Category: Technology

Clop Claims Zero-Day Attacks Against 130 Organizations

Russia-linked ransomware gang Clop has claimed that it has attacked over 130 organizations since late January, using a zero-day vulnerability in the GoAnywhere MFT secure file transfer tool, and was successful in stealing data from those organizations. The vulnerability is CVE-2023-0669, which allows attackers to execute remote code execution.

The manufacturer of GoAnywhere MFT notified customers of the vulnerability on February 1, 2023, and issued a patch for the vulnerability on February 7, 2023.

HC3 issued an alert on February 22, 2023, warning the health care sector about Clop targeting healthcare organizations and recommended:

  • Educate and train staff to reduce the risk of social engineering attacks via email and network access.
  • Assess enterprise risk against all potential vulnerabilities and prioritize implementing the security plan with the necessary budget, staff, and tools.
  • Develop a cybersecurity roadmap that everyone in the healthcare organization understands.

Security professionals are recommending that information technology professionals update machines to the latest GoAnywhere version and “stop exposing port 8000 (the internet location of the GoAnywhere MFT admin panel).”

Article By Linn F. Freedman of Robinson & Cole LLP

For more cybersecurity legal news, click here to visit the National Law Review.

Copyright © 2023 Robinson & Cole LLP. All rights reserved.

To AI or Not to AI: U.S. Copyright Office Clarifies Options

The U.S. Copyright Office has weighed in with formal guidance on the copyrightability of works whose generation included the use of artificial intelligence (AI) tools. The good news for technology-oriented human creative types: using AI doesn’t automatically disqualify your work from copyright protection. The bad news for independent-minded AI’s: you still don’t qualify for copyright protection in the United States.

On March 16, 2023, the Copyright Office issued a statement of policy (“Policy”) to clarify its practices for examining and registering works that contain material generated by the use of AI and how copyright law’s human authorship requirements will be applied when AI was used. This Policy is not itself legally binding or a guarantee of a particular outcome, but many copyright applicants may breathe a sigh of relief that the Copyright Office has formally embraced AI-assisted human creativity.

The Policy is just the latest step in an ongoing debate over the copyrightability of machine-assisted products of human creativity. Nearly 150 years ago, the Supreme Court ruled at photographs are copyrightable. See Burrow-Giles Lithographic Company v. Sarony, 111 U.S. 53 (1884). The case involved a photographer’s claim against a lithographer for 85,000 unauthorized copies of a photograph of Oscar Wilde. The photo, Sarony’s “Oscar Wilde No. 18,” is shown below:

Sarony’s “Oscar Wilde No. 18"

The argument against copyright protection was that a photograph is “a reproduction, on paper, of the exact features of some natural object or of some person” and is therefore not a product of human creativity. Id. at 56. The Supreme Court disagreed, ruling that there was sufficient human creativity involved in making the photo, including posing the subject, evoking the desired expression, arranging the clothing and setting, and managing the lighting.

In the mid-1960’s, the Copyright Office rejected a musical composition, Push Button Bertha, that was created by a computer, reasoning that it lacked the “traditional elements of authorship” as they were not created by a human.

In 2018, the U.S. Court of Appeals for the Ninth Circuit ruled that Naruto, a crested macaque (represented by a group of friendly humans), lacked standing under the Copyright Act to hold a copyright in the “monkey selfie” case. See Naruto v. Slater, 888 F.3d 418 (9th Cir. 2018). The “monkey selfie” is below:

Monkey Selfie

In February 2022, the Copyright Office rejected a registration (filed by interested humans) for a visual image titled “A Recent Entrance to Paradise,” generated by DABUS, the AI whose claimed fractal-based inventions are the subject of patent applications around the world. DABUS’ image is below:

“A Recent Entrance to Paradise”

Litigation over this rejected application remains pending.

And last month, the Copyright Office ruled that a graphic novel consisting of human-authored text and images generated using the AI tool Midjourney could, as a whole, be copyrighted, but that the images, standing alone, could not. See U.S. Copyright Office, Cancellation Decision re: Zarya of the Dawn (VAu001480196) at 2 (Feb. 21, 2023).

The Copyright Office’s issuing the Policy was necessitated by the rapid and remarkable improvements in generative AI tools over even the past several months. In December 2022, generative AI tool Dall-E generated the following images in response to nothing more than the prompt, “portrait of a musician with a hat in the style of Rembrandt”:

Four portraits generated by AI tool Dall-E from the prompt, "portrait of a musician with a hat in the style of Rembrandt."

If these were human-generated paintings, or even photographs, there is no doubt that they would be copyrightable. But given that all four images were generated in mere seconds, with a single, general prompt from a human user, do they meet the Copyright Office’s criteria for copyrightability? The answer, now, is a clear “no” under the Policy.

However, the Policy opens the door to registering AI-assisted human creativity. The toggle points will be:

“…whether the ‘work’ is basically one of human authorship, with the computer [or other device] merely being an assisting instrument, or whether the traditional elements of authorship in the work (literary, artistic, or musical expression or elements of selection, arrangement, etc.) were actually conceived and executed not by man but by a machine.” 

