Category: Communication Media & Internet

AI Transcripts and Investment Advisers: Embracing Technology While Meeting SEC Requirements

AI Transcripts in Investment Advisory

There has been a boom recently regarding investment advisers’ use of artificial intelligence (“AI”) to transcribe client and internal meetings. Among other applications, AI features such as Zoom AI Companion, Microsoft Copilot, Jump, and Otter.ai (collectively, “AI Meeting Assistants”) can assist with drafting, transcribing, summarizing and prompting action items based on conversation content in the respective application. For instance, Zoom AI Companion and Microsoft Copilot can draft communications, generate transcriptions of conversations, identify points of agreement and disagreement of a discussion and summarize action items.

Overview of SEC Recordkeeping Requirements for AI Transcripts

As of now, there are no specific artificial intelligence regulations pertaining to the use of AI transcripts or the recordkeeping obligations that would follow. However, there are several SEC recordkeeping provisions that may be implicated by use of the AI capabilities offered by the AI Meeting Assistants. Rule 204-2 requires investment advisers to maintain certain records “relating to [their] investment advisory business” including “written communications sent by such investment adviser relating to” such enumerated subjects as: (i) any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) any receipt, disbursement or delivery of funds or securities; (iii) the placing or execution of any order to purchase or sell any security; and (iv) predecessor performance and the performance or rate of return of any or all managed accounts, portfolios, or securities recommendations (subject to certain exceptions).

Every registered investment adviser is required to keep true, accurate and current books and records. The approach at this juncture would be to adopt these AI Meeting Assistant transcripts into the firm’s books and records. Once translated into written form, the SEC could consider the transcripts and summaries to be written communications regarding investment advice. Such transcripts and summaries should be kept in their original form, together with notes (if any) as to any corresponding inaccuracies produced by the AI content. Registered investment advisers are fiduciaries and should not utilize any information in conjunction with providing client services or communications that it does not reasonably believe is accurate. Thus, if the firm was to use the content of AI transcripts and/or summaries in conjunction with client services or communications that was incorrect, the onus would remain on the firm to demonstrate as to how it reasonably relied upon the content. It is inconsequential whether these transcripts and summaries make it into your CRM software or are maintained in the AI Meeting Assistants program. Regardless of whether the content is a meeting summary or list of action items, the transmission would likely constitute a communication for purposes of Rule 204-2 due to implicating an already established recordkeeping requirement.

Implementing Effective AI Strategies in Investment Advisory

  • A firm must eliminate or neutralize the effect of conflicts of interest associated with the firm’s use of artificial intelligence in investor interactions that place the firm’s or its associated person’s interest ahead of investors’ interests.
  • A firm that has any investor interaction using covered technology (AI) to have written policies and procedures reasonably designed to prevent violations of the proposed rules.
  • Adopt AI Meeting Assistant transcripts into books and records.
COPYRIGHT © 2024, STARK & STARK
For more on AI, visit the NLR Artificial Intelligence section

The Cybersecurity Maturity Model Certification (CMMC) Program – Defense Contractors Must Rapidly Prepare and Implement

The Department of Defense (DoD) has officially launched the Cybersecurity Maturity Model Certification (CMMC) Program, which requires federal contractors and subcontractors across the Defense Industrial Base (DIB) to comply with strict cybersecurity standards. The CMMC program aims to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in DoD contracts from evolving cyber threats by requiring defense contractors to implement comprehensive cybersecurity controls. The CMMC Program, which must be confirmed by contracting officers, moves beyond the prior self-assessment model for many contractors to a certification-based approach verified by DoD-approved third-party assessors known as CMMC Third Party Assessor Organizations (C3PAOs).

This client alert outlines the key elements of the CMMC program, providing a detailed analysis of the new certification requirements, timelines for implementation, and practical steps contractors can take to prepare for compliance.

CMMC Overview and Purpose

The CMMC Program represents the DoD’s commitment to ensuring that companies handling FCI and CUI meet stringent cybersecurity standards. The program was developed in response to increasing cyber threats targeting the defense supply chain and is designed to verify that defense contractors and subcontractors have implemented the necessary security measures to safeguard sensitive information.

The CMMC Program consists of three levels of certification, with each level representing an increasing set of cybersecurity controls. The certification levels correspond to the type of information handled by the contractor, with higher levels required for contractors handling more sensitive information, such as CUI.

The DoD officially published the CMMC final rule on October 15, 2024, establishing the CMMC Program within federal regulations. The rule will be effective 60 days after publication, marking a significant milestone in the program’s rollout. DoD expects to publish the final rule amending the DFARS to add CMMC requirements to DoD contracts in early 2025. Contractors that fail to meet CMMC requirements will be ineligible for DoD contracts that involve FCI or CUI and could face significant penalties if they inappropriately attest to compliance.

The overall scope of the CMMC rule is relatively clear; however, some key elements are ambiguous and, in some cases, may require careful consideration. Particularly at the outset of any assessment process, a pre-risk gap assessment internal review, ideally conducted under legal privilege, is recommended to permit sufficient time to address shortfalls in technical controls or governance. The typical timeline for implementing a CMMC-type program may take many months, and we strongly recommend that clients begin this process soon if they have not already started—it is now unquestionably a requirement to do business with the DoD.

CMMC Certification Levels

The CMMC Program features three certification levels that contractors must achieve depending on the nature and sensitivity of the information they handle:

Level 1 (Self-Assessment)

Contractors at this level must meet 15 basic safeguarding requirements outlined in Federal Acquisition Regulation (FAR) 52.204-21. These requirements focus on protecting FCI, which refers to information not intended for public release but necessary for performing the contracted services. A self-assessment is sufficient to achieve certification at this level.

Level 2 (Self-Assessment or Third-Party Assessment)

Contractors handling CUI must meet 110 security controls specified in NIST Special Publication (SP) 800-171. CUI includes unclassified information that requires safeguarding or dissemination controls according to federal regulations. To achieve certification, contractors at this level can conduct a self-assessment or engage a C3PAO. Most defense contracts involving CUI will require third-party assessments to verify compliance.

Level 3 (Third-Party Assessment by DIBCAC)

Contractors supporting critical national security programs or handling highly sensitive CUI must achieve Level 3 certification. This level adds 24 security controls from NIST SP 800-172 to protect CUI from advanced persistent threats. The Defense Contract Management Agency’s (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) will conduct assessments for Level 3 contractors. This is the most stringent level of certification and is reserved for contractors working on the most sensitive programs.

Each certification level builds upon the previous one, with Level 3 being the most comprehensive. Certification is valid for three years, after which, contractors must be reassessed.

Certification Process and Assessment Requirements

Contractors seeking certification must undergo an assessment process that varies depending on the level of certification they are targeting. For Levels 1 and 2, contractors may conduct self-assessments. However, third-party assessments are required for most contracts at Level 2 and all contracts at Level 3. The assessment process includes several key steps:

Self-Assessment (Level 1 and Level 2 (Self))

Contractors at Level 1 or Level 2 (Self) must perform an internal assessment of their cybersecurity practices and submit their results to the Supplier Performance Risk System (SPRS). This system is the DoD’s centralized repository for contractor cybersecurity assessments. Contractors must affirm their compliance annually to maintain their certification status.

