Speaker Pelosi Expresses Concerns With Federal Privacy Bill’s Preemption Provision

On Thursday, House Speaker Nancy Pelosi expressed concerns with certain features of the American Data Privacy and Protection Act (“ADPPA”) and its broad preemption provision, which as currently drafted would override the California Consumer Privacy Act (“CCPA”) and its subsequent voter- approved amendments.  The ADPPA was favorably reported by the House Committee on Energy and Commerce in July by a vote of 53-2.  The bill has not yet been scheduled for a vote on the House floor. Speaker Pelosi “commended” the Energy and Commerce Committee for its efforts, while also praising California Democrats for having “won the right for consumers for the first time to be able to seek damages in court for violations of their privacy rights.”  Speaker Pelosi noted that California leads the nation in protecting consumer privacy and it was “imperative that California continues offering and enforcing the nation’s strongest privacy rights.”

Speaker Pelosi stated that she and others would be working with Chairman Frank Pallone (D-NJ) to address concerns related to preserving  California privacy laws.  Although Speaker Pelosi’s comments cast doubt on the future of the ADPPA, we continue to believe that it will clear the House. We anticipate only modest tweaks to the preemption provision, which must be acceptable to the Republican leadership of the committee for the bill to move forward. As Speaker Pelosi noted, the bill contains a private right of action for consumers—the single most important provision to Republicans in return for strong preemption language. After more than a decade of effort, the Democratic leadership of the House will be hard pressed to let the perfect be the enemy of the really good.

© Copyright 2022 Squire Patton Boggs (US) LLP

Acronis Reports Ransomware Damages Will Exceed $30B by 2023

In its Mid-Year Cyberthreat Report published on August 24, 2022, cybersecurity firm Acronis reports that ransomware continues to plague businesses and governmental agencies, primarily through phishing campaigns.

According to the report over 600 malicious email campaigns were launched in the first half of 2022, with the goal of stealing credentials to launch ransomware attacks. Other attack vectors included vulnerabilities to cloud-based networks, targeting unpatched or software vulnerabilities, and cryptocurrency and decentralized finance systems.

According to Acronis, “ransomware is worsening, even more so than we predicted.” It estimates that global damages related to ransomware attacks will top $30 billion by 2023.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.

Top Legal Industry News Highlights for August 2022: Law Firm Expansion, Legal Awards and Recognition, and the Latest in Women in Law

Thank you for reading the latest edition of the National Law Review’s bi-weekly legal news roundup! In these last weeks of summer, we hope you are remaining safe and healthy. Read more below for updates on law firm hiring and expansion, industry awards and recognition, and spotlights on women in the field of law.

Law Firm Hiring and Expansion

Moore & Van Allen PLLC has added Julianne Farnsworth as counsel and as a member of the firm’s Litigation practice group. Presently based in the Charleston office, Ms. Farnsworth dedicates her practice to complex civil litigation, representing clients in areas such as business torts, environmental law, employment law, and other areas. She has practiced before state and federal courts across the U.S. and is additionally certified as a mediator in the state circuit and federal courts of South Carolina.

“We are pleased to welcome Julianne who has been a top litigator in the Charleston area for over 30 years,” said Trudy H. Robertson, co-managing member of the firm’s Charleston office. “Julianne’s experience and reputation will be valuable assets for servicing our litigation clients across the full spectrum of business areas and industries.”

Trey Baker, a former senior advisor for public engagement at the White House, has joined Barnes & Thornburg LLP as a partner in the Government Services and Finance Department. In his former role, Mr. Baker specialized in outreach to civil rights organizations and minority communities, focusing on criminal justice and law enforcement reform. He has also served for four years as the city manager for Grenada, Mississippi.

“Trey’s deep well of government experience and strong foundation in the D.C. market will prove invaluable to our clients – both locally and nationally,” said Roscoe Howard, managing partner of the firm’s Washington, D.C. office. “His passion for community engagement, evidenced by the breadth of his work at the local and federal level, brings a unique skill set to our talented group of legal professionals. We’re happy to have him.”

