was overwhelmed. Even my adult ADD wasn’t saving me this time.

I have learned that when you need to slow down, you either do it or you’re forced to do it. 

So I have slowed down. I am able to take stock of my goals and my 5 – 10 – 15 year plan. I kinda sorta had a plan, and executed it immaculately despite myself. I know what it important for me professionally and personally – and everything else. everything. is nonessential to my life.

Face the hard decisions. And face them head on with determination and consideration. Be brutally honest with yourself about what matters – and what is simply busy work, or chasing a dream that you thought you should have, or doing things that are expected of someone in your field. Focus on what matters. And yes, professional goals matter too. We spend most of our waking hours working (which can suck if you don’t do what you love), so don’t knock having professional goals and dreams.

Some of us may not be in a position to be choosy, but if it is at all possible – take a step towards being in a place to choose. One step at a time. My goal, growing up poor in Mississippi was 1) be able to walk into a superstop (quickie mart, 7/11, whatever the local corner store is) and buy a coke without having to balance my checkbook first and 2) go on a great vacation every year. #1 I can do. #2 – my definition of a great vacation seems to be morphing.

I’m still young (I tell people I am 74 and looks dayum good for my age), but I am 47 years old. I am young and in a field (privacy law) that is growing leaps and bounds. I know and love some amazing people, both personally and professionally, and I work for some phenomenal people/companies that I respect and hope to continue those relationships.

And I still need to finish that dissertation. this year.

So being too busy was my come to Jesus moment. And I survived it with some hits to the pocket book, ego, health, and personal matters. Maybe that is what it took. I do not ever want to say or feel those words again. I want to be in deliberate control of my life. Live with purpose.

 

ACC WITH: Global Women in Law

20160621_172608Tonight, a dream came true. A vision took form.

The Association of Corporate Counsel (the organization for in-house attorneys with about 40,000 members worldwide) launched their global initiative supporting women attorneys.

It all started with one question “Does the ACC offer programming for women?” The answer was no, but we should. And two years later, here we are. In the brilliant hands of Jennifer Chen, the Director of the ACC Foundation, this program has not only been put in place, it has grown wings.

It took a cadre of amazing ACC attorneys (Tracy Stanton, Jennifer Mailander, Katia Bloom, and many others) along with the ACC (Veta Richardson, Tori Payne, and also many others) to share the vision and take actionable steps to make it happen. Last October, we did a soft launch of WITH at the ACC Annual Meeting, where we held a breakfast with inspiring, accomplished women attorneys. We did surveys, wrote articles, developed toolkits, and spread the word.

That word resulted in honoring three women tonight who have truly forged the path and had a vision and a plan long before us: Irina Bokova, Director-General, UNESCO; Gloria Santona, Executive Vice President, General Counsel and Secretary, McDonald’s Corporation; and Charisse R. Lillie, Fellow and Vice President of Community Investment
Comcast Corporation, Executive Vice President, Comcast Foundation. The fabulous Sunny Hostin, Senior Legal Correspondent & Analyst, ABC News led the discussion, which touched on many key points – mentoring and having a sponsor for one’s career, situations in which they noted “this is what it means to be a woman in the legal field,” salary, plans, and advice. They held the room enthralled – about 200 attendees all nodded their heads in agreement and there were more than a few “yeah. Yeah!” heard around the room.

And this was after David Nabarro, Special Adviser to the United Nations Secretary-General on the 2030 Agenda for Sustainable Development and Climate Change inspired the room with his talk on the 17 goals in the 2030 Agenda – and how many are related to the empowerment of women.  Knowing that 193 countries are committed to seeing women empowered is simply incredible.

And the room was not just women. There were many men present as well – as it should be. Men are a critical component if women are to “live under the sky” (as opposed to breaking the glass ceiling in a few spots here and there).

We all hope to see this field equalized and celebrate the difference that women make. One thing Irina said really resonated with the audience. When a woman reaches a certain position or role, there are high expectations – people are watching. She must do an exceptional job and far surpass expectations. Yet men in the same role are only expected to do the job. They don’t need to surpass expectations, no one is “watching.” At some point, we – as women – want to be average. Let us simply do the job. Because we can. But it is really hard to always exceed expectations that are only set for one half of the profession. Hitting a metric that should not exist is simply unreasonable.