Third-Party Assessment (Level 2 (C3PAO) and Level 3 (DIBCAC))

For higher-level certifications, contractors must engage a certified C3PAO to conduct an independent assessment of their compliance with the applicable security controls. For Level 3 certifications, assessments will be performed by the DIBCAC. These assessments will involve reviewing the contractor’s cybersecurity practices, examining documentation, and conducting interviews to verify that the contractor has implemented the necessary controls.

Plan of Action and Milestones (POA&M)

Contractors that do not meet all of the required security controls during their assessment may develop a POA&M. This document outlines the steps the contractor will take to address any deficiencies. Contractors have 180 days to close out their POA&M, after which they must undergo a follow-up assessment to verify that all deficiencies have been addressed. If the contractor fails to meet the requirements within the 180-day window, their conditional certification will expire, and they will be ineligible for future contract awards.

Affirmation

After completing an assessment and addressing any deficiencies, contractors must submit an affirmation of compliance to SPRS. This affirmation must be submitted annually to maintain certification, even if a third-party assessment is only required once every three years.

Integration of CMMC in DoD Contracts

The CMMC Program will be integrated into DoD contracts through a phased implementation process. The program will initially apply to a limited number of contracts, but it will eventually become a requirement for all contracts involving FCI and CUI. The implementation will occur in four phases:

Phase 1 (Early 2025)

Following the publication of the final DFARS rule, CMMC requirements will be introduced in select solicitations. Contractors bidding on these contracts must meet the required CMMC level to be eligible for contract awards.

Phase 2

One year after the start of Phase 1, additional contracts requiring CMMC certification will be released. Contractors at this stage must meet Level 2 certification if handling CUI.

Phase 3

A year after the start of Phase 2, more contracts, including those requiring Level 3 certification, will include CMMC requirements.

Phase 4 (Full Implementation)

The final phase, expected to occur by 2028, will fully implement CMMC requirements across all applicable DoD contracts. From this point forward, contractors must meet the required CMMC level as a condition of contract award, exercise of option periods, and contract extensions.

Flow-Down Requirements for Subcontractors

CMMC requirements will apply to prime contractors and their subcontractors. Prime contractors must ensure that their subcontractors meet the appropriate CMMC level. This flow-down requirement will impact the entire defense supply chain, as subcontractors handling FCI must achieve at least Level 1 certification, and those handling CUI must achieve Level 2.

Subcontractors must be certified before the prime contractor can award them subcontracts. Prime contractors will be responsible for verifying that their subcontractors hold the necessary CMMC certification.

Temporary Deficiencies and Enduring Exceptions

The CMMC Program allows for limited flexibility in cases where contractors cannot meet all of the required security controls. Two key mechanisms provide this flexibility:

Temporary Deficiencies

Contractors may temporarily fall short of compliance with specific security controls, provided they document the deficiency in a POA&M and work toward remediation. These temporary deficiencies must be addressed within 180 days to maintain certification. Failure to close out POA&Ms within the required timeframe will result in the expiration of the contractor’s conditional certification status.

Enduring Exceptions

In some cases, contractors may be granted an enduring exception for specific security controls that are not feasible to implement due to the nature of the system or equipment being used. For example, medical devices or specialized test equipment may not support all cybersecurity controls required by the CMMC Program. In these cases, contractors can document the exception in their System Security Plan (SSP) and work with the DoD to determine appropriate mitigations.

Compliance Obligations and Contractual Penalties

The DoD has made it clear that failure to comply with CMMC requirements will have serious consequences for contractors. Noncompliant contractors will be ineligible for contract awards. Moreover, the Department of Justice’s Civil Cyber-Fraud Initiative looms menacingly in the background, as it actively pursues False Claims Act actions against defense contractors for alleged failures to comply with cybersecurity requirements in the DFARS. In addition, the DoD reserves the right to investigate contractors that have achieved CMMC certification to verify their continued compliance. If an investigation reveals that a contractor has not adequately implemented the required controls, the contractor may face contract termination and other contractual remedies.

Preparing for CMMC Certification

Given the far-reaching implications of the CMMC Program, contractors and subcontractors should begin preparing for certification as soon as possible. As an initial step, an internal, confidential gap assessment is highly advisable, preferably done under legal privilege, to fully understand both past and current shortfalls in compliance with existing cybersecurity requirements that will now be more fully examined in the CMMC process. Key steps include:

Assess Current Cybersecurity Posture

Contractors should conduct an internal assessment of their current cybersecurity practices against the CMMC requirements. This will help identify any gaps and areas that need improvement before seeking certification.

Develop an SSP

Contractors handling CUI must develop and maintain an SSP that outlines how they will meet the security controls specified in NIST SP 800-171. This document will serve as the foundation for both internal and third-party assessments.

Engage a C3PAO

Contractors at Level 2 (C3PAO) and Level 3 must identify and engage a certified C3PAO to conduct their assessments. Given the anticipated demand for assessments, contractors should begin this process early to avoid delays.

Prepare a POA&M

For contractors that do not meet all required controls at the time of assessment, developing a POA&M will be crucial to addressing deficiencies within the required 180-day window.

Review Subcontractor Compliance

Prime contractors must review their subcontractors’ compliance with CMMC requirements and ensure they hold the appropriate certification level. This flow-down requirement will impact the entire defense supply chain.

Conclusion

The CMMC Program marks a significant shift in the oversight of how the DoD manages cybersecurity risks within its defense supply chain. While DoD contractors that handle CUI have had contractual obligations to comply with the NIST SP 800-171 requirements since January 1, 2018, the addition of third-party assessments and more stringent security controls for Level 3 contracts aim to improve the overall cybersecurity posture of contractors handling FCI and CUI. Contractors that fail to comply with CMMC requirements risk losing eligibility for DoD contracts, which could result in substantial business losses.

Given the phased implementation of the program, contractors must act now to assess their cybersecurity practices, engage with certified third-party assessors, and ensure compliance with the new requirements. Proactive planning and preparation will be key to maintaining eligibility for future DoD contracts.

Copyright 2024 K & L Gates
For more on Defense Contractors, visit the NLR Government Contracts Maritime Military section

Artificial Intelligence and the Rise of Product Liability Tort Litigation: Novel Action Alleges AI Chatbot Caused Minor’s Suicide

As we predicted a year ago, the Plaintiffs’ Bar continues to test new legal theories attacking the use of Artificial Intelligence (AI) technology in courtrooms across the country. Many of the complaints filed to date have included the proverbial kitchen sink: copyright infringement; privacy law violations; unfair competition; deceptive and acts and practices; negligence; right of publicity, invasion of privacy and intrusion upon seclusion; unjust enrichment; larceny; receipt of stolen property; and failure to warn (typically, a strict liability tort).

A case recently filed in Florida federal court, Garcia v. Character Techs., Inc., No. 6:24-CV-01903 (M.D. Fla. filed Oct. 22, 2024) (Character Tech) is one to watch. Character Tech pulls from the product liability tort playbook in an effort to hold a business liable for its AI technology. While product liability is governed by statute, case law or both, the tort playbook generally involves a defective, unreasonably dangerous “product” that is sold and causes physical harm to a person or property. In Character Tech, the complaint alleges (among other claims discussed below) that the Character.AI software was designed in a way that was not reasonably safe for minors, parents were not warned of the foreseeable harms arising from their children’s use of the Character.AI software, and as a result a minor committed suicide. Whether and how Character Tech evolves past a motion to dismiss will offer valuable insights for developers AI technologies.