In the case of works containing AI-generated material, the Office will consider whether the AI contributions are the result of “mechanical reproduction” or instead of an author’s “own original mental conception, to which [the author] gave visible form.” 

The answer will depend on the circumstances, particularly how the AI tool operates and how it was used to create the final work. This will necessarily be a case-by-case inquiry.” 

See Policy (citations omitted).

Machine-produced authorship alone will continue not to be registerable in the United States, but human selection and arrangement of AI-produced content could lead to a different result according to the Policy. The Policy provides select examples to help guide registrants, who are encouraged to study them carefully. The Policy, combined with near future determinations by the Copyright Office, will be critical to watch in terms of increasing likelihood a registration application will be granted as the Copyright Office continues to assess the impacts of new technology on the creative process. AI tools should not all be viewed as the “same” or fungible. The type of AI and how it is used will be specifically considered by the Copyright Office.

In the short term, the Policy provides some practical guidance to applicants on how to describe the role of AI in a new copyright application, as well as how to amend a prior application in that regard if needed. While some may view the Policy as “new” ground for the Copyright Office, it is consistent with the Copyright Office’s long-standing efforts to protect the fruits of human creativity even if the backdrop (AI technologies) may be “new.”

As a closing note, it bears observing that copyright law in the United Kingdom does permit limited copyright protection for computer-generated works – and has done so since 1988. Even under the U.K. law, substantial questions remain; the author of a computer-generated work is considered to be “the person by whom the arrangements necessary for the creation of the work are undertaken.” See Copyright, Designs and Patents Act (1988) §§ 9(3), 12(7) and 178. In the case of images generated by a consumer’s interaction with a generative AI tool, would that be the consumer or the generative AI provider?

Article By Nadia G. Aram and Dr. Christian E. Mammen of Womble Bond Dickinson (US) LLP

For more intellectual property legal news, click here to visit the National Law Review.

Copyright © 2023 Womble Bond Dickinson (US) LLP All Rights Reserved.

Lawyer Bot Short-Circuited by Class Action Alleging Unauthorized Practice of Law

Many of us are wondering how long it will take for ChatGPT, the revolutionary chatbot by OpenAI, to take our jobs. The answer: perhaps, not as soon as we fear!

On March 3, 2023, Chicago law firm Edelson P.C. filed a complaint against DoNotPay, self-described as “the world’s first robot lawyer.” Edelson may have short-circuited the automated barrister’s circuits by filing a lawsuit alleging the unauthorized practice of law.

DoNotPay is marketed as an AI program intended to assist users in need of legal services, but who do not wish to hire a lawyer. The organization was founded in 2015 to assist users in disputing parking tickets. Since then, DoNotPay’s services have expanded significantly. The company’s website offers to help users fight corporations, overcome bureaucratic obstacles, locate cash and “sue anyone.”

In spite of those lofty promises, Edelson’s complaint counters by pointing out certain deficiencies, stating, “[u]nfortunately for its customers, DoNotPay is not actually a robot, a lawyer, or a law firm. DoNotPay does not have a law degree, is not barred in any jurisdiction and is not supervised by any lawyer.”

The suit was brought by plaintiff Jonathan Faridian, who claims to have used DoNotPay for legal drafting projects, demand letters, one small claims court filing and drafting an employment discrimination complaint. Faridian’s complaint explains he was under the impression that he was purchasing legal documents from an attorney, only to later discover that the “substandard” outcomes generated did not comport with his expectations.

When asked for comment, DoNotPay’s representative denied Faridian’s allegations, explaining the organization intends to defend itself “vigorously.”

Article By Troy J. Chinnici of Wilson Elser Moskowitz Edelman & Dicker LLP

For more communications, media, and internet legal news, click here to visit the National Law Review.

© 2023 Wilson Elser

The Future of Stablecoins, Crypto Staking and Custody of Digital Assets

In the wake of the collapse of cryptocurrency exchange firm FTX, the Securities and Exchange Commission (SEC) has ratcheted up its oversight and enforcement of crypto firms engaged in activities ranging from crypto staking to custody of digital assets. This is due in part to concerns that the historically free-wheeling and largely unregulated crypto marketplace may adversely impact U.S. investors and contaminate traditional financial systems. The arguments that cryptocurrencies and digital assets should not be viewed as securities under federal laws largely fall on deaf ears at the SEC. Meanwhile, the state of the crypto economy in the United States remains in flux as the SEC, other regulators and politicians alike attempt to balance competing interests of innovation and investment in a relatively novel and untested asset class.

Is Crypto Staking Dead?

First, what is crypto staking? By way of background, it’s necessary to understand a bit about blockchain technology, which serves as the underpinning for all cryptocurrency and digital asset transactions. One of the perceived benefits of such transactions is that they are decentralized and “peer-to-peer” – meaning that Person A can transact directly with Person B without the need for a financial intermediary to approve the transaction.