Honigman Law, LLP has advanced its recent growth efforts, announcing the launch of Honigman Law Israel, an Israeli subsidiary focusing its efforts on U.S. mergers and acquisitions, capital markets, venture capital, real estate, and more. For prospective candidates, the subsidiary offers the opportunity to continue practicing complex U.S. legal matters while located in Israel. The HLI team has already added its first five attorneys: Sam Katz, who practices in corporate and capital markets; Inbar Rauchwerger, who practices in mergers and acquisitions; Aviv Avnon, who practices in finance; David Snyder, who practices in tax law; and Rachel Rhodes, who practices in corporate and capital markets.

“We’re honored to bring on these five top-notch attorneys from some of the most prominent law firms in the U.S. and expect to bring in many more highly qualified individuals through this initiative,” said Honigman CEO and Chair David Foltyn. “We have continued to see incredible demand for our transactional counsel, which in turn requires that we continue to grow with the most talented lawyers. With HLI, we have created a win-win opportunity for A+ attorneys who want to reside in Israel for personal reasons but did not have a path to doing so, and for Honigman, which can deepen and expand the great talent we can devote to our clients.”

Much Shelist, P.C. has added three new attorneys: Jonathan FriedlandJeremy Waitzman, and Hajar Jouglaf. Mr. Friedland joins the firm’s Restructuring & Creditors’ Rights group, and Mr. Waitzman and Mr. Jouglaf join the firm’s Corporate & Finance group. The trio has formerly worked together to represent businesses across the U.S., focusing their efforts on mergers and acquisitions, insolvency, and bankruptcy matters. Together, they counsel clients across many industries, including manufacturing, information technology, retail, and hospitality.

“Jonathan, Jeremy, and Hajar impressed us from the very beginning of our conversations,” said the firm’s Managing Partner Mitchell Roth. “They bring legal prowess and business savvy that will be immensely valuable to our clients, and they share our commitment to top-tier service.”

Steptoe & Johnson PLLC has added Jeffery D. Mulrooney as Of Counsel to the firm’s Business Department. Mr. Mulrooney has a great deal of experience managing intellectual property matters, with particular emphasis on patent, trademark, and copyright applications across all industries, including medical devices, material sciences, consumer products, and more. At the firm, he will focus his practice specifically on intellectual property and transactional matters.

“Jeffrey’s focus on copyright, trademark, and patent law is a great addition to our Pittsburgh office,” said Steptoe & Johnson CEO, Christopher L. Slaughter. “We are always looking for the best attorneys to meet our client’s needs and with the explosive growth in technology industries across our footprint, Jeffrey’s background will be a great asset to our clients and our firm.”

Industry Awards and Recognition

Two Romer Debbas partners, Michael R. Feldman and Alison L. Weisman, have been honored by Best Lawyers. The award is based on peer reviews and feedback and acknowledges attorneys at the beginning of their law careers for “upstanding professional standards and excellence in private practice.” Mr. Feldman and Ms. Weisman were specifically recognized as rising industry stars in the field of real estate law.

Michael Feldman is a partner and manager of the residential real estate department at Romer Debbas’ New York office. His practice focuses on residential and commercial real estate transactions. Alison Weisman is a partner in Romer Debbas’ commercial real estate department. She concentrates her practice on representing buyers, sellers, tenants, landlords, and developers in various real estate and lending transactions. She is also a trained mediator.

Greenberg Traurig was nominated by JUVE Verlag, a business law publisher based in Germany, as the Law Firm of the Year in the Labor and Employment category. The firm was nominated for its “positive, dynamic development over the past year.” The award ceremony will take place on Oct. 27 in Frankfurt where the winners will be announced.