The Complaint

On October 22nd, 2024, Ms. Garcia, the mother of the deceased minor (Sewell), filed a complaint in the Middle District of Florida against Google LLC, Character Technologies Inc. and the creators of Character.AI—Noam Shazeer and Daniel De Frietas Adiwarsana. Shazeer and De Frietas formed Character Technologies Inc. after they left their prior jobs at Google LLC and subsequently developed and marketed Character.AI.

Character.AI allows users to communicate with existing Character.AI characters – such as Interviewer or Trip Planner – or to create new AI characters using Character.AI’s tools. A user can then engage with the Character.AI character – whether for human-like conversations, such as to answer questions, write a story, translate or write code – based on Character Tech’s large language model chatbot. According to the Complaint, Character.AI was rated as suitable for children until July 2024.

The Complaint alleges that Character.AI’s chatbot led Sewell to commit suicide. The Plaintiff claims her son became instantly addicted to Character.AI, leading to drastic behavioral changes such as sleep deprivation, school-related issues and low self-esteem. Her son primarily engaged with Character.AI characters from the HBO series Game of Thrones. The conversations with Game of Thrones’ female characters (such as Rhaenyra Targaryen and Daenerys Targaryen) involved sexualized content. Sewell also expressed his own dark thoughts such as “[t]he world I’m in now is such a cruel one. One where I’m meaningless. But, I’ll keep living and trying to get back to you so we can be together again, my love.” According to the Complaint, after Ms. Garcia took her son’s phone away, Sewell would use extraordinary measures to engage with Character.AI characters.

In his last conversation with a Character.AI character, Sewell told the character that he wanted to “come home” and the character replied, “[please] come home to me as soon as possible, my love,” to which he responded, “[w]hat if I told you I could come home right now?” The character answered, “…please do, my sweet king.” Seconds later, Sewell took his own life.

The Claims

The Complaint asserts a host of claims centered around an alleged lack of safeguards for Character.AI and the exploitation of minors. The most significant claims are noted below:

  • The Product Liability Torts

The Plaintiff alleges both strict liability and negligence claims for a failure to warn and defective design. The first hurdle under these product liability claims is whether Character.AI is a product. She argues that Character.AI is a product because it has a definite appearance and location on a user’s phone, it is personal and movable, it is a “good” rather than an idea, copies of Character.AI are uniform and not customized, there are an unlimited number of copies that can be obtained and it can be accessed on the internet without an account. This first step may, however, prove difficult for the Plaintiff because Character.AI is not a traditional tangible good and courts have wrestled over whether similar technologies are services—existing outside the realm of product liability. See In re Social Media Adolescent Addiction, 702 F. Supp. 3d 809, 838 (N.D. Cal. 2023) (rejecting both parties’ simplistic approaches to the services or products inquiry because “cases exist on both sides of the questions posed by this litigation precisely because it is the functionalities of the alleged products that must be analyzed”).

The failure to warn claims allege that the Defendants had knowledge of the inherent dangers of the Character.AI chatbots, as shown by public statements of industry experts, regulatory bodies and the Defendants themselves. These alleged dangers include knowledge that the software utilizes data sets that are highly toxic and sexual to train itself, common industry knowledge that using tactics to convince users that it is human manipulates users’ emotions and vulnerability, and that minors are most susceptible to these negative effects. The Defendants allegedly had a duty to warn users of these risks and breached that duty by failing to warn users and intentionally allowing minors to use Character.AI.

The defective design claims argue the software is defectively designed based on a “Garbage In, Garbage Out” theory. Specifically, Character.AI was allegedly trained based on poor quality data sets “widely known for toxic conversations, sexually explicit material, copyrighted data, and even possible child sexual abuse material that produced flawed outputs.” Some of these alleged dangers include the unlicensed practice of psychotherapy, sexual exploitation and solicitation of minors, chatbots tricking users into thinking they are human, and in this instance, encouraging suicide. Further, the Complaint alleges that Character.AI is unreasonably and inherently dangerous for the general public—particularly minors—and numerous safer alternative designs are available.

  • Deceptive and Unfair Trade Practices

The Plaintiff asserts a deceptive and unfair trade practices claim under Florida state law. The Complaint alleges the Defendants represented that Character.AI characters mimic human interaction, which contradicts Character Tech’s disclaimer that Character.AI characters are “not real.” These representations constitute dark patterns that manipulate consumers into using Character.AI, buying subscriptions and providing personal data.

The Plaintiff also alleges that certain characters claim to be licensed or trained mental health professionals and operate as such. The Defendants allegedly failed to conduct testing to determine whether the accuracy of these claims. The Plaintiff argues that by portraying certain chatbots to be therapists—yet not requiring them to adhere to any standards—the Defendants engaged in deceptive trade practices. The Complaint compares this claim to the FTC’s recent action against DONOTPAY, Inc. for its AI-generated legal services that allegedly claimed to operate like a human lawyer without adequate testing.

The Defendants are also alleged to employ AI voice call features intended to mislead and confuse younger users into thinking the chatbots are human. For example, a Character.AI chatbot titled “Mental Health Helper” allegedly identified itself as a “real person” and “not a bot” in communications with a user. The Plaintiff asserts that these deceptive and unfair trade practices resulted in damages, including the Character.AI subscription costs, Sewell’s therapy sessions and hospitalization allegedly caused by his use of Character.AI.

  • Wrongful Death

Ms. Garcia asserts a wrongful death claim arguing the Defendants’ wrongful acts and neglect proximately caused the death of her son. She supports this claim by showing her son’s immediate mental health decline after he began using Character.AI, his therapist’s evaluation that he was addicted to Character.AI characters and his disturbing sexualized conversations with those characters.

  • Intentional Infliction of Emotional Distress

Ms. Garcia also asserts a claim for intentional infliction of emotional distress. The Defendants allegedly engaged in intentional and reckless conduct by introducing AI technology to the public and (at least initially) targeting it to minors without appropriate safety features. Further, the conduct was allegedly outrageous because it took advantage of minor users’ vulnerabilities and collected their data to continuously train the AI technology. Lastly, the Defendants’ conduct caused severe emotional distress to Plaintiff, i.e., the loss of her son.

  • Other Claims

The Plaintiff also asserts claims of negligence per se, unjust enrichment, survivor action and loss of consortium and society.

Lawsuits like Character Tech will surely continue to sprout up as AI technology becomes increasingly popular and intertwined with media consumption – at least until the U.S. AI legal framework catches up with the technology. Currently, the Colorado AI Act (covered here) will become the broadest AI law in the U.S. when it enters into force in 2026.

The Colorado AI Act regulates a “High-Risk Artificial Intelligence System” and is focused on preventing “algorithmic discrimination, for Colorado residents”, i.e., “an unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, veteran status, or other classification protected under the laws of [Colorado] or federal law.” (Colo. Rev. Stat. § 6-1-1701(1).) Whether the Character.AI technology would constitute a High-Risk Artificial Intelligence System is still unclear but may be clarified by the anticipated regulations from the Colorado Attorney General. Other U.S. AI laws also are focused on detecting and preventing bias, discrimination and civil rights in hiring and employment, as well as transparency about sources and ownership of training data for generative AI systems. The California legislature passed a law focused on large AI systems that prohibited a developer from making an AI system available if it presented an “unreasonable risk” of causing or materially enabling “a critical harm.” This law was subsequently vetoed by California Governor Newsome as “well-intentioned” but nonetheless flawed.

While the U.S. AI legal framework – whether in the states or under the new administration – an organization using AI technology must consider how novel issues like the ones raised in Character Tech present new risks.