However, in the absence of a central authority to validate a transaction, blockchain requires other verification processes or consensus mechanisms such as “proof of work” (which in the case of Bitcoin mining ensures that transactions are valid and added to the Bitcoin blockchain correctly) or “proof of stake” (a network of “validators” who contribute or “stake” their own crypto in exchange for a chance to validate a new transaction, update the blockchain and earn a reward). Proof of work has come under fire by environmental activists for the enormous amounts of computer power and energy required to solve complex mathematical or cryptographic puzzles to validate a transaction before it can be recorded on the blockchain. In contrast, proof of stake is analogous to a shareholder voting their shares of stock to approve a corporate transaction.

Second, why has crypto staking caught the attention of the SEC? Many crypto firms and exchanges offer “staking as a service” (SaaS) whereby investors can stake (or lend) their digital assets in exchange for lucrative returns. This practice is akin to a person depositing cash in a bank account in exchange for interest payments – minus FDIC insurance backing of all such bank deposits to protect investors.

Recently, on February 9, 2023, the SEC charged two crypto firms, commonly known as “Kraken,” for violating federal securities laws by offering a lucrative crypto asset SaaS program. Pursuant to this program, investors could stake their digital assets with Kraken in exchange for annual investment returns of up to 21 percent. According to the SEC, this program constituted the unregistered sale of securities in violation of federal securities laws. Moreover, the SEC claims that Kraken failed to adequately disclose the risks associated with its staking program. According to the SEC’s Enforcement Division director:

“Kraken not only offered investors outsized returns untethered to any economic realities but also retained the right to pay them no returns at all. All the while, it provided them zero insight into, among other things, its financial condition and whether it even had the means of paying the marketed returns in the first place.”1

Without admitting or denying the SEC’s allegations, Kraken has agreed to pay a $30 million civil penalty and will no longer offer crypto staking services to U.S. investors. Meanwhile, other crypto firms that offer similar programs, such as Binance and Coinbase, are waiting for the other shoe to drop – including the possibility that the SEC will ban all crypto staking programs for U.S. retail investors. Separate and apart from potentially extinguishing a lucrative revenue stream for crypto firms and investors alike, it may have broader consequences for proof of stake consensus mechanisms commonly used to validate blockchain transactions.

NY DFS Targets Stablecoins

In the world of cryptocurrency, stablecoins are typically considered the most secure and least volatile because they are often pegged 1:1 to some designated fiat (government-backed) currency such as U.S. dollars. In particular, all stablecoins issued by entities regulated by the New York Department of Financial Services (NY DFS) are required to be fully backed 1:1 by cash or cash equivalents. However, on February 13, 2023, NY DFS unexpectedly issued a consumer alert stating that it had ordered Paxos Trust Company (Paxos) to stop minting and issuing a stablecoin known as “BUSD.” BUSD is reportedly the third largest stablecoin by market cap and pegged to the U.S. dollar.

The reasoning behind the NY DFS order remains unclear from the alert, which merely states that “DFS has ordered Paxos to cease minting Paxos-issued BUSD as a result of several unresolved issues related to Paxos’ oversight of its relationship with Binance in regard to Paxos-issued BUSD.”2 The same day, Paxos confirmed that it would stop issuing BUSD. However, in an effort to assuage investors, Paxos stated “All BUSD tokens issued by Paxos Trust have and always will be backed 1:1 with U.S. dollar–denominated reserves, fully segregated and held in bankruptcy remote accounts.”3

Separately, the SEC reportedly issued a Wells Notice to Paxos on February 12, 2023, indicating that it intended to commence an enforcement action against the company for violating securities laws in connection with the sale of BUSD, which the SEC characterized as unregistered securities. Paxos, meanwhile, categorically denies that BUSD constitute securities, but nonetheless has agreed to stop issuing these tokens in light of the NY DFS order.

It remains to be seen whether the regulatory activity targeting BUSD is the beginning of a broader crackdown on stablecoins amid concerns that, contrary to popular belief, such coins may not be backed by adequate cash reserves.

Custody of Crypto Assets

On February 15, 2023, the SEC proposed changes to the existing “custody rule” under the Investment Advisers Act of 1940. As noted by SEC Chair Gary Gensler, the custody rule was designed to “help ensure that [investment] advisers don’t inappropriately use, lose, or abuse investors’ assets.”4 The proposed changes to the rule (referred to as the “safeguarding rule”) would require investment advisers to maintain client assets – specifically including crypto assets – in qualified custodial accounts. As the SEC observed, “[although] crypto assets are a relatively recent and emerging type of asset, this is not the first time custodians have had to adapt their practices to safeguard different types of assets.”5

A qualified custodian generally is a federal or state-chartered bank or savings association, certain trust companies, a registered broker-dealer, a registered futures commission merchant or certain foreign financial institutions.6 However, as noted by the SEC, many crypto assets trade on platforms that are not qualified custodians. Accordingly, “this practice would generally result in an adviser with custody of a crypto asset security being in violation of the current custody rule because custody of the crypto asset security would not be maintained by a qualified custodian from the time the crypto asset security was moved to the trading platform through the settlement of the trade.”7

Moreover, in a departure from existing practice, the proposed safeguarding rule would require an investment adviser to enter into a written agreement with the qualified custodian. This custodial agreement would set forth certain minimum protections for the safeguarding of customer assets, including crypto assets, such as:

