Privacy Law Commons^™

From Chevron To Chaos: How Loper Is Redefining The Future Of Health Privacy, Skylar Johnson

Oklahoma Law Review

No abstract provided.

Law Enforcement, Reproductive Health Information, And The Hipaa Privacy Rule, Stacey A. Tovino

Faculty Articles

On April 26, 2024, the federal Department of Health and Human Services (HHS) promulgated a final rule (Final Rule) amending the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The Final Rule prohibits HIPAA covered entities and business associates from using and disclosing protected health information (PHI) to conduct criminal, civil, or administrative investigations into an individual for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care. The Final Rule also prohibits HIPAA covered entities and business associates from using and disclosing PHI to impose criminal, civil, and administrative liability on any individual, or to …

Exposed! Students’ Personal Reproductive Healthcare Information, Janet Koven Levit

Oklahoma Law Review

No abstract provided.

The Warrant Exception That Isn't: Fisa Section 702, "Defensive" Searches, And The Fourth Amendment, Noah C. Chauvin

Faculty Articles

Section 702 of the Foreign Intelligence Surveillance Act allows the government to conduct warrantless electronic surveillance of non-Americans who are located overseas. Although the surveillance targets foreigners, Americans' communications are "incidentally" collected, too. Once the government has acquired Americans' communications, court-approved rules allow it to conduct warrantless searches for and through them in its Section 702 databases. Intelligence agencies have used these rules to turn this foreign intelligence program into a domestic spying tool, conducting tens of thousands of warrantless "backdoor" searches for Americans' private communications obtained under Section 702 every year.

Section 702 periodically sunsets; Congress most recently reauthorized …

The Kids Aren’T Alright: Creating Greater Protections For The Children Of Family Vloggers, Annie Dunn

Oklahoma Law Review

No abstract provided.

Artificial Intelligence And The Hipaa Privacy Rule: A Primer, Stacey A. Tovino

Faculty Articles

No abstract provided.

Increasing Congressional Oversight Of Fisa Section 702 After Risaa, Noah C. Chauvin

Faculty Articles

In April of 2024, Congress passed the Reforming Intelligence and Securing America Act ("RISAA"). This bill reauthorized Section 702 of the Foreign Intelligence Surveillance Act ("FISA'), an important counterterrorism authority that was intended to make it easier for the government to spy on foreign terrorists but which has been repeatedly abused to spy on Americans. While RISAA enacted modest surveillance reforms, it also included substantial expansions of the government's spying powers. Moreover, it largely left intact the existing oversight regime for Section 702, which is deficient as a matter of law, policy, and fact.

This article assesses the extent to …

Cyberflashing: Exposing Oklahoma’S Legal Loophole, Sara Wray

Oklahoma Law Review

No abstract provided.

Growing Tensions: Consumer Privacy And Corporate Disclosures, Megan Wischmeier Shaner

Faculty Articles

Data privacy and data security have become key issues for legislators, regulators, and individual citizens. Roughly two-thirds of Americans believe their data is being regularly tracked, monitored, and collected by companies and the government. A majority of U.S. adults also believe their data is less secure today than five years ago, expressing concerns that they have little control over how their personal information is being used and that the entities who control their data are not responsible stewards. In the absence of comprehensive federal regulation, a continuous stream of privacy statutes have been proposed at the state level. Beginning with …

Confidentiality Over Privacy, Stacey A. Tovino

Faculty Articles

No abstract provided.