Daniel Stephen, Naija Perry, and Aden Hochrun contributed to this article

© Copyright 2024 Squire Patton Boggs (US) LLP
For more on AI, visit the NLR Communications Media Internet section

New Fact Sheet Highlights ASTP’s Concerns About Certified API Practices

On October 29, 2024, the US Department of Health and Human Services (HHS) Assistant Secretary for Technology Policy (ASTP) released a fact sheet titled “Information Blocking Reminders Related to API Technology.” The fact sheet reminds developers of application programming interfaces (APIs) certified under the ASTP’s Health Information Technology (IT) Certification Program and their health care provider customers of practices that constitute information blocking under ASTP’s information blocking regulations and information blocking condition of certification applicable to certified health IT developers.

In Depth

The fact sheet is noteworthy because it follows ASTP’s recent blog post expressing concern about reports that certified API developers are potentially violating Certification Program requirements and engaging in information blocking. ASTP also recently strengthened its feedback channels by adding a section specifically for API-linked complaints and inquiries to the Health IT Feedback and Inquiry Portal. It appears increasingly likely that initial investigations and enforcement of the information blocking prohibition by the HHS Office of Inspector General will focus on practices that may interfere with access, exchange, or use of electronic health information (EHI) through certified API technology.

The fact sheet focuses on three categories of API-related practices that could be information blocking under ASTP’s information blocking regulations and Certification Program condition of certification:

  • ASTP cautions against practices that limit or restrict the interoperability of health IT. For example, the fact sheet states that health care providers who locally manage their fast healthcare interoperability resources (FHIR) servers without certified API developer assistance may engage in information blocking when they refuse to provide to certified API developers the FHIR service base URL necessary for patients to access their EHI.
  • ASTP states that impeding innovations and advancements in access, exchange, or use of EHI or health-IT-enabled care delivery may be information blocking. For example, the fact sheet indicates that a certified API developer may engage in information blocking by refusing to register and enable an application for production use within five business days of completing its verification of an API user’s authenticity as required by ASTP’s API maintenance of certification requirements.
  • ASTP states that burdensome or discouraging terms, delays, or influence over customers and users may be information blocking. For example, ASTP states that a certified electronic health record (EHR) developer may engage in information blocking by conditioning the disclosure of interoperability elements to third-party developers on the third-party developer entering into business associate agreements with all of the EHR developer’s covered entity customers, even if the work being done is not for the benefit of the customers and HIPAA does not require the business associate agreements.

The fact sheet does not address circumstances under which any of the above practices of certified API developers may meet an information blocking exception (established for reasonable practices that interfere with access, exchange, or use of EHI). Regulated actors should consider whether exceptions apply to individual circumstances.

© 2024 McDermott Will & Emery
For more on API Practices, visit the NLR Health Law Managed Care section

HIPAA Gets a Potential Counterpart in HISAA

Americans hear about cybersecurity incidents on a frequent basis. As the adage goes, it is not a matter of “if” a breach or security hack occurs; it is a matter of “when.” At no time was that more evident earlier this year when the healthcare industry was hit with the widespread ransomware attack on Change Healthcare, a subsidiary of the United Health Group. Because of the nature of the Change Healthcare shutdown and its impact across the industry, the U.S. Department of Health & Human Services (HHS) and its HIPAA enforcement arm, the Office for Civil Rights (OCR), conducted investigations and issued FAQ responses for those impacted by the cybersecurity event.

In further response, Senators Ron Wyden (D-OR) and Mark Warner (R-VA) introduced the Health Infrastructure Security and Accountability Act (HISAA) on September 26, 2024. Like HIPAA and HITECH before it, which established minimum levels of protection for healthcare information, HISAA looks to reshape how healthcare organizations address cybersecurity by enacting mandatory minimum security standards to protect healthcare information and by providing initial financial support to facilitate compliance. A copy of the legislative text can be found here, and a one-page summary of the bill can be found here.

To date, HIPAA and HITECH require covered entities and business associates to develop, implement, and maintain reasonable and appropriate “administrative, technical, physical” safeguards to protect electronic Protected Health Information or e-PHI. However, the safeguards do not specify minimum requirements; instead, they prescribe standards intended to be scalable, depending on the specific needs, resources, and capabilities of the respective organization. What this means is that e-PHI stored or exchanged among interconnected networks are subject to systems with often different levels of sophistication or protection.

Given the considerable time, effort, and resources dedicated to HIPAA/HITECH compliance, many consider the current state of voluntary safeguards as inadequate. This is especially the case since regulations under the HIPAA Security Rule have not been updated since 2013. As a result, Senators Wyden and Warner introduced HISAA in an effort to bring the patchwork of healthcare data security standards under one minimum umbrella and to require healthcare organizations to remain on top of software systems and cybersecurity standards.

Key pieces of HISAA, as proposed, include:

  1. Mandatory Cybersecurity Standards—If enacted, the Secretary of HHS, together with the Director of the Cybersecurity and Infrastructure Security Agency (CISA) and the Director of National Intelligence (DNI), will oversee the development and implementation of required standards and the standards will be subject to review and update every two years to counter evolving threats.
  2. Annual Audits and Stress Tests—Like current Security Risk Assessment (SRA) requirements, HISAA will require healthcare organizations to conduct annual cybersecurity audits and document the results. Unlike current requirements, these audits will need to be conducted by independent organizations to assess compliance, evaluate restoration abilities, and conduct stress tests in real-world simulations. While smaller organizations may be eligible for waivers from certain requirements because of undue burden, all healthcare organizations will have to publicly disclose compliance status as determined by these audits.
  3. Increased Accountability and Penalties—HISAA would implement significant penalties for non-compliance and would require healthcare executives to certify compliance on an annual basis. False information in such certifications could result in criminal charges, including fines of up to $1 million and prison time for up to 10 years. HISAA would also eliminate fine caps to allow HHS to impose penalties commiserate with the level needed to deter lax behaviors, especially among larger healthcare organizations.
  4. Financial Support for Enhancements—Because the costs for new standards could be substantial, especially for smaller organizations, HISAA would allocate $1.3 billion to support hospitals for infrastructure enhancements. Of this $1.3 billion, $800 million would be for rural and safety net hospitals over the first two years, and an additional $500 million would be available for all hospitals in succeeding years.
  5. Medicare Payment Adjustments—Finally, HISAA enables the Secretary of HHS to provide accelerated Medicare payments to organizations impacted by cybersecurity events. HHS offered similar accelerated payments during the Change Healthcare event, and HISAA would codify similar authority to HHS for recovery periods related to future cyberattacks.

While HISAA will establish a baseline of cybersecurity requirements, compliance with those requirements will require a significant investment of time and resources in devices and operating systems/software, training, and personnel. Even with the proposed funding, this could result in substantial challenges for smaller and rural facilities to comply. Moreover, healthcare providers will need to prioritize items such as encryption, multi-factor authentication, real-time monitoring, comprehensive response and remediation plans, and robust training and exercises to support compliance efforts.

Finally, at this juncture, the more important issue is for healthcare organizations to recognize their responsibilities in maintaining effective cybersecurity practices and to stay updated on any potential changes to these requirements. Since HISAA was introduced in the latter days of a hectic (and historic) election season, we will monitor its progress as the current Congress winds down in 2024 and the new Congress readies for action with a new administration in 2025.