  • Implementing appropriate measures to safeguard an advisory client’s assets8
  • Indemnifying an advisory client when its negligence, recklessness or willful misconduct results in that client’s loss9
  • Segregating an advisory client’s assets from its proprietary assets10
  • Keeping certain records relating to an advisory client’s assets
  • Providing an advisory client with periodic custodial account statements11
  • Evaluating the effectiveness of its internal controls related to its custodial practices.12

The new proposed, cumbersome requirements for custodians of crypto assets appear to be a direct consequence of the collapse of FTX, which resulted in the inexplicable “disappearance” of billions of dollars of customer funds. By tightening the screws on custodians and investment advisers, the SEC is seeking to protect the everyday retail investor by leveling the playing field in the complex and often murky world of crypto. However, it still remains to be seen whether, and to what extent, the proposed safeguarding rule will emerge after the public comment period, which will remain open for 60 days following publication of the proposal in the Federal Register.

1 SEC Press Release 2023-25 (Feb. 9, 2023).

2 NY DFS Consumer Alert (Feb. 13, 2023) found at https://www.dfs.ny.gov/consumers/alerts/Paxos_and_Binance.

3 Paxos Press Release (Feb. 13, 2023) found at https://paxos.com/2023/02/13/paxos-will-halt-minting-new-busd-tokens/.

4 SEC Press Release 2023-30 (Feb. 15, 2023).

5 SEC Proposed Rule, p. 79.

6 SEC Fact Sheet: Proposed Safeguarding Rule.

7 SEC Proposed Rule, p. 68.

8 For instance, per the SEC, this could require storing crypto assets in a “cold wallet.”

9 Per the SEC, “the proposed indemnification requirement would likely operate as a substantial expansion in the protections provided by qualified custodians to advisory clients, in particular because it would result in some custodians holding advisory client assets subject to a simple negligence standard rather than a gross negligence standard.” See SEC Proposed Rule, p. 89.

10 Per the SEC, this requirement is intended to “ensure that client assets are at all times readily identifiable as client property and remain available to the client even if the qualified custodian becomes financially insolvent or if the financial institution’s creditors assert a lien against the qualified custodian’s proprietary assets (or liabilities).” See SEC Proposed Rule, p. 92.

11 Per the SEC, “[in] a change from the current custody rule, the qualified custodian would also now be required to send account statements, at least quarterly, to the investment adviser, which would allow the adviser to more easily perform account reconciliations.” See SEC Proposed Rule, p. 98.

12 Per the SEC, the proposed rule would require that the “qualified custodian, at least annually, will obtain, and provide to the investment adviser a written internal control report that includes an opinion of an independent public accountant as to whether controls have been placed in operation as of a specific date, are suitably designed, and are operating effectively to meet control objectives relating to custodial services (including the safeguarding of the client assets held by that qualified custodian during the year).” See SEC Proposed Rule, p. 101.

Article By Anjali C. Das of Wilson Elser Moskowitz Edelman & Dicker LLP

For more cryptocurrency and finance legal news, click here to visit the National Law Review.

© 2023 Wilson Elser

Locking Tik Tok? White House Requires Removal of TikTok App from Federal IT

On February 28, the White House issued a memorandum giving federal employees 30 days to remove the TikTok application from any government devices. This memo is the result of an act passed by Congress that requires the removal of TikTok from any federal information technology. The act responded to concerns that the Chinese government may use data from TikTok for intelligence gathering on Americans.

I’m Not a Federal Employee — Why Does It Matter?

The White House Memo clearly covers all employees of federal agencies. However, it also covers any information technology used by a contractor who is using federal information technology.  As such, if you are a federal contractor using some sort of computer software or technology that is required by the U.S. government, you must remove TikTok in the next 30 days.

The limited exceptions to the removal mandate require federal government approval. The memo mentions national security interests and activities, law enforcement work, and security research as possible exceptions. However, there is a process to apply for an exception – it is not automatic.

Takeaways

Even if you are not a federal employee or a government contractor, this memo would be a good starting place to look back at your company’s social media policies and cell phone use procedures. Do you want TikTok (or any other social media app) on your devices? Many companies have found themselves in PR trouble due to lapses in enforcement of these types of rules. In addition, excessive use of social media in the workplace has been shown to be a drag on productivity.

Article By J. William Manuel and Anne R. Yuengert of Bradley Arant Boult Cummings LLP

For more communications, media, and internet legal news, click here to visit the National Law Review.

© 2023 Bradley Arant Boult Cummings LLP

FTC Launches New Office of Technology

On February 17, 2023, the Federal Trade Commission announced the launch of their new Office of Technology. The Office of Technology will assist the FTC by strengthening and supporting law enforcement investigations and actions, advising and engaging with staff and the Commission on policy and research initiatives, and engaging with the public and relevant experts to identify market trends, emerging technologies and best practices. The Office will have dedicated staff and resources and be headed by Chief Technology Officer Stephanie T. Nguyen.

Article By Hunton Andrews Kurth’s Privacy and Cybersecurity Practice Group

For more privacy and cybersecurity legal news, click here to visit the National Law Review.