Privacy For Student-Patients: A Call To Action, Stacey A. Tovino

Faculty Articles

Consider a law student who has a mental or reproductive health issue that the student wishes to keep private. If the student seeks care at an off-campus health clinic that is not affiliated with the student’s law school or university, the student typically has a number of federally enforceable privacy rights. For example, the federal HIPAA Privacy Rule will typically apply and prohibit the clinic from disclosing the student’s protected health information to professors, parents, and other third parties without the student’s prior written authorization. The law student also will have the right to receive a notice of privacy practices, …

In Celebration Of Dissents (And Lengthy Textbooks): How Digital Became Different For The Fourth Amendment And Why It Is Time For A Real Warrant Default, Stephen E. Henderson

Faculty Articles

The last decade has brought tremendous change to the Fourth Amendment, finally resulting in a ‘digital is different’ norm. We stand at an inflection point between a monolithic, analog past and a murky future of yet-unarticulated constitutional digital policing rules. It is a good time, then, to reflect upon how we came to be here and where we ought to go. This Essay first looks back to a monumental, majestic dissent: that of Justice Louis Brandeis in the 1928 decision of Olmstead v. United States. Every American, and especially every law student, ought to know that opinion, and judges …

Not So Private, Stacey A. Tovino

Faculty Articles

Federal and state laws have long attempted to strike a balance between protecting patient privacy and health information confidentiality on the one hand and supporting important uses and disclosures of health information on the other. To this end, many health laws restrict the use and disclosure of identifiable health data but support the use and disclosure of de-identified data. The goal of health data de-identification is to prevent or minimize informational injuries to identifiable data subjects while allowing the production of aggregate statistics that can be used for biomedical and behavioral research, public health initiatives, informed health care decision making, …

Accidental Wiretaps: The Implications Of False Positives By Always-Listening Devices For Privacy Law & Policy, Lindsey Barrett, Ilaria Liccardi

Oklahoma Law Review

No abstract provided.

Tiktok, Wechat, And National Security: Toward A U.S. Data Privacy Framework, Robert L. Rembert

Oklahoma Law Review

No abstract provided.

Bringing Down Big Data: A Call For Federal Data Privacy Legislation, Madeline M. Cook

Oklahoma Law Review

No abstract provided.

At A Covid Crossroads : Public Health, Patient Privacy, And Health Information Confidentiality, Stacey A. Tovino

Faculty Articles

This essay summarizes and assesses the various bulletins, guidance documents, and notices of enforcement discretion released by the federal Department of Health and Human Services regarding the application of the HIPAA Privacy Rule to the COVID-19 pandemic. Among other topics and actions, these authorities address the application of the HIPAA Privacy Rule to the use and disclosure of protected health information for public health activities, waive the application of certain HIPAA Privacy Rule requirements during the COVID-19 pandemic, and announce enforcement discretion regarding certain covered entities’ non-compliance with particular provisions within the HIPAA Privacy Rule. These authorities overwhelmingly, and appropriately, …

A Virtuous Circle: How Health Solidarity Could Prompt Recalibration Of Privacy And Improve Data And Research, Nicolas P. Terry, Christine Coughlin

Oklahoma Law Review

No abstract provided.

Covid-19 And The Hipaa Privacy Rule: Asked And Answered, Stacey A. Tovino

Faculty Articles

The severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), the virus that causes coronavirus disease 2019 (COVID-19), raises important and vexing privacy and security issues. Public health officials, law and policy makers, and members of the general public disagree, for example, regarding the amount and type of individually identifiable health data that should be collected, used, and disclosed for public health surveillance, public health investigation, and public health intervention. Stakeholders also diverge in their opinions regarding the sufficiency of federal and state data privacy and security laws. Some stakeholders believe that current statutes and regulations are sufficient to protect individually identifiable …

In A World Of "Fake News," What's A Social Media Platform To Do?, Evelyn Aswad

Faculty Articles

While the circulation of disinformation and misinformation online can pose a variety of risks to societies around the world, it should also be of concern that overreacting to such false information can undermine human rights, including freedom of expression. The business operations of global social media platforms frequently intersect with this latter concern because of a spike in the adoption of national laws that ban “fake news” as well as their own platform policies to tackle false information. This Essay assesses the corporate responsibility standards afforded by the United Nations’ Guiding Principles on Business & Human Rights as well as …

Losing The Freedom To Be Human, Evelyn Aswad

Faculty Articles

In 2019, Apple’s CEO warned that contemporary business models, which are based on harvesting our personal data and monetizing everything we do online, violate our privacy and will eventually cause us “to lose the freedom to be human.” Others have taken this privacy concern a step further by questioning whether these business models undermine mental autonomy, i.e., the ability to think and form opinions. The burgeoning chorus of concerns has triggered a variety of high-profile calls to explore whether international human rights law protects against intrusions on the inner sanctum of one’s mind, particularly with respect to the business models …

Assumed Compliance, Stacey A. Tovino

Faculty Articles

No abstract provided.