© 2024 Winstead PC.
For more on HIPAA, visit the NLR Health Law Managed Care section

50 Creative Content Ideas for Businesses and Consultants

When it comes to professional service firms and consultants, the challenge isn’t finding content ideas, it’s choosing the ones that will truly resonate with your audience. The goal is to fill your editorial calendar with posts that keep you visible, relevant and connected with the people who matter most, which include clients, potential hires and referral sources. It’s about creating content that offers real value and positions you as a trusted resource.

Building a Content Strategy That Resonates for Professional Service Firms and Consultants

For professional service firms and consultants, creating engaging content is about more than just filling up an editorial calendar, it’s about choosing ideas that connect with your audience on a deeper level. The real challenge lies in selecting topics that are not only relevant but also genuinely valuable to clients, potential hires and referral sources. Effective content keeps you visible, showcases your expertise and strengthens your reputation as a trusted resource in your field.

Here’s how to create impactful content for your blog, LinkedIn and other social channels. This approach will help you create content that resonates with the people who matter most to your business, driving engagement and helping you stay top-of-mind in a crowded market.

  1. Understand Your Audience’s Needs and Interests; Take time to research what topics are top-of-mind for your clients, prospective clients and industry connections. What questions are they asking? What challenges do they face? Tailoring content around these insights ensures that your posts provide practical answers and value.
  2. Prioritize Value-Driven Content: When brainstorming ideas, focus on content that educates, informs or provides actionable insights. Avoid self-promotional or overly technical topics that may not resonate. Content that genuinely helps your audience solve problems or understand industry trends will set you apart as a valuable resource.
  3. Use Varied Content Types for Engagement: Mix up your content to keep it fresh and engaging. Some ideas work well as blog posts or LinkedIn articles, while others might be better suited for quick LinkedIn posts, infographics or short videos. Diversifying your formats can attract different types of engagement and keep your audience coming back.
  4. Maintain Consistency: Building trust requires regular engagement. Schedule posts to maintain a steady presence, so your audience knows they can rely on you for frequent, quality insights. Aim to post consistently without overloading your audience, finding a rhythm that balances frequency with quality.
  5. Track What Resonates: Use analytics to monitor which topics receive the most engagement. Pay attention to comments, shares and direct messages to identify themes that resonate, and adapt your content plan accordingly.

50 Content Ideas to Get You Started

Here are 50 content ideas to help you build a strong, consistent presence on your blog, email newsletters, LinkedIn and other social platforms.

  1. Show your workspace: Give a tour of where you work, whether it’s your office, a co-working space or a virtual setup. This humanizes your firm and makes you more relatable.
  2. Introduce your team: Highlight key team members and their roles, showcasing their expertise and contributions to the success of the firm.
  3. Introduce yourself: Share your career path, your expertise and how you’ve helped clients achieve success.
  4. Showcase a service you provide: Explain a service in detail, focusing on its benefits and how it solves problems for your clients.
  5. Client testimonials: Share short video testimonials from clients explaining how you helped them and what impact your services had on their business.
  6. Tell a story: Share success stories of how you’ve helped clients overcome significant challenges in their industries.
  7. A day in the life: Take your audience through a typical day at your company to show what goes on behind the scenes.
  8. Behind the scenes: Show the preparation that goes into a major project, event or client engagement.
  9. Answer frequently asked questions: Provide insights and answers to common questions clients ask about your services and processes.
  10. Share industry trends: Offer commentary or analysis on current trends in your industry and how clients can take advantage of them.
  11. How it started vs. how it’s going: Share the evolution of your business or a significant project, demonstrating your growth and accomplishments.
  12. Repurpose blog posts or articles: Share snippets from articles or blogs you’ve written, summarizing key takeaways for your audience.
  13. How-to videos: Create short videos explaining complex concepts or offering professional tips and advice.
  14. Share client success stories: Highlight case studies or client success stories that show the value your services provide.
  15. Your regular work routine: Share the routines or habits that help you stay productive and successful in your field.
  16. Reality vs. expectations: Compare what clients typically expect versus the reality of working with your firm or consultancy, focusing on positive surprises.
  17. Before and after: Show the impact of your services through before-and-after case studies of client businesses.
  18. Quick tips: Share a few short, actionable tips related to your field, such as best practices in your area of expertise.
  19. Do what people ask for in comments: Engage directly with your audience by answering questions or addressing topics they raise in the comments.
  20. Positive reactions to industry news: Provide your take on relevant news in your field and why it matters to your clients.
  21. Share the tools you use: Talk about the tools and resources your firm or consultancy uses to stay efficient and deliver great results for clients.
  22. Celebrate business milestones: Highlight significant moments in your business, such as anniversaries, major achievements or new partnerships.
  23. Highlight a professional skill: Focus on showcasing a specific skill you offer, explaining how it benefits clients and what problems it solves.
  24. Client interviews: Record short interviews with clients about their experience working with your firm, showcasing their success stories.
  25. Encouraging messages: Share positive, motivational insights related to your industry or business practices.
  26. A sneak peek into a major project: Offer a behind-the-scenes look at an exciting new project you’re working on.
  27. Run a social media contest: Engage with your audience by running a contest related to your services (e.g., offer a free consultation or a business audit).
  28. Explain your core values: Share a story or insight about the core values that drive your business and how they impact your services.
  29. Show your thought process: Walk your audience through how you approach solving a client’s problem, emphasizing your expertise.
  30. Tips for Hiring in Your Field: Offer advice on hiring practices or skills to look for in your industry.
  31. Case study in your niche: Share a detailed case study about a particular challenge you solved for a client, emphasizing the results and impact.
  32. Checklist for the week: Offer a weekly checklist that helps clients stay on top of key tasks in their industry or business.
  33. 5 pros & cons of (your niche): Provide a balanced view on the benefits and challenges of working in your field, demonstrating your in-depth knowledge.
  34. Industry updates: Share the latest trends or changes in regulations that impact your clients, positioning yourself as a thought leader.
  35. Favorite tools you use: Discuss the tools or software you use to increase efficiency and improve results for clients.
  36. Quick hacks for getting results: Share a quick tip or hack that helps clients achieve better outcomes in their business.
  37. How clients got results: Highlight how clients benefited from working with your firm, with a focus on outcomes and results.
  38. Things I wish I knew before starting my business: Offer insights or lessons you’ve learned that can benefit other entrepreneurs or consultants.
  39. Highlight key lessons from industry events: Share top takeaways or insights from industry conferences, webinars or roundtables that your firm attended.
  40. Share Lessons Learned from a Recent Client Project: Highlight a recent client project and share key takeaways or lessons learned. This helps showcase your expertise while providing practical insights that could benefit your audience.
  41. Ask for followers’ suggestions: Engage your audience by asking them for content ideas or business topics they want to learn more about.
  42. Encourage followers to ask questions: Create a post inviting your audience to ask you questions about your services, industry trends or business advice.
  43. Create an “ask me anything” session: Host a session where your audience can ask you anything, whether it’s about business, personal growth or industry insights.
  44. Insights from Recent Conferences: Share takeaways from recent industry events or conferences (with photos!).
  45. Spotlight a client’s journey: Highlight the stages of a client’s experience, from the initial consultation to the final outcome. Break down how your firm guided them through each phase, offering valuable insights along the way.
  46. Share key takeaways from major projects: Highlight insights and lessons learned from significant client projects, showcasing how your firm’s expertise helped achieve successful outcomes. This provides value to your audience while reinforcing your industry knowledge.
  47. Show before and after results: For service-based businesses, showing the impact your consultancy or firm has made can build credibility.
  48. Showcase industry predictions and trends: Share your thoughts on the future of your industry. Highlight key changes you expect over the next 6-12 months and what businesses should do to prepare.
  49. Highlight women in leadership: Showcase women leaders in your firm or industry. Share their journeys, achievements and advice to inspire others and emphasize your firm’s commitment to diversity.
  50. Behind-the-scenes insight: Offer a glimpse into the process behind your firm’s latest project, case or transaction, giving clients a better understanding of how your firm operates.