197 attorneys at Ballard Spahr received 330 recognitions in this year’s The Best Lawyers in America guide. Of additional note, 58 Ballard Spahr attorneys have been featured in the Ones to Watch category, which is intended for lawyers at the beginning of their careers. Ballard Spahr attorneys also received 7 recognitions for Lawyers of The Year:

Best Lawyers uses annual surveys to assess lawyers in the field, asking attorneys to evaluate their peers based on professionalism, integrity, and legal skill. Lawyers of the Year receive the highest overall peer feedback for a given practice area and region.

Women in Law

Clifford Law Office partner Sarah F. King is scheduled to present “The Power of Visual Persuasion” at the Society of Women Trial Lawyers’ 2022 Fall Conference in Nashville, TN. A medical malpractice attorney based in Chicago, Ms. King will be sharing her insights on technological innovations and visual storytelling in virtual and physical courtrooms. She has previously presented at events such as the Michigan Association of Justice Medical Malpractice Seminar and the American Association for Justice Annual Convention, and is an active member of the Women’s Bar Association of Illinois and Illinois Trial Lawyers Association.

The Society of Women Trial Lawyers conference provides an opportunity for women practitioners across the U.S. to enhance their trial skillset while building valuable professional and personal connections. This year’s event will be at the Thompson Nashville Hotel on Thursday, October 6, 2022.

The Texas Diversity Council will recognize Foley & Lardner partner Michelle Ku as a 2022 Top Women Lawyers Award winner at a virtual ceremony on September 27, 2022. Ms. Ku is a business litigator known for taking on high stakes trials at the local, state, and federal levels, covering issues related to antitrust, government investigations, class actions, tax, and intellectual property. She and her fellow awardees were selected for their professional success, legal industry impact, integrity, and commitment to supporting other women in the field.

Alyson Brown of Hunton Andrews Kurth has been selected for the National Black Lawyers Top 40 Under 40 for the second year in a row. Inclusion on the list provides access to a national network of leading figures in the Black legal community and requires a reputation for professional excellence and leadership as determined through peer nominations and a third-party research process.

Ms. Brown is a Richmond, VA based employment attorney. At Hunton Andrews Kurth, she handles issues related to unfair workplace practices, labor law compliance, and employment litigation. In addition to her experience arguing before the National Labor Relations Board, Brown is a Program Committee Member of the Richmond Bar Association and Board Member of the Downtown Richmond YMCA. She has recently been listed on the 2022 Virginia Access to Justice Pro Bono Honor Roll.

Copyright ©2022 National Law Forum, LLC

Children’s Advertising Rules Apply in the Metaverse Too, CARU Says

CARU, the Children’s Advertising Review Unit of BBB National programs, issued a compliance warning last week reminding industry that the self-regulating body on children’s advertising and privacy intends to enforce its advertising guidelines in the metaverse, just like in the real world.

CARU’s August 23 compliance warning puts companies on notice of what perhaps should have been obvious: its guidelines for advertising to children apply in the metaverse, too. The warning heavily analogizes the metaverse, augmented reality (AR) and virtual reality (VR) worlds to other digital spaces like smartphone apps and online videos. CARU emphasizes the need to:

  • avoid blurring the lines between advertising and non-advertising content;
  • clearly disclose the use of brand-sponsored avatar influencers;
  • avoid manipulative tactics that induce children to view or interact with ads or to make in-game purchases; and
  • use clear, understandable, easily noticeable and prominent disclosures, repeated if necessary to ensure children notice and understand them.

The metaverse is a new area of focus for CARU and BBB National Programs: two recent posts, Know the Rules: How to Be Age Appropriate in the Metaverse and Advertising And Privacy: The Rules Of The Road For The Metaverse, emphasize the need to make sure advertising is truthful, non-deceptive and clearly identifiable as advertising, especially in brand-sponsored worlds. CARU recommends that advertisers and operators anticipate and stay aware of how their child audiences interact with the metaverse experience, including how, when and where ads will be shown to them and how influencers will engage in the space.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

5 Ways Legal Billing Software Increases Law Firm Revenue

In any business, keeping an eye on the bottom line is essential. For law firms, this can be a challenge, as there are many ways that money can be lost throughout a case. From inefficient time-tracking to inaccurate billing, there are many potential pitfalls. However, there is one solution that can help to increase law firm revenue: legal billing software. Choosing the right legal billing software is essential for maximizing its benefits. Consider time-tracking, billing accuracy, and customer service when evaluating different packages. Take a look at solutions built specifically for the legal industry to get the most out of your investment.