Copyright © 2023, Hunton Andrews Kurth LLP. All Rights Reserved.

8 Best Lawyer Forums Online

Though unorthodox for a traditional profession like the law, remote work is becoming a more realistic option for lawyers all over the country. With the help of tools like legal practice management software and options to practice law in multiple states, lawyers everywhere are tackling the challenges of remote work.

But one obstacle that remains is networking. Remote lawyers need to put extra work into maintaining professional connections and building an online presence, both of which are made easier with online forums designed specifically for legal professionals.

What Is an Online Forum?

An online forum is an internet space dedicated to conversation using questions, answers, responses, and prompts. Typically, online forums are asynchronous — users post a question, then other users respond at their leisure.

Posts in forums are archived and arranged into categories like post date, popularity, and more. Discussions can last for hours, days, months, or possibly years, as long as users continue to contribute.

Why Should Lawyers Use Online Forums?

After the rapid shift to remote work during the COVID-19 pandemic, plenty of industries saw the value of allowing employees to work from home – including law firms. More and more lawyers are working remotely, but that could come at the cost of networking.

Networking doesn’t have to mean interactions that take place over coffee, lunch, cocktails, golf excursions, or big events. In the strictest sense, networking is any meeting between people, whether in a group or one on one, online or in-person, which can be done using online forums.

Online forums dedicated to lawyers and the legal industry are an effective way to facilitate networking opportunities when in-person meetings aren’t an option. Getting involved in online forums help lawyers discuss industry topics with experts and thought leaders, stay current on trends and technology, and learn valuable tips from other lawyers.

Top 8 Online Forums for Lawyers

Curious about online forums? Here are the best options for lawyers and legal professionals to engage with other legal professionals and build a network as a remote attorney:

1. Quora

Quora is a broad forum that covers a variety of topics in question-and-answer formats, including the legal industry. You can easily search for questions or topics that are trending in the legal industry and contribute expert answers to boost your credibility. The more answers you provide, and the more other users engage with you, the closer you can get to becoming a thought leader in the space.

2. Bar Association Forums

Bar association forums are always a benefit to lawyers, remote or otherwise. There are plenty of options to choose from, including local bar associations or forums dedicated to your practice area. Best of all, you’ll be engaging with other knowledgeable legal professionals to connect and network.

3. Social Media Groups

Social media channels like Facebook and LinkedIn have dedicated groups that bring together users based on interests or industries, such as the legal industry. These two platforms are among the best for getting into a private or public group and enhancing your online presence. Keep in mind that you are representing yourself as a lawyer in these groups, so use a professional social media account, not your personal one.

The Thomson Reuters Legal Community is an exclusive option for customers of Thomson Reuters that brings together a virtual community of lawyers to network and engage in group settings. You can connect with lawyers from all different practice areas, both locally and nationally, and gain valuable insights from industry experts.

5. The Lawyerist Community

The Lawyerist is an online community dedicated to small firm lawyers to provide coaching, podcasts, books, guides, and other insights. The company has its own online lawyer forum – The Lawyerist Community – on Facebook to discuss law firm best practices, trends, and ideas.

6. Reddit

Reddit has some of the best online forums for a range of different topics, from broad subjects like sports to niche communities dedicated to obscure literature. There’s also a legal forum, r/LawFirm, that’s an informal community for lawyers to discuss running a law firm and the legal industry as a whole. There’s also a lawyer subreddit that you can join if you’re licensed.

7. Slack

Slack is a top-rated collaboration platform that offers individual channels for groups of users. There are several communities dedicated to the law, including LawyerSmack, which is comprised of private attorneys.

8. Law School Alumni Forums

Some law schools have online forums for alumni to stay connected with faculty and colleagues. While not every school offers an online forum for networking, if yours does, you can build vital industry contacts and further your practice. You’ll also get updates on news, trends, and in-person network events by participating in the forum.

Outlook on Online Forums

Remote and hybrid working models are the “new normal,” even for lawyers. Now that law firms and lawyers have seen the benefits in productivity, work-life balance, and enhanced communication afforded by remote work, there’s no going back.

Still, lawyer networking is essential for lawyers to grow their practice, no matter if it’s online or in-person. Along with joining forums to engage in discussions with other industry professionals, you can enhance your remote work with law practice management software. The right law firm software empowers lawyers to manage their practice from anywhere.

Start Networking Remotely

Networking is a big part of successful client acquisition for lawyers. Though it takes a little more work to keep up with networking as a lawyer working remotely, online lawyer forums can keep you connected to other industry professionals. And because you can engage with lawyers all over the country, you can find even more opportunities online than in person at networking events.

Article By Dan Bowman of PracticePanther

For more business of law legal news, click here to visit the National Law Review.

© Copyright 2023 PracticePanther

DOL Issues Guidance on Handling Telework Under FLSA, FMLA

The U.S. Department of Labor (DOL) has issued guidance on the application of the Fair Labor Standards Act (FLSA) and Family and Medical Leave Act (FMLA) to employees who telework from home or from another location away from the employer’s facility.