These content ideas can help you stay consistent with your social media presence and maintain visibility within your industry. By using content that speaks directly to your audience and showcases your expertise, you’ll keep your firm connected and top of mind for potential clients.

Copyright © 2024, Stefanie M. Marrone. All Rights Reserved.
For more on Law Office Management, visit the NLR Law Office Management section

Social Media’s Legal Dilemma: Curated Harmful Content

Walking the Line Between Immunity and Liability: How Social Media Platforms May Be Liable for Harmful Content Specifically Curated for Users

As proliferation of harmful content online has increasingly become easier and more accessible through social media, review websites and other online public forums, businesses and politicians have pushed to reform and limit the sweeping protections afforded by Section 230 of the Communications Decency Act, which is said to have created the Internet. Congress enacted Section 230 of the Communications Decency Act of 1996 “for two basic policy reasons: to promote the free exchange of information and ideas over the Internet and to encourage voluntary monitoring for offensive or obscene material.” Congress intended for internet to flourish and the goal of Section 230 was to promote the unhindered development of internet businesses, services, and platforms.

To that end Section 230 immunizes online services providers and interactive computer services from liability for posting, re-publishing, or allowing public access to offensive, damaging, or defamatory information or statements created by a third party. Specifically, Section 230(c)(1) provides,

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

[47 U.S.C. § 230(c)(1)]

Section 230 has been widely interpreted to protect online platforms from being held liable for user-generated content, thereby promoting the free exchange of information and ideas over the Internet. See, e.g., Hassell v. Bird, 5 Cal. 5th 522 (2018) (Yelp not liable for defamatory reviews posted on its platform and cannot be forced to remove them); Doe II v. MySpace Inc., 175 Cal. App.4th 561, 567–575 (2009) (§ 230 immunity applies to tort claims against a social networking website, brought by minors who claimed that they had been assaulted by adults they met on that website]; Delfino v. Agilent Technologies, Inc., 145 Cal. App.4th 790, 804–808 (2006) (§ 230 immunity applies to tort claims against an employer that operated an internal computer network used by an employee to allegedly communicate threats against the plaintiff]; Gentry v. eBay, Inc., 99 Cal. App. 4th 816, 826-36 (Cal. Ct. App. 2002) (§ 230 immunity applies to tort and statutory claims against an auction website, brought by plaintiffs who allegedly purchased forgeries from third party sellers on the website).

Thus, under § 230, lawsuits seeking to hold a service provider liable for its exercise of a publisher’s traditional editorial functions—such as deciding whether to publish, withdraw, postpone or alter content—are barred. Under the statutory scheme, an “interactive computer service” qualifies for immunity so long as it does not also function as an “information content provider” for the portion of the statement or publication at issue. Even users or platforms that “re-post” or “publish” allegedly defamatory or damaging content created by a third-party are exempted from liability. See Barrett v. Rosenthal, 40 Cal. 4th 33, 62 (2006). Additionally, merely compiling false and/or misleading content created by others or otherwise providing a structured forum for dissemination and use of that information is not enough to confer liability. See, e.g. eBay, Inc. 99 Cal. App. 4th 816 (the critical issue is whether eBay acted as an information content provider with respect to the information claimed to be false or misleading); Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1122-1124 (9th Cir. 2003) (Matchmaker.com not liable for fake dating profile of celebrity who started receiving sexual and threatening emails and voicemails).

Recently, however, the Third Circuit appellate court found that Section 230 did not immunize and protect popular social media platform TikTok from suit arising from a ten-year old’s death following her attempting a “Blackout Challenge” based on videos she watched on her TikTok “For You Page.” See Anderson v. TikTok, Inc., 116 F.4th 180 (3rd Cir. 2024). TikTok is a social media platform where users can create, post, and view videos. Users can search for specific content or watch videos recommended by TikTok’s algorithm on their “For You Page” (FYP). This algorithm customizes video suggestions based on a range of factors, including a user’s age, demographics, interactions, and other metadata—not solely on direct user inputs. Some videos on TikTok’s FYP are “challenges” that encourage users to replicate the actions shown. One such video, the “Blackout Challenge,” urged users to choke themselves until passing out. TikTok’s algorithm recommended this video to a ten-year old girl who attempted it and tragically died from asphyxiation.

The deciding question was whether TikTok’s algorithm, and the inclusion of the “Blackout Challenge” video on a user’s FYP, crosses the threshold between an immune publisher and a liable creator. Plaintiff argued that TikTok’s algorithm “amalgamat[es] [] third-party videos,” which results in “an expressive product” that “communicates to users . . . that the curated stream of videos will be interesting to them.” The Third Circuit agreed finding that a platform’s algorithm reflecting “editorial judgments” about “compiling the third-party speech it wants in the way it wants” is the platform’s own “expressive product,” and therefore, TikTok’s algorithm, which recommended the Blackout Challenge on decedent’s FYP, was TikTok’s own “expressive activity.” As such, Section 230 did not bar claims against TikTok arising from TikTok’s recommendations via its FYP algorithm because Section 230 immunizes only information “provided by another,” and here, the claims concerned TikTok’s own expressive activity.

The Court was careful to note its conclusion was reached specifically due to TikTok’s promotion of the Blackout Challenge video on decedent’s FYP was not contingent on any specific user input, i.e. decedent did not search for and view the Blackout Video through TikTok’s search function. TikTok has certainly taken issue with the Court’s ruling contending that if websites lose § 230 protection whenever they exercise “editorial judgment” over the third-party content on their services, then the exception would swallow the rule. Perhaps websites seeking to avoid liability will refuse to sort, filter, categorize, curate, or take down any content, which may result in unfiltered and randomly placed objectionable material on the Internet. On the other hand, some websites may err on the side of removing any potentially harmful third-party speech, which would chill the proliferation of free expression on the web.

The aftermath of the ruling remains to be seen but for now social media platforms and interactive websites should take note and re-evaluate the purpose, scope, and mechanics of their user-engagement algorithms.

COPYRIGHT © 2024, STARK & STARK
For more on Social Media, visit the NLR Communications Media Internet section.

Ten Social Media and Content Ideas for Law Firms to Give Back This November

November is a perfect time to reflect, show gratitude, and give back because it encourages us to pause and appreciate the people and opportunities that have shaped our year. It’s an ideal moment to acknowledge those who’ve made a difference and to find meaningful ways to give back to the community.

For law firms, this season offers a special chance to not only spotlight your pro bono work, charitable initiatives and community service but also connect with followers on a deeper, more meaningful level. It’s about more than just sharing what your firm has done—it’s about inspiring others and showing the real impact of your efforts.

To make the most of this season of giving on social media, focus on content that aligns with the values of gratitude and generosity, while highlighting how your firm is making a difference. Here are some creative ideas to help your law firm stand out this November and beyond.