3 Common Ways Law Firms Lose Money

Time Tracking Issues

Many lawyers still rely on manual methods of tracking time by using spreadsheets or notepads. This antiquated approach to timekeeping is fraught with problems, including the potential for lost billable time and revenue, vulnerability to billing disputes, and high administrative costs.

With spreadsheet or notepad timekeeping, it is easy for lawyers to forget to record their time or lose track of their records, leading to lost billable hours and ultimately lost revenue for the firm. Manual timekeeping doubles the work since someone must manually enter all data into the system.

Manually keeping track of time leaves attorneys vulnerable to billing disputes. If a client questions a lawyer’s billing records, it can be difficult for the attorney to prove that the charges are accurate without detailed and meticulous records.

Invoicing Frequency

When it comes to law firm revenue, timely billing is everything. The longer you wait to send a bill, the longer you wait to get paid. Clients can’t pay a bill they haven’t received.

Not billing promptly sends the message to your client that prompt payment is not that important to you. Sending your invoices at the end of each month helps to avoid confusion or miscommunication and ensures that you and your clients are on the same page.

Billing Bottlenecks

Getting paid by clients is a significant problem for 61% of small law firms, according to 2019 research conducted by Thomson Reuters Legal Executive Institute. Law firms that don’t provide clients with various payment options, like online payments and accepting credit card payments, are more vulnerable to decreased law firm revenue due to not getting paid on time.

What is Legal Billing Software?

Legal billing software is downloadable or cloud-based that helps lawyers accurately track their time and invoice their clients. A robust software, like Bill4Time, will have the capability to track time, LEDES billing format, create custom invoices, accept online payments, and meet state bar regulations for billing. Law firms use dedicated legal billing software to improve their bottom line by improving invoicing processes and reducing inaccurate time management and billing bottlenecks.

What Billing Software do Law Firms Use?

Lawyers are always looking for ways to be more efficient and maximize their billable hours, so they prioritize cloud-based software solutions that have integrated time tracking, easy invoice options, and a client portal for online payments.

Law firms need industry-specific features like trust & IOLTA accounting which allows lawyers to reconcile trust accounts without a secondary application. They also look for software that provides LEDES billing, the most widely used e-billing standard for law firms invoicing corporate clients.

Why Does My Law Firm Need Legal Billing Software?

As a law firm, you know that time is money. Every minute spent on administrative tasks is a minute that could be spent on billable hours.

Automate the billing process

You, and your team, enter matter information as time-tracked once, and the software will take care of the rest, generating invoices and sending them out to clients on your behalf.

Manage your cash flow

You will always have a clear record of what has been billed and remains outstanding. You can responsibly allocate your resources to maximize your profits.

Track payments and expenses

Having this information organized and readily available can save you a great deal of time and hassle when it comes time to file taxes or apply for loans or lines of credit.

Billing automation will save you and your team considerable time each month, which can be spent growing your business.

How to Identify the Best Legal Billing Software

When choosing legal billing software, there are a few key factors to keep in mind.

Choosing a program compatible with your firm’s existing tech stack, including your law practice management software, is critical to success. Consider the cost, ease of use, and customer support options. Mobile access is also crucial for lawyers who can access their files on any device — iPhone, iPad, or Android.

And finally, security is always a top priority when it comes to sensitive legal information. Look for software that has industry-standard security protocols in place to protect your data.

By keeping these factors in mind, you’ll choose the best legal billing software for your needs.