The Field Assistance Bulletin (FAB) 2023-1, released on February 9, 2023, is directed to agency officials responsible for enforcement and provides employers a glimpse into how the DOL applies existing law and regulations to common remote-work scenarios. FAB 2023-1 addresses FLSA regulations governing “hours worked,” rules related to break time and privacy for nursing employees, and FMLA eligibility factors.

Hours Worked

In the FAB, the DOL reviews the rules governing compensability of work time, explaining that, regardless of work location, short breaks (typically, 20 minutes or less) generally are counted as compensable hours worked, whereas, longer breaks “during which an employee is completely relieved from duty, and which are long enough to enable [the employee] to use the time effectively for [their] own purposes[,] are not hours worked.” Examples of short breaks, whether at home or in the office, include when an employee takes a bathroom or coffee break or gets up to stretch their legs.

Longer rest breaks and periods of time, when employees are completely relieved from duty and able to use the time for their own purposes, are not considered work time. Just as would be the case when an employee is working in the office, if during remote work an employee’s 30-minute lunch break is interrupted by several work-related phone calls, that 30-minute period would be counted as hours worked. Conversely, if an employee working from home takes a three-hour break to pick up their child or to perform household chores, that time does not count as work time under the FLSA. In short, the FAB reiterates the telework guidance set forth by the DOL in a Q&A series published during the height of the COVID-19 pandemic.

The FAB emphasizes that, regardless of whether an employee performs duties at home, at the worksite, or at some other location, if the employer knows or has reason to believe that work is being performed, the time must be counted as hours worked. Importantly, the FAB notes that an employer may satisfy its obligation to exercise reasonable diligence to acquire knowledge regarding employees’ unscheduled hours of work by providing a reasonable reporting procedure for employees to use when they work non-scheduled time and paying employees for all hours worked. This guidance was addressed in greater detail in FAB 2020-5.

Guidelines for Nursing Employees

The FAB further clarifies that, under the FLSA, an employer’s obligation to provide employees “reasonable break time,” as well as an appropriate place to express breast milk, extends to employees who are teleworking or working at an off-site location. Just as an employer has an obligation to provide an “appropriate place” for an employee to express milk while working at a client site, the employer should ensure a teleworking employee has privacy from a “computer camera, security camera, or web conferencing platform” to express milk.

Employers are not required to pay employees for otherwise unpaid breaks simply because the employee is expressing breast milk during the break, but if an employee is working while pumping (or if the pumping occurs during an otherwise paid break), they must be paid for that time. For example, in most cases, if a remote employee attends a call or videoconference off camera while pumping, that employee would be considered on duty and must be paid for that time.

The recently enacted PUMP Act expanded existing employer obligations under the FLSA to cover exempt employees, as well as non-exempt employees. The DOL has published more guidance on breast milk pumping during work.

Eligibility Under FMLA

The DOL also addresses FMLA eligibility requirements for remote employees both in terms of hours worked (employee must work 1,250 hours in the previously 12 months) and the small worksite exception (employee must work at a worksite with at least 50 employees in a 75-mile radius).

As with the FLSA, it is important for employers to have a system to track their remote workers’ hours. With respect to hours worked, the FAB reiterates that the 1,250 hours determination for remote worker is based on compensable hours of work under FLSA principles.

With respect to the worksite size determination, the FMLA regulations explain that an employee’s personal residence is not a worksite. Instead, whether a remote employee is FMLA-eligible is based on the size of the worksite from which “they report to” or “their assignments are made.” If a remote employee reports into or receives assignments from a site with 50 or more employees working at that site (or reporting to or receiving assignments from that site) or within 75 miles, then that employee would meet that eligibility factor.

The DOL provided two examples of this rule:

  • When both a store employee and their supervisor are working from their homes temporarily due to a weather emergency, for FMLA eligibility purposes, the store remains their worksite.

  • When remote employees are working in various cities more than 75 miles away from the company headquarters but receiving assignments from a manager working at the headquarters, for FMLA-eligibility determination, the company’s headquarters would be considered the workplace for the remote employees.

Employers are reminded to review state and local wage and hour laws, paid and unpaid leave laws, and lactation accommodation laws.

Article By Jenifer M. Bologna, Justin R. Barnes, and Jeffrey W. Brecher of Jackson Lewis P.C.

For more labor and employment legal news, click here to visit the National Law Review.

Jackson Lewis P.C. © 2023

The FTC Announces First Health Breach Notification Rule Enforcement Action

On February 1, the Federal Trade Commission (“FTC”) announced enforcement action for the first time under its Health Breach Notification Rule[1]. The complaint against telehealth and prescription drug discount provider GoodRx Holdings Inc. (“GoodRx”), alleges its failure to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to Facebook, Google and other companies.

In a first-of-its-kind proposed order, filed by the Department of Justice on behalf of the FTC, GoodRx will be prohibited from sharing user health data with applicable third parties for advertising purposes, and has agreed to pay a $1.5 million civil penalty for violating the rule. The proposed order must be approved by the federal court to go into effect. The Health Breach Notification Rule requires vendors of personal health records and related entities, which are not covered by the Health Insurance Portability and Accountability Act (HIPAA), to notify consumers and the FTC of unauthorized disclosures. In a September 2021 policy statement, the FTC warned health apps and connected devices that they must comply with the rule.