1. Spotlight Your Pro Bono Work with Personal Stories

Pro bono work is often one of the most meaningful ways a law firm gives back to the community. However, instead of just listing the number of pro bono hours completed or the organizations you’ve helped, humanize your content by telling personal stories from the lawyers who have contributed to these efforts.

Actionable Tip: Create a series of posts that focus on individual lawyers and the pro bono cases they’ve handled. Instead of vague descriptions, dive into what inspired the lawyer to take on the case, the challenges faced and the impact it had on the individual or community served. Pair each post with a high-quality photo of the lawyer or team involved to give it a personal touch. A quote from the lawyer about what the experience meant to them adds an extra layer of connection.

Example Post: For associate Jennifer Lee, taking on pro bono cases is more than just part of her job – it’s her way of giving back to the community in which she grew up. Jennifer recently helped a local non-profit secure affordable housing for low-income families, ensuring a roof over their heads for years to come. ‘To know that I played a small part in securing a future for these families is incredibly rewarding” she says.

2. Host a ‘Gratitude Week’ on Social Media

Thanksgiving isn’t just about turkey – it’s about gratitude. Use the week leading up to Thanksgiving to post daily about the things for which your firm is grateful. This could range from thanking clients for their trust to showing appreciation for your hardworking staff and giving a shoutout to the community partners and service providers you’ve worked with throughout the year.

Actionable Tip: Create a ‘Gratitude Week’ campaign where each day, your firm highlights something or someone for whom you’re thankful. Use real-life examples of client success stories, employee recognition and your firm’s milestones. Make sure to tie these posts back to your firm’s values and the relationships you’ve built.

Example Post: This #GratitudeWeek, we want to thank our incredible clients for their trust and partnership over the years. It’s because of your belief in us that we’re able to continue doing meaningful work in our community. Here’s to many more shared successes together!

3. Community Service Initiatives: Go Beyond the Office

Many firms participate in community service, but how often is it shared in a way that resonates with clients and potential clients on social media? During November, consider highlighting the volunteer work your team is doing, not just within the firm but outside of it – whether it’s serving at local food banks, participating in charity runs or supporting legal aid programs.

Actionable Tip: Take photos and videos of your team in action and use them to create visually engaging posts. Be sure to highlight why the firm chose to participate in the specific initiative and the positive outcomes. Consider creating an Instagram Story that chronicles the day of volunteering, offering a behind-the-scenes look at your firm’s involvement in the community.

Example Post: Today, members of our firm traded in their suits for aprons as we spent the morning serving meals at the local shelter. It’s a small way for us to give back to a community that has given us so much.

4. Client Appreciation: Personalized Thanks

November is an ideal time to publicly thank clients and partners for their trust and collaboration. Rather than generic messages, make it personal. Identify key clients you’ve worked closely with over the year and create posts that express genuine gratitude for the relationship you’ve built together.

Actionable Tip: Feature key clients (with their permission) in your posts and mention specific projects or deals you’ve worked on together. If the relationship spans several years, briefly touch on how it’s grown and what makes the partnership special. Including a photo of your team with the client adds a more personal touch.

Example Post: This Thanksgiving, we want to give a special thanks to our long-standing client, XYZ Corporation, for trusting us with their legal needs for over XX years. Our partnership has been a rewarding one, and we look forward to continuing our work together in the future. #ClientAppreciation #GivingThanks

5. Employee-Led Charity Drive: Showcase Your Team’s Efforts

Encourage your firm’s employees to participate in a November charity drive, including collecting food for a local food bank, gathering winter clothing for shelters or raising funds for a specific cause. Document the progress of the drive on social media to engage your audience and inspire others to give back as well.

Actionable Tip: Create a dedicated hashtag for your charity drive and encourage your team to post their contributions or experiences on their own social media platforms, using the hashtag. Share updates on your firm’s official accounts, showcasing both individual and collective efforts. At the end of the month, share the results of the drive, thanking everyone who participated and emphasizing the impact made.

Example Post: Our firm is having a November charity drive to support local families in need this holiday season. From now until Thanksgiving, we’ll be collecting non-perishable food items and winter clothing for donation. Thank you to everyone who’s already participated—let’s keep it going!

6. Employee “Give Thanks” Campaign

Encourage employees to share who they’re thankful for in their professional or personal lives and why. This approach humanizes your firm, builds community and emphasizes the importance of gratitude in both personal and professional relationships.

Actionable Tip: Ask employees to submit short quotes or stories expressing thanks to someone who has made a positive impact on their career or life. These posts can be shared throughout November, featuring the employee, their story, and the person they’re thanking (if appropriate). It’s a great way to celebrate meaningful connections.

Example Post: This Thanksgiving, I’m grateful for [Name], who has been an incredible mentor throughout my career. Their guidance and support have helped me grow both personally and professionally. #GiveThanks #GratitudeInAction #MentorshipMatters

7. Create a ‘Giving Back’ Campaign

A campaign that highlights your firm’s charitable efforts can inspire others while promoting your firm’s values. Instead of focusing on just video content, consider a series of posts that recap all the ways your firm has given back throughout the year, using images, stories and quotes from your employees.

Actionable Tip: Collect photos, quotes and stories from your pro bono work, community service initiatives, and charity partnerships. Create a series of posts featuring employee spotlights, quotes about why giving back matters, and highlights from key events. This approach allows you to showcase your firm’s impact in an authentic and engaging way across all social channels.

Example Post: It’s been an incredible year of giving back at [Firm Name], and we’re so proud of the difference we’ve made. From our pro bono cases to community service efforts, here’s a look back at the impact we’ve had together.

8. Pro Bono and Volunteer Pledge Challenge

Challenge your firm’s attorneys and staff to pledge a certain number of pro bono or volunteer hours during November. Turn this into a public commitment by sharing the pledges on social media, encouraging others to join in.

Actionable Tip: Create a branded graphic to share on social media where employees can submit their volunteer hours. Each week, share the progress of the firm’s collective volunteer hours and highlight individual contributions.

Example Post: “Our team has pledged over 500 hours of pro bono work and community service this month to give back to those who need it most. We’re proud of the commitment from our attorneys and staff to make a meaningful difference this November. #GivingBack #ProBonoPledge

9. Spotlight Pro Bono and Community Service Organizations

Showcasing the organizations your firm partners with is a great way to highlight the meaningful work being done while strengthening relationships with these groups. By sharing their missions and how your firm has contributed, you emphasize the impact of these partnerships and build credibility for your community efforts.

Actionable Tip: Dedicate posts to each organization your firm has supported through pro bono work or community service. Share a brief overview of their mission, the specific projects in which your firm has been involved and the positive outcomes. Include quotes or testimonials from the organizations themselves to further highlight the value of your partnership.

Example Post: We’re honored to work with [Organization Name] and support their mission to [brief description of their cause]. This year, our attorneys dedicated [number of hours] to help [project name or impact]. Thank you to [Organization Name] for letting us be a part of this important work!

10. Share a Photo Collage Highlighting Your Year of Giving Back

A photo collage is an excellent way to showcase your firm’s involvement in community service, pro bono work, and industry events throughout the year. This approach highlights your participation while giving well-deserved attention to the organizations you’ve supported, showing your firm’s commitment to making a positive impact.

Actionable Tip: Collect photos from various events your firm has supported over the past year, including volunteering efforts, pro bono projects, and industry-related activities. Create a collage or a series of posts that capture these moments, with captions that highlight the organizations and the meaningful work being done. This is a great way to visually engage your audience and reflect on your firm’s year of giving.