Best Practices for Implementing a Legal Billing Software

There are many different types of legal billing software on the market, and it can be challenging to decide which one is right for your law firm.

When choosing new software for your law firm, there are a few important factors to remember:

  • You must ensure that the software is compatible with your existing legal practice management software.

  • Be sure to clearly understand your law firm’s billing policies before setting up the software to ensure everything is billed correctly.

  • The software should be easy to use, but you still need to take time to train your staff on how to use the new software.

  • You want a responsive and helpful company when you run into problems. If you run into issues, you can contact the support team.

A little upfront investment will pay off in the long run by preventing billing mistakes and increasing efficiency. Following these simple tips, you can set your law firm up for success with legal billing software.

Increase Law Firm Revenue with Legal Billing Software

Ultimately, you can improve your firm’s bottom line and the client experience by investing in legal billing software. Here are five ways a legal billing software can help you achieve success:

1 ) Accurate Time Tracking

Time entry and expense tracking are crucial for any organization looking to boost productivity and improve profitability. Yet many organizations struggle with manually tracking time and expenses, leading to inaccuracies and lost data. The software makes tracking time and expenses by the user, client, or project easy.

Move beyond the notepad, and start tracking your time with a cloud-based software solution.

Whether on the go or at the office, easy time entry makes it simple to run timers simultaneously, record multiple time entries on one screen, and automatically convert appointments into time entries. You’ll always know your organization’s productivity and financial status with daily and weekly time summaries.

2 ) Automated Billing

Automated billing and online payments can make it easier for clients to pay their invoices, resulting in quicker payment turnaround times. Clients tend to delay payment if they don’t understand the invoice. Prevent this from happening by providing detailed and informative invoices.

With legal billing software, you can set up invoice templates with custom settings such as your billing policy and payment links to pay online —  you can even perform batch invoice creation to save administrative time.

You can even extend your brand while increasing workflow efficiencies by personalizing and creating branded invoices with your logo.

3 ) Online Payments

Online payments are becoming increasingly popular, and customers expect businesses to offer this option. You may even miss out on potential customers if you don’t offer online payments.

Online payments allow firms to quickly and easily receive payments from clients. This can be done via credit card, debit card, or even PayPal. In addition, online payments are more secure than traditional methods, such as mailing a check.

4 ) Custom Reporting

Real-time data is essential for any growing business and managing cash flow. You’ll want a solution with comprehensive reporting to manage your firm’s financial performance better and identify trends to ensure success—review payment history, balance due, collections, expenses, productivity, and summary reports.

Legal billing software should be able to run user activity reports, so you can get detailed insights into how your team works, including efficiency, expense, schedule, and internal tracked time.  This data can help you identify areas of improvement so your team can work smarter, not harder.

5 ) Enhanced Client Experience

Client portals are a great way to provide your clients with more information and control over their billing. Empower your clients to log in, view their account balances, make payments, and see a detailed fee history.

Grow Your Law Firm Revenue with Legal Billing Software

The legal industry is one of the most competitive and rapidly-changing fields. To succeed, law firms must be cutting edge in all aspects of their business – including billing. With so much at stake, it’s no wonder that more and more law firms are turning to legal billing software to help them stay ahead of the competition.

This article was authored by Dan Bowman of Bill4Time.

For more business of law legal news, click here to visit the National Law Review.

©2006-2022, BILL4TIME. ALL RIGHTS RESERVED.

How to Market Your Firm When You Don’t Need an In-House Hire

Law firms of any size need some level of marketing for long-term growth and sustainability. To be successful, every law firm must focus on its marketing. In an ideal world, lawyers would have the time to do what they do best and also market their business so it can grow. However, lawyers are inherently busy individuals, and it often doesn’t make sense to try to do it all themselves. Trying to do it all alone is overwhelming, and your time is best spent helping clients.