We are excited about our next steps. And we welcome you to the effort. We have a huge initiative in place with Diversity Lab and the onRamp  Fellowships. Caren Ulrich Stacy, the founder, is truly a giant among giants (I think I fell a little in love with her). Five corporate powers have signed on to her program to help women re-enter the legal workforce.

You know you want to be WITH us. Feel free to contact me or the ACC Foundation to learn more. http://www.acc-foundation.com/

 

 

Why Work in Privacy?

top 5Often, when asked what I do, the person is totally flummoxed when I respond that I am a privacy attorney. Sometimes, they will even ask – what does that mean? Well, if I said I was a contract attorney or a patent attorney, they would understand, right? It means I handle contracts or patents – or specifically in my case, I handle privacy.

Ah – that’s the problem, they don’t understand privacy. I mean, seriously, how do I find enough work to fill 40 hours a week?

Privacy is the concept that information about ourselves is only shared to individuals/companies  whom we want to know those things about us.

Simple, right? Not so much.

So why would anyone want to work in privacy? All day long, every day, the whole year, for decades, we fight a battle that few people ever see. It’s like starring in a vampire drama – there’s a fight happening in a world that most people don’t see and would not believe. And like vampires, we typically work in the dark, our emergencies happen at night, and we live off a critical element that is very personal to people….data. And to most of our colleagues, we’re the boogie men who come to steal your profits while you’re sleeping (or when you’re bad).

So why work in privacy?

My top five reasons:

  1. I’m such a geek rebel that I C# and bleed java. I am building a complete Padme parade dress costume for ComicCon. My UAV isn’t even registered. I speak in movie quotes. And Sheldon is my hero. Bazinga!
  2. Unlike most corporate attorneys, I may work for the company, but my job is to protect the little guy. I always did go for the underdog – I liked Tom Wopat not John Schneider and I preferred Larry Wilcox to Eric Estrada. I may look like a heartless corporate attorney, but really…I’m all squishy inside.
  3. The field is growing by leaps and bounds. Everywhere you turn, there is data being collected, used, shared, abused, lost, forgotten, manipulated, and more! Technology is getting smaller, stronger, and can  hold more data.
  4. The privacy field is a gender neutral one.  Perhaps because of the way it grew up, women tend to  have equal pay and leadership roles.
  5. My ADD (Attention Deficit Disorder) has free reign! I am  never bored; I can work on 46.3 projects at a time; and given how fast the field changes – if I don’t like something, it is likely to be different tomorrow.

Being a privacy professional is a calling for certain people and requires flexibility, rampant curiosity, thick skin, and a relentless gift for persuasion. If you don’t love it – don’t get in it. It is not a profession for those seeking glory or an easy desk job.

teaching, learning, doing,& dreaming

It’s been a dream of mine to teach college or more correctly, simply be involved with college students at some level. See, right out of law school, I worked at the Sandra Day O’Connor College of Law at Arizona State University. It was not named after that glorious woman when I started, but I was there during the renaming.

teachI’ve had this dream and as I write this entry, I have to wonder how this sounds. Do I think I am so great that I should have the chance to influence others? Or is it that those cannot do, teach? Not so narcissistic as the former and not so incompetent as the latter. Or so I hope.

I feel in love with the relationships one builds with students – how they change and grow, how they learn, how one small thing can change their lives and they can go on to change the lives of others. Yeah yeah. I’m a dreamer. But I truly believe in the power of people and only people can change this world. And we need all the people in this world to be part of the change – if you’re not part of the solution, you’re part of the problem, right?

I mentored a fabulous young man, Juan, starting when he was in 5th grade until he finished 8th grade. We stayed in touch and he came to live with us later to go to college. We had a conversation about why going to college was important when he could get (and he had) a job he loved that paid him well. It’s not about the money, it’s about the ability to participate actively in the governance of your community. Civic engagement. Now, that can happen at all levels, but in this nation, we have a huge problem – most leadership positions are held by a rather homogenous group. We need minorities and women to be equally represented. Until the leadership of this nation resembles that of its people, we will continue to experience the consequences of non-representation.

I had left academia due to my husband’s job and have been trying to get back to it ever since. Few colleges want to hire in someone who has been in the corporate world (and the pay cut is hard to take in order to work one’s way up the ranks), so my options are to volunteer and/or be an adjunct professor. (Now, if there is anyone with a college or university reading this – trust me, I am so worth the seeming risk. It’s my calling.)