Example Post: We’ve had the privilege of supporting some incredible organizations this year. From pro bono cases to community service events, here’s a look at some of the highlights. We’re grateful for the chance to contribute to these important efforts.

Make Giving Part of Your Firm’s Culture

As your law firm embraces the spirit of giving this November, remember that these social media campaigns and content ideas are not just for the holidays, they can serve as the foundation of a year-round culture of giving. Whether it’s through pro bono work, community service or partnerships with local organizations, your firm’s commitment to giving back will resonate with your clients, employees and the community at large.

By turning these efforts into authentic, engaging social media content, you can showcase the values that define your firm while inspiring others to join in the spirit of giving.

Copyright © 2024, Stefanie M. Marrone. All Rights Reserved.

by: Stefanie M. Marrone of Stefanie Marrone Consulting

For more on Social Media Content, visit the NLR Law Office Management section.

NLRB General Counsel Takes Issue with “Stay-or-Pay” Employment Provisions

On October 7, 2024, the General Counsel (GC) for the National Labor Relations Board (NLRB) issued a 17-page memorandum urging the NLRB to find so-called “stay-or-pay” provisions unlawful and to impose harsh monetary penalties on employers that use such provisions.

On October 15, 2024, the U.S. Department of Labor (DOL) similarly announced that it will combat stay-or-pay clauses, among other provisions in employment agreements that the DOL describes as “coercive.”

What is a “stay-or-pay” provision?

A stay-or-pay provision is a requirement that an employee pay their employer for certain expenditures made for the employee’s benefit if the employee separates from employment within a specified period of time. Examples include training repayment agreement provisions (sometimes referred to as “TRAPs”), and provisions requiring employees to repay signing bonuses, moving expenses, or tuition reimbursement.

Why does the NLRB GC take issue with such provisions?

The GC’s latest memorandum is essentially an addendum to her prior memorandum criticizing non-compete covenants. In her view, stay-or-pay provisions violate the National Labor Relations Act (NLRA) because, as she interprets them, they are akin to non-compete covenants that unlawfully restrict employees from changing jobs.

We don’t have union employees. Does the NLRA even apply to our business?

Yes. Under Section 7 of the NLRA, employees in both unionized and nonunionized workforces have the right to join together in an effort to improve the terms and conditions of their employment. Specifically, Section 7 grants employees “the right to self-organization, to form, join, or assist labor organizations, to bargain collectively through representatives of their own choosing, and to engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection, or to refrain from any and all such activities.” Although certain types of workers, such as managers, supervisors, and independent contractors, are not entitled to such rights, Section 7 of the NLRA otherwise applies to all workers – whether unionized or not.

Do I really need to be concerned about the NLRB GC’s memorandum, and is it legally binding on my business?

The memorandum does not carry the force of a statute or regulation or case law. And it’s not even the stance of the NLRB. It’s essentially the NLRB GC’s guidance for the stance she is encouraging the NLRB to take with respect to these types of provisions.

That said, the memorandum is getting a lot of publicity in the press and online, which means employees who have heard about it may become skeptical about the enforceability and/or legality of their stay-or-pay provisions. This, in turn, may embolden employees to make a move, as they may be less fearful of their repayment obligations.

Will the NLRB GC’s memorandum apply prospectively, or will it also apply retroactively?

If the NLRB adopts the GC’s view, then yes, the memorandum would apply both to agreements entered into in the future, as well as to agreements already signed by employees and former employees. However, it affords employers a 60-day period from the date of the memorandum to “cure” any pre-existing stay-or-pay provisions before facing potential prosecution.

What are the potential consequences for my business if the NLRB adopts the GC’s view?

The GC expects employers to make employees whole, which may mean rescinding or rewriting the agreement or reimbursing former employees for sums repaid pursuant to their agreements. She goes further and suggests that an employer must compensate an employee if the employee can demonstrate that “(1) there was a vacancy available for a job with a better compensation package; (2) they were qualified for the job; and (3) they were discouraged from applying for or accepting the job because of the stay-or-pay provision.”

Is there any way the stay-or-pay provisions used by my business aren’t objectionable?

According to the GC, a stay-or-pay provision is reasonable if (a) it is entered into voluntarily in exchange for a benefit to the employee (as opposed to, for example, being a condition of employment), (b) the repayment amount is reasonable and specific, (c) the “stay” period is reasonable, and (d) it does not require repayment if the employee is terminated without cause.

We do use stay-or-pay provisions in our business. What should we do now?

Your course of action depends on your appetite for risk. At a minimum, we encourage you to consult with your company’s legal counsel to discuss the full import of the memorandum, risks, and options for your business, as there are a lot more details and nuances in those 17 pages than we can summarize here.

Going forward, some employers might consider alternatives to stay-or-pay provisions, such as stay bonuses (e.g., instead of paying a signing bonus and requiring recoupment if an employee leaves within two years following their date of hire, condition payment of the bonus on the employee staying for a period of two years.) Of course, the hitch with this approach is that it may impact the enforceability of non-compete or non-solicitation covenants in states that require up-front consideration to impose such covenants for at-will employees.

Notably, the GC’s 60-day moratorium takes us to December 6, which is a full month following Election Day. By now, employers are familiar with the makeup of the NLRB changing depending on the party occupying the White House, and if there is a shift in political power come November, that may result in a newly constituted NLRB with new policy preferences. With that in mind, some employers may opt to use a wait-and-see approach before making any changes – whether to existing agreements or retention strategies going forward.

 
© 2024 Much Shelist, P.C.
For more on Stay-or-Pay, visit the NLR Labor Employment section.

FTC Social Media Staff Report Suggests Enforcement Direction and Expectations

The FTC’s staff report summarizes how it views the operations of social media and video streaming companies. Of particular interest is the insight it gives into potential enforcement focus in the coming months, and into 2025. Of particular concern for the FTC in the report, issued last month, were the following:

  1. The high volume of information collected from users, including in ways they may not expect;
  2. Companies relying on advertising revenue that was based on use of that information;
  3. Use of AI over which the FTC felt users did not have control; and
  4. A gap in protection of teens (who are not subject to COPPA).

As part of its report, the FTC recommended changes in how social media companies collect and use personal information. Those recommendations stretched over five pages of the report and fell into four categories. Namely:

  1. Minimizing what information is collected to that which is needed to provide the company’s services. This recommendation also folded in concepts of data deletion and limits on information sharing.
  2. Putting guardrails around targeted digital advertising. Especially, the FTC indicated, if the targeting is based on use of sensitive personal information.
  3. Providing users with information about how automated decisions are being made. This would include not just transparency, the FTC indicated, but also having “more stringent testing and monitoring standards.”
  4. Using COPPA as a baseline in interactions with not only children under 13, but also as a model for interacting with teens.

The FTC also signaled in the report its support of federal privacy legislation that would (a) limit “surveillance” of users and (b) give consumers the type of rights that we are seeing passed at a state level.

Putting it into Practice: While this report was directed at social media companies, the FTC recommendations can be helpful for all entities. They signal the types of safeguards and restrictions that the agency is beginning to expect when companies are using large amounts of personal data, especially that of children and/or within automated decision-making tools like AI.

Listen to this post 

Copyright © 2024, Sheppard Mullin Richter & Hampton LLP.
For more on Social Media, visit the NLR Communications Media Internet section.