The simple answer to this time crunch dilemma is to hire someone in-house to take over the marketing efforts. But for many firms, that has a laundry list of drawbacks, such as additional time and expense. Perhaps you don’t have the marketing needs or budget to hire someone to market your law firm on a full- or even part-time basis. Hiring someone in-house means you need to have enough work and room in your budget to keep them busy. So, what are your other options?

Do it Yourself

Continuing to market your law firm yourself is one option. But let’s be realistic; you cannot do it all. With your busy schedule, you might only have one to three hours per week to dedicate to your marketing efforts. If this is the case, pick one or two marketing elements to be consistent with. For example, focus on your blogs or social media posts. If you need more help, as this tiny sliver of weekly time is not likely to move the needle or be sustainable, it’s time to outsource.

Hire an Agency or Freelancer

One viable option could be hiring an agency or freelancer to take over all or most of your marketing tasks. Outsourcing can help take some of this pressure off. Leaving your marketing in the hands of an experienced and knowledgeable agency or freelancer gives you peace of mind that it’s being done optimally. It also lets you focus on your clients and practicing law—which is what you went to school for, after all.

Identify Your Marketing Goals

If you decide to go this route, determine what your primary marketing goals are and go from there:

  • Do you want more leads?

  • Do you want to see more conversions?

  • Do you need to get more referrals?

  • Do you need a better ROI for your marketing dollars?

By listing your marketing goals and dreams and what you’re already doing, you can visualize your marketing gap and identify when it’s time to work with a professional. The more significant this gap, the more likely you need to hire a professional as soon as possible. In the meantime, you could be missing out on signing new clients.

Get an Outside Opinion

When you work with a freelancer or marketing agency, you will have a professional on your side who can also audit your marketing plan and tell you what your marketing is missing. Having another person, especially a marketing expert, lay eyes on what you’ve done to market your law firm and your future plans can help you identify your weaknesses and course correct to the right path. Marketing professionals can take what you have already started and turn it into something bigger and more successful.

Benefits of Working with a Marketing Agency or Freelancer

Working with a marketing agency or freelancer can provide your law firm with the following benefits:

  • Increased brand awareness

  • Greater ability to be found on the internet

  • More website traffic

  • Building trust and credibility with your audience

  • Improved online presence and engagement

  • Conversion rate optimization

  • Cost efficiency

  • Tracking and interpreting marketing efforts

  • Strategy and creativity – for example, creating targeted campaigns for niche clients

Last but not least, they allow you to focus on obtaining optimal outcomes for your clients instead of trying to market your law firm.

© 2022 Denver Legal Marketing LLC

A Rule 37 Refresher – As Applied to a Ransomware Attack

Federal Rule of Civil Procedure 37(e) (“Rule 37”) was completely rewritten in the 2015 amendments.  Before the 2015 amendments, the standard was that a party could not generally be sanctioned for data loss as a result of the routine, good faith operation of its system. That rule didn’t really capture the reality of all of the potential scenarios related to data issues nor did it provide the requisite guidance to attorneys and parties.

The new rule added a dimension of reasonableness to preservation and a roadmap for analysis.  The first guidepost is whether the information should have been preserved. This rule is based upon the common law duty to preserve when litigation is likely. The next guidepost is whether the data loss resulted from a failure to take reasonable steps to preserve. The final guidepost is whether or not the lost data can be restored or replaced through additional discovery.  If there is data that should have been preserved, that was lost because of failure to preserve, and that can’t be replicated, then the court has two additional decisions to make: (1) was there prejudice to another party from the loss OR (2) was there an intent to deprive another party of the information.  If the former, the court may only impose measures “no greater than necessary” to cure the prejudice.  If the latter, the court may take a variety of extreme measures, including dismissal of the action. An important distinction was created in the rule between negligence and intention.