This past year, my dream started coming true.  I am now teaching an online course in fundamental law to master’s students and an in-person course on privacy (big data and emerging technologies). And oh my goodness, the students are so worth it. I love the engagement, the discussions, the worries and questions. And I love having both populations of students: online grad students and in-person. Funny, I never considered that my in-person would include undergrad students, but it does! How cool is that?

I’ll never be a scholar (despite my PhD efforts) – I am not so eloquent or studious. I am a practitioner and a very practical one at that. I have the opportunity to combine my two loves – privacy and students. And for now, I am in hog heaven. good googli moo

 

RN2JD: What being an RN taught me about being a Privacy Attorney

nurse scales

Nursing school is harder than law school. Seriously.

As a nurse (and a nursing student), you really do have someone’s life in your hands. As an attorney, some may argue that you do, but you really don’t. There are many failsafes built into the system.

As a law student, I rarely took my books into the house. No, I did not read for class. (and yes, I still did really well in my classes). As a nursing student, I lived, breathed, and sweated with my books.

Being an RN has helped me be a better privacy attorney. I was an oncology, hospice, clinical research, cardiac, and unit (ICU/CCU) nurse. Here are the top ten ways being an RN helps:

  1. Stay cool in an emergency.

When there is an emergency, you need the quarterback (usually the one who knows the most, like the doctor), you need the experienced nurses, and you need a recorder – someone who documents what was done when.  You don’t need someone who loses their head. One must be knowledgeable, experienced, fast, decisive, and accurate.

  1. Check your work twice or three times and have a witness when it is critical.

Sometimes, something is just important enough that you need to not only check your work, but you need someone to check it for you – and perhaps even go on record that they have done so. In both professions, this seems to happen more at the start of your career, but there are many times that it is still needed for an experienced professional.

  1. Use your time wisely.

Do what needs to be done, when it needs to be done. And if a meeting is required, have the right people in the room – and don’t waste time.

  1. Weird things happen at night and during the full moon.

Be prepared for anything. This is not an urban myth. If something weird is going to happen or something is going to go tragically wrong, it will be at night or during a full moon. People act differently. Those in comas may wake up. Those who can’t move, start dancing. It’s just weird. Be prepared for weird. Take it in stride. Manage your business.

  1. Document. Document. Document.

Enough said.

  1. Be an advocate for those you serve and to those you serve.

Those you serve don’t always know what they need and are not always rationale, be they patients or clients (or family). People tend to set their sights on something and that something may or may not be right for them. At times, you have to advocate for their wishes when it is something you don’t personally believe in, but your job is to advocate ethically for the one you serve. Other times, you have to advocate to that person when what they want, what they really really want, is not the right choice or the smart choice. Sometimes the wrong choice is what they select and despite your best advice and guidance, it is all they can see. Sometimes, it hurts to see that choice made, but you are not them. There have been times when I have had to advise a family and I cried doing it. It was a painful choice, but the right one for the person affected who could not speak for him/herself.

  1. Fight to win.

When you are going in to fight an enemy, pull out all of the stops within legal and ethical boundaries. Be creative. Attack on multiple fronts. Identify what is most important and fight for that, even if it may not seem like winning to others. Put all you have into winning and at times, be willing to redefine what winning means.

  1. Root problems may not be seen, but cause just as much damage.

You may not see the disease that is growing and causing issues. Until you realize it, you must fight the symptoms and not the cause. Sometimes that is all you can do, but along with treating the symptoms, keep looking for the root cause. If you can find the cause, hope that it is curable. If it is not curable, then look for what you can do – reduce it, contain it, something. If however, you cannot find the cause, then fix the symptoms – alleviate the suffering and prevent complications. In law, this applies to people as well as processes. You can always tell when there is a problem, you just don’t always know where the root of that problem lies.

  1. Just because you love what you do, doesn’t mean you love every minute of it.

I loved being a nurse.  I even loved being a hospice nurse and more about living during that time. But I did not love every minute of every day. Same with being a privacy attorney. I love what I do. I am very passionate about it, but I don’t love every minute of it. Sure there are frustrations and problems.  If, however, the negatives started outnumbering the positives, I’d have to find something else to do.

  1. Things are done a certain way for a reason.

Some may not still be warranted. Don’t be afraid to question them, but don’t question them just for the sake of argument. In nursing and in law, there is a reason for traditions, norms, expectations, policies, practices, and processes. Some of this is general across the profession and some is localized to your region or employer. Don’t come into a new place and start shaking it up without sizing it up.

Bonus: When you get the answer you want, shut up.