According to the FTC’s complaint, for years GoodRx violated the FTC Act by sharing sensitive personal health information with advertising companies and platforms—contrary to its privacy promises—and failed to report these unauthorized disclosures as required by the Health Breach Notification Rule.  Specifically, the FTC claims GoodRx shared personal health information with Facebook, Google, Criteo and others. According to the FTC, since at least 2017, GoodRx deceptively promised its users that it would never share personal health information with advertisers or other third parties. GoodRx repeatedly violated this promise by sharing sensitive personal health information—such as including its users’ prescription medications and personal health conditions.

The FTC also alleges GoodRx monetized its users’ personal health information, and used data it shared with Facebook to target GoodRx’s own users with personalized health and medication-specific advertisements on Facebook and Instagram.

The FTC further alleges that GoodRx:

  • Failed to Limit Third-Party Use of Personal Health Information: GoodRx allowed third parties it shared data with to use that information for their own internal purposes, including for research and development or to improve advertising.
  • Misrepresented its HIPAA Compliance: GoodRx displayed a seal at the bottom of its telehealth services homepage falsely suggesting to consumers that it complied with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a law that sets forth privacy and information security protections for health data.
  • Failed to Implement Policies to Protect Personal Health Information: GoodRx failed to maintain sufficient policies or procedures to protect its users’ personal health information. Until a consumer watchdog publicly revealed GoodRx’s actions in February 2020, GoodRx had no sufficient formal, written, or standard privacy or data sharing policies or compliance programs in place.

In addition to the $1.5 million penalty for violating the rule, the proposed federal court order also prohibits GoodRx from engaging in the deceptive practices outlined in the complaint and requires the company to comply with the Health Breach Notification Rule. To remedy the FTC’s numerous allegations, other provisions of the proposed order against GoodRx also:

  • Prohibit the sharing of health data for advertising: GoodRx will be permanently prohibited from disclosing user health information with applicable third parties for advertising purposes.
  • Require user consent for any other sharing: GoodRx must obtain users’ affirmative express consent before disclosing user health information with applicable third parties for other purposes. The order requires the company to clearly and conspicuously detail the categories of health information that it will disclose to third parties.  It also prohibits the company from using manipulative designs, known as dark patterns, to obtain users’ consent to share the information.
  • Require the company to seek deletion of data: GoodRx must direct third parties to delete the consumer health data that was shared with them and inform consumers about the breaches and the FTC’s enforcement action against the company.
  • Limit Retention of Data: GoodRx will be required to limit how long it can retain personal and health information according to a data retention schedule. It also must publicly post a retention schedule and detail the information it collects and why such data collection is necessary.
  • Implement a Mandated Privacy Program: GoodRx must put in place a comprehensive privacy program that includes strong safeguards to protect consumer data.

© 2023 Dinsmore & Shohl LLP. All rights reserved.

For more Cybersecurity and Privacy Legal News, click here to visit the National Law Review

FOOTNOTES

[1] 16 CFR Part 318

FDA’s Digital Health High Notes from 2022

There has been a lot of discussion lately of the Food and Drug Omnibus Reform Act of 2022 (FDORA), which was enacted on December 29, 2022 as part of the larger Consolidated Appropriations Act for 2023 (you can find our blog post on it here). As important as these kinds of future reforms are to medical product developers, we should also take a moment to review last year’s actions and policy updates on digital health from the Food and Drug Administration (FDA) and to reflect on the transformations that have been taking place at the agency as a result of the rapid pace of innovation in the field. The year 2022 marked the conclusion of the five-year Software Precertification Pilot Program and the release of the final Clinical Decision Support Software guidance, among other things, although FDA’s digital health policies generally remained consistent. In this post, we summarize the agency’s key actions in the digital health space in 2022.

Expanding into Extended Reality

Over the past few years, FDA has started a number of initiatives to explore the use of virtual, mixed, and augmented reality (the agency typically uses the term “extended reality” to cover all types of immersive digital systems) as therapeutic devices for use by patients in clinical environments and at home. The agency granted marketing authorization to two virtual reality devices for patient use, EaseVRx for chronic pain (de novo classification) and Luminopia One for treatment of lazy eye in children, in 2021 and the CureSight system, also for lazy eye in children, in 2022. It is also conducting multiple internal research projects on medical extended reality within the Center for Devices and Radiological Health (CDRH).

In conjunction with its internal research, FDA is engaging health care professionals and the industry to learn about possible benefits, as well as the risks and limitations, of medical extended reality systems to guide future decisions about the therapeutic and clinical uses of such devices. A meeting of FDA’s Patient Engagement Advisory Committee in July 2022 provided an opportunity for the agency to hear from experts and researchers in the field of extended reality and its uses, as well as companies developing medical extended reality devices and patients who have experienced such devices. The materials from the meeting are available here.

FDA also published a list of medical extended reality devices that have received marketing authorization on its website devoted to the Digital Health Center of Excellence (DHCoE), which is part of CDRH.