So how does a ransomware attack fit into the new analytical framework? A Special Master in MasterObjects, Inc. v. Amazon.com (U.S. Dist. Court, Northern District of California, March 13, 2022) analyzed Rule 37 in the context of a ransomware attack. MasterObjects was the victim of a well-documented ransomware attack, which precluded the companies access to data prior to 2016. The Special Master considered the declaration from MasterObjects which explained that, despite using state of the art cybersecurity protections, the firm was attacked by hackers in December 2020.  The hack rendered all the files/mailboxes inaccessible without a recovery key set by the attackers.  The hackers demanded a ransom and the company contacted the FBI.  Both the FBI and insurer advised them not to pay the ransom. Despite spending hundreds of hours attempting to restore the data, everything prior to 2016 was inaccessible.

Applying Rule 37, the Special Master stated that, at the outset, there is no evidence that any electronically stored information was “lost.”  The data still exists and, while access has been blocked, it can be accessed in the future if a key is provided or a technological work-around is discovered.

Even if a denial of access is construed to be a “loss,” the Special Master found no evidence in this record that the loss occurred because MasterObjects failed to take reasonable steps to preserve it. This step of the analysis, “failure to take reasonable steps to preserve,” is a “critical, basic element” to prove spoliation.

On the issue of prejudice, Amazon argued that “we can’t know what we don’t know” (related to missing documents).  The Special Master did not find Amazon’s argument persuasive. The Special Master concluded that Amazon’s argument cannot survive the adoption of Rule 37(e). “The rule requires affirmative proof of prejudice in the specific destruction at issue.”

Takeaways:

  1. If you are in a spoliation dispute, make sure you have the experts and evidence to prove or defend your case.

  2. When you are trying to prove spoliation, know the new test and apply it in your analysis (the Special Master noted that Amazon did not reference Rule 37 in its briefing).

  3. As a business owner, when it comes to cybersecurity, you must take reasonable and defensible efforts to protect your data.

©2022 Strassburger McKenna Gutnick & Gefsky

Wegmans Settles With NYAG for $400,000 Over Data Incident

The New York Attorney General recently announced a data security-related settlement with Wegmans Food Markets. The issue arose in April 2021 regarding a cloud-based incident. At that time a security researcher notified Wegmans that the company had an Azure cloud storage container that was unsecured. Upon investigation, the company determined that the container had been misconfigured and that three million customer records had been publicly accessible since 2018. The records included email addresses and account passwords.

Of concern for the AG, among other things, were that the passwords were salted and hashed using SHA-1 hashing, rather than PBKDF2. Similarly, the AG found concerning the fact that the company did not have an asset inventory of what it maintained in the cloud. As a result, no security assessments were conducted of its cloud-based databases. The NYAG also took issue with the company’s lack of long-term logging: logs for its Azure assets were kept for only 30 days. Finally, the company kept checksums derived from customer driver’s license information, something for which the NYAG did not feel the company had a “reasonable business purpose” to collect or maintain.

The NYAG argued that these practices were both deceptive and unlawful in light of the promises Wegman’s made in its privacy policy. It also felt that the practices were a violation of the state’s data security law. As part of the settlement, Wegmans agreed to pay $400,000. It also agreed to implement a written information security program that addresses, among other things:

  1. asset management that covers cloud assets and identifies several items about the asset, including its owner, version, location, and criticality;
  1. access controls for all cloud assets;
  1. penetration testing that takes into account cloud assets, and includes at least one annual test of the cloud environment;
  1. central logging and monitoring for cloud assets, including keeping cloud logs readily accessible for 90 days (and further stored for a year from logged activity);
  1. customer password management that includes hashing algorithms and a salting policy that is at least commensurate with NIST standards and “reasonably anticipated security risks;” and
  1. policies and procedures around data collection and deletion.

Wegmans agreed to have the program assessed within a year of the settlement, with a written report by the third-party assessor provided to the NYAG. It will also conduct at-least-annual reviews of the program. As part of that review it will determine if any changes are needed to better protect and secure personal data.

