Managing Privacy and Cyber In A Pandemic: Lessons Learned For 2021 & Beyond

### Overview Presented at RSA Conference by Aaron Charfoos (Partner at Paul Hastings) and Ericka Johnson (Senior Associate at Squire Patton Boggs), this session examines the privacy and cybersecurity implications brought on by the COVID-19 pandemic and remote work. The talk focuses on the operational and legal complexities of collecting employee health data during workplace reopenings, the surge in cyber incidents and double-extortion ransomware attacks, the necessity of Written Information Security Plans (WISPs), and legal strategies to protect post-breach forensic reports from discovery in litigation.

### Key Topics - **Workplace Health Data Collection**: As organizations reopen, employers increasingly gather health data. Data presented indicates 76% of surveyed organizations ask employees to report positive diagnoses, 53% ask about personal travel, 35% inquire about household members, and 23% take physical temperatures. Additionally, about 50% adopted new work-from-home technologies, with nearly 60% bypassing or expediting privacy and security reviews. - **Legal & Regulatory Frameworks**: HIPAA generally does not apply to employer-collected workplace monitoring data, which is instead regulated under state unfair/deceptive practices acts, personal data laws, and guidance from agencies like the EEOC. Internationally, regulations such as the EU's GDPR and Canada's PIPEDA impose stricter obligations. U.S. state statutes (e.g., in Kansas, New York, South Carolina) and proposed federal bills (e.g., COVID Consumer Data Protection Act, Public Health Emergency Privacy Act) establish varying requirements for consent, transparency, and retention. - **Evolving Cyber Threat Landscape**: The pandemic exacerbated cyber attacks, particularly phishing and social engineering in remote environments. Threat actors have shifted towards double-extortion schemes—exfiltrating sensitive corporate, customer, or partner data before encrypting systems—increasing litigation risk and pressure to pay ransoms. - **Written Information Security Plans (WISPs)**: WISPs serve as an organization's playbook for controls, incident response, and disaster recovery. Regulators increasingly scrutinize them, and maintaining a recognized security program can provide legal benefits or affirmative defenses under state statutes such as Ohio Chapter 1354. - **OFAC/FinCEN Sanctions Guidance**: On October 1, 2020, OFAC and FinCEN issued parallel advisories regarding ransomware payments and sanctions violations under the Specially Designated Nationals and Blocked Persons list. Organizations must conduct rigorous, documented OFAC checks and coordinate closely with cyber insurance carriers. - **Discoverability of Forensic Reports**: Drawing from the *Capital One* and *Clark Hill* rulings, courts have deemed third-party forensic breach reports discoverable when prepared for business or remediation purposes rather than strictly in anticipation of litigation.

### Technical Details & Best Practices - **Data Minimization**: Organizations should assess whether data (such as temperature logs or detailed test results) truly needs to be stored, establish clear retention/deletion timelines, and consider delegating physical checks to third parties (e.g., building management) to limit exposure. - **Contracting with Testing Providers**: Ensure agreements with COVID-19 testing or vaccine clinic vendors do not mistakenly classify data under HIPAA if HIPAA compliance is not required, as misclassification incurs stricter disclosure and security liabilities. - **Ransomware & Sanctions Compliance**: Involve legal counsel on the incident response team to document due diligence through an OFAC check memo, review insurance policies for payment pre-approval and indemnification, and leverage threat intelligence or dark web monitoring to check actor leak sites. - **Protecting Privilege on Forensic Reports**: - Avoid relying on pre-existing Master Services Agreements (MSAs) or statements of work with existing IT vendors; retain a new, independent forensic firm solely for legal defense. - Draft statements of work specifying that the work is prepared exclusively at the direction of counsel in anticipation of litigation. - Pay for forensic engagements directly out of litigation budgets. - Strictly restrict dissemination of forensic reports, avoiding distribution to general business leadership, broad employee groups, or outside regulators/investigators. - Exclude forward-looking business or remediation recommendations from litigation forensic reports.

### Takeaways Organizations must proactively align pandemic-era health data collection with data minimization and state-level breach laws. When handling ransomware, entities must balance legal sanctions risks with cyber insurance requirements and comprehensive OFAC vetting. Finally, when investigating incidents, companies should structure IT forensic engagements deliberately through legal counsel to avoid producing self-incriminating technical reports that become discoverable to plaintiffs in subsequent litigation.