Application of extended reality technology and the metaverse to medicine is an exciting area of development, and we expect FDA to continue to be active in the space and to develop formal policies and guidance on extended reality devices in the near future.

Precertification Pilot Ends with Uncertain Future

FDA’s Software Precertification Pilot Program, launched in 2017 to explore innovative methods and approaches to regulating software as a medical device (SaMD), officially ended in September 2022 (see our previous posts on the Precertification program here and here). Although FDA was able to glean some key insights from the pilot, including a better understanding of SaMD manufacturer practices throughout the product life cycle, including design, development, and management of SaMD products, the agency ultimately admitted that it had encountered significant challenges in implementing the pilot program. Such challenges included:

  • limited statutory authorities, which hindered FDA’s ability to gather consistent and harmonized information on manufacturer practices and SaMD performance;
  • focusing only on SaMD for De Novo classification, which limited the number of eligible devices and created issues for testing pilot-specific special controls; and
  • the small number of participants (only nine SaMD manufacturer were accepted to the pilot program).

You can read FDA’s final report from the pilot program here.

FDA may use its observations from the pilot program when developing new guidance or other policies pertaining to SaMD, but any new rules or guidances must be consistent with the agency’s current statutory authorities. It is very likely that we have seen the end of any FDA software precertification program, unless or until Congress decides to grant the agency specific authority to implement a new or different regulatory regime for SaMD.

Leadership Changes at the Digital Health Center of Excellence

The past year marked a number of watershed changes at the DHCoE, including the departure of Bakul Patel, longstanding CDRH official in many capacities and the first director of the DHCoE, and the naming of a new acting director, Brendan O’Leary. Subsequently, in January 2023, the agency named Troy Tazbaz, former senior vice president at Oracle, as the new director of DHCoE. It will be interesting to see how Mr. Tazbaz, a newcomer to the agency, will direct the DHCoE in further developing the regulatory framework for digital health devices and in building strategic partnerships with industry stakeholders.

Digital Health Guidances

FDA introduced a number of new and revised guidance documents relating to digital health technologies in 2022. The following is a list with brief descriptions of each such agency guidance:

  • Clinical Decision Support Software (final guidance) – After a long wait (the previous draft version was published in September 2019), FDA issued a final guidance covering clinical decision support (CDS) software devices on September 28, 2022. You can find our analysis of this critical guidance in this previous post. In addition, FDA created some helpful resources to determine the regulations that may apply to a company’s CDS software or other types of SaMD: a CDS software flowchart, and a Digital Health Policy Navigator.
  • Policy for Device Software Functions and Mobile Medical Applications (revised final guidance) – FDA issued an updated version of this guidance in September 2022 to implement changes consisted with the CDS final guidance.
  • Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (draft guidance) – In recent years, FDA has repeatedly emphasized the importance of addressing cybersecurity in medical devices and has made great efforts in keeping its policies and guidance documents aligned with current cybersecurity recommendations. This guidance describes methods for incorporating cybersecurity into the design and development process for connected medical devices (including SaMD) and for maintaining cybersecurity as part of device quality systems throughout the product lifecycle. Once finalized, this guidance will supersede final guidance Content of Premarket Submissions for Management of Cybersecurity in Medical Devices, issued in October 2014. It is also worth noting that FDORA grants the agency new authorities to require cybersecurity plans as part of premarket submissions for so-called “cyber devices,” which will need to be considered and incorporated into any upcoming final guidance on this topic.
  • Computer-Assisted Detection Devices Applied to Radiology Images and Radiology Device Data – Premarket Notification [510(k)] Submissions (final guidance) & Clinical Performance Assessment: Considerations for Computer-Assisted Detection Devices Applied to Radiology Images and Radiology Device Data in Premarket Notification (510(k)) Submissions (final guidance) – This pair of final guidances describes FDA’s expectations for information included in premarket notification submissions for CADe devices, and specifically for the design of clinical studies to support marketing authorization of such devices. Many companies have developed, or are interested in developing, software with CADe functionality to detect lesions or abnormalities in radiology images for the purpose of assisting human readers, and with the rapid risk of artificial intelligence/machine learning-based software, some manufacturers may seek to develop CADe software that replaces human readers altogether. These guidances are especially useful for companies developing CADe software and preparing for clinical testing and submission to FDA.
  • Electronic Submission Template for Medical Device 510(k) Submissions (final guidance) – Although this guidance does not specifically apply to digital health technologies, it represents an important development for all medical device companies, including digital health device manufacturers. FDA released this guidance in conjunction with the announcement that CDRH will accept electronic submissions of device premarket notifications from all applicants using the electronic submission template and resource (eSTAR) tool. The guidance describes the structure of the template (and helpfully cross-references other guidance documents that relate to each section of the template). FDA has designated October 1, 2023 as the date of full transition to electronic submission for premarket notifications, meaning that FDA will no longer accept eCopies of premarket notification submissions for filing and review as of that date.

As the preceding list highlights, digital health is an active and rapidly advancing field both in the private sector and at FDA. We will continue to monitor and report on notable developments in terms of regulatory policies affecting developers and investors in the broader field.

©1994-2023 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.
For more Food and Drug Legal News, click here to visit the National Law Review