Putting It Into Practice: This case is a reminder for companies to think not only about assets on its network, but its cloud assets, when designing a security program. Part of these efforts include clearly identifying locations that house personal information (as defined under security and breach laws) and evaluating the security practices and controls in place to protect that information. The security program elements the NYAG has asked for in this settlement signal its expectations of what constitutes a reasonable information security program.

Copyright © 2022, Sheppard Mullin Richter & Hampton LLP.

How to Write Better Client Alerts and Blog Posts

One of the most effective marketing strategies for lawyers is writing client alerts and blog posts on a regular basis. Publishing content like this establishes you as a thought leader and helps to keep you top of mind with your clients, referrals, prospects and the media and bolsters your SEO results too.

So, what makes a good client alert or blog post? It’s not about writing the longest alert or publishing it before your competitors or including every detail about the court decision.

I see many law firms publish client alerts with good intentions – the whole idea is to get helpful information to your clients and prospects as quickly as possible with interesting insights.

A lot of law firms sometimes miss the mark because their client alerts are either just regurgitating facts, don’t have a lot of insight in them, are too long, are written in legalese and they’re not client-centric meaning they don’t put the client first and aren’t written for them and their needs, which completely defeats the point.

I also see alerts that are too cute or clever – with headlines based on movies, TV shows or music lyrics . What you really want to do is deliver a clear promise in the headline and provide value while engaging your reader.

A strong headline is often the determining factor on whether someone actually opens the content or not. You also must actually deliver on what you say you’re going to provide in the alert.

So if the alert says it is going to be on X topic and the first few sentences lead you to believe that, but then it goes down another path, that’s clickbait and frustrates the reader.

Almost as important as what you write is how you structure the alert. Dense, long paragraphs are not going to capture your reader’s attention today. Try using shorter paragraphs with subheadings. Make it easy for someone to follow along and find points of engagement. Bulleted or numbered lists also work well to engage your reader.

In addition, make sure your alert has a vantage point. Just regurgitating information that somebody can find on a public website about a major decision or case or update in the law is not very poignant, memorable, relevant or helpful.

What is helpful and useful is explaining what the decision or update means for your client’s business.  And of course, the hidden underlying message is “we can help you with this, we care about you and our insights can help solve your thorniest legal and business needs.” Just make sure that your content supports that too.

Writing client alerts and blog posts is one of the best ways to get back in touch with your clients, referrals and prospects in a way that showcases your subject-matter authority. Plus you’re not even thinking about all of the silent viewers and readers of your content and how that can actually lead to new business, greater visibility and brand recognition.

If writing a client alert or blog post seems too overwhelming to do alone, buddy up with a colleague or even better – a client. The summer is a great time to focus on drafting and publishing a piece of content like this, so what are you waiting for?

Watch this video for more tips on writing a better client alert or blog post.

Copyright © 2022, Stefanie M. Marrone. All Rights Reserved.

Privacy Tip #335 – Health Care Sector Continues to Be Hit with Ransomware

According to the 2022 State of Ransomware Report issued recently by Sophos, it surveyed 5,600 IT professionals from 31 countries, including professionals in the health care sector. Those professionals in the health care sector shared that 66 percent of them had experienced a ransomware attack in 2021, which was an increase of 69 percent over 2020. This was the largest increase of all sectors surveyed.

If you look at the Office for Civil Rights data breach portal, you will see that a vast majority of breaches reported by health care providers and business associates are related to “Hacking/IT incident.” This confirms that the health care sector continues to be attacked by threat actors seeking to steal protected health information of patients.

If you are a patient who receives a breach notification letter from a health care provider or business associate, the letter will provide guidance on how to protect yourself following a data breach and may offer some protection guidance, including credit monitoring or fraud resolution. Such a letter has been sent to patients to comply with the breach notification requirements of HIPAA and state law. Part of those requirements includes that the patients be provided mitigation steps following the breach to protect themselves from fraud. Avail yourself of these protections in the event your information is compromised. Take the time to sign up for the mitigation offered. It is clear that these attacks will not subside any time soon.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.