Going Rogue: Mobile Research Applications And The Right To Privacy, Stacey A. Tovino

Faculty Articles

This Article investigates whether nonsectoral state laws may serve as a viable source of privacy and security standards for mobile health research participants and other health data subjects until new federal laws are created or enforced. In particular, this Article (1) catalogues and analyzes the nonsectoral data privacy, security, and breach notification statutes of all fifty states and the District of Columbia; (2) applies these statutes to mobile-app-mediated health research conducted by independent scientists, citizen scientists, and patient researchers; and (3) proposes substantive amendments to state law that could help protect the privacy and security of all health data subjects, …

Florida Law, Mobile Research Applications, And The Right To Privacy, Stacey A. Tovino

Faculty Articles

This Article investigates whether state law contains comprehensive privacy, security, and breach notification standards that could apply to independent scientists who conduct mobile app mediated health research. Focusing only on Florida law, this Article assesses potentially relevant and applicable sources of privacy, security, and breach notification standards for health data of the type obtained during mobile app mediated health research studies. This Article concludes that, with one exception, Florida law tends to fall into one of two categories: (1) the law contains at least one data privacy, security, or breach notification standard, but the standard is limited in application to …

A Timely Right To Privacy, Stacey A. Tovino

Faculty Articles

On December 28, 2017, the federal Department of Health and Human Services ("HHS") settled its fiftieth case involving potential violations of the privacy, security, and breach notification rules ("Rules") that implement the Health Insurance Portability and Accountability Act ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH"). This Article catalogues and examines currently available enforcement actions involving the HIPAA and HITECH Rules, including the cases in which HHS has entered into a settlement agreement with a HIPAA covered entity or business associate, the cases in which HHS has imposed a civil money penalty on a HPAA …

Carpenter V. United States And The Fourth Amendment: The Best Way Forward, Stephen E. Henderson

Faculty Articles

We finally have a federal ‘test case.’ In Carpenter v. United States, the Supreme Court is poised to set the direction of the Fourth Amendment in the digital age. The case squarely presents how the twentieth-century third party doctrine will fare in contemporary times, and the stakes could not be higher. This Article reviews the Carpenter case and how it fits within the greater discussion of the Fourth Amendment third party doctrine and location surveillance, and I express a hope that the Court will be both a bit ambitious and a good measure cautious. As for ambition, the Court …

Fourth Amendment Anxiety, Kiel Brennan-Marquez, Stephen E. Henderson

Faculty Articles

In Birchfield v. North Dakota (2016), the Supreme Court broke new Fourth Amendment ground by establishing that law enforcement’s collection of information can be cause for “anxiety,” meriting constitutional protection, even if subsequent uses of the information are tightly restricted. This change is significant. While the Court has long recognized the reality that police cannot always be trusted to follow constitutional rules, Birchfield changes how that concern is implemented in Fourth Amendment law, and importantly, in a manner that acknowledges the new realities of data-driven policing. Beyond offering a careful reading of Birchfield, this Article has two goals. First, …

Get Off My Porch: United States V. Carloss And The Escalating Dangers Of “Knock And Talks”, Skyler K. Sikes

Oklahoma Law Review

No abstract provided.

United States V. Carloss: Should The Police Act Like Good Neighbors?, Cole Mclanahan

Oklahoma Law Review

No abstract provided.

Ferpa Close-Up: When Video Captures Violence And Injury, Kitty L. Cone, Richard J. Peltz-Steele

Oklahoma Law Review

No abstract provided.