1
00:00:00,000 --> 00:00:04,560
Welcome to Breaking Down the Buzz, the podcast where we explore the thrilling world of tech
2
00:00:04,560 --> 00:00:09,760
industry leaders. From AI to the latest trends, we cut through the noise and decode the tech buzz
3
00:00:09,760 --> 00:00:12,320
and share our collected insights and insider knowledge.
4
00:00:22,160 --> 00:00:27,760
Welcome back to Breaking Down the Buzz. In this episode, I interviewed Nathan Cotkamp. Nathan
5
00:00:27,760 --> 00:00:32,320
Cotkamp is not only a distinguished attorney that specializes in healthcare regulations,
6
00:00:32,320 --> 00:00:37,840
but also a competitive cyclist. In today's episode, we'll navigate through the complexities of ransom
7
00:00:37,840 --> 00:00:43,200
wear in healthcare, explore legal strategies for cybersecurity, and even take a detour into how Nathan
8
00:00:43,200 --> 00:00:48,160
Cycling Discipline influences his professional resilience. Stay tuned for an enlightening
9
00:00:48,160 --> 00:00:52,960
conversation full of legal insights and life lessons from the fast link. Thank you for joining us.
10
00:00:52,960 --> 00:00:56,960
We're super excited to have you here on the podcast. I'd love it if you could tell us kind
11
00:00:56,960 --> 00:01:02,400
of about what you do. Sure. I'm Nathan Cotkamp and I am a healthcare attorney here in Richmond.
12
00:01:02,960 --> 00:01:09,520
I have a practice that covers pretty much the full array of healthcare providers,
13
00:01:10,160 --> 00:01:15,920
whether it's physician practices, hospitals, senior living facilities, and I'm kind of a jack
14
00:01:15,920 --> 00:01:23,280
of all trades. When things go off, I try and come in and fix problems. And otherwise, I deal with
15
00:01:23,280 --> 00:01:29,680
all the things that happen behind the desk when you come in and sign in. All that stuff is sort of
16
00:01:29,680 --> 00:01:36,320
in my bailiwick. Okay. So obviously, I'm a technologist and so we're going to talk a little bit
17
00:01:36,320 --> 00:01:43,040
about technology. And I know that you are involved from a legal perspective in how companies
18
00:01:44,000 --> 00:01:50,320
prepare for breaches and also respond to breaches, not from a technology perspective,
19
00:01:50,320 --> 00:01:55,760
but from a legal perspective. We'd love to hear about that. Right. What you mentioned is actually
20
00:01:55,760 --> 00:02:00,960
very important because I do get questions from my clients about the particulars of technology.
21
00:02:00,960 --> 00:02:06,080
And I said, look, I'm not a tech person. Go to synergy, go to somewhere else that is going to be
22
00:02:06,080 --> 00:02:10,560
able to help you in that manner. And it's actually a point of caution that I want to mention is,
23
00:02:11,200 --> 00:02:17,120
sometimes I've got clients who will come to me and they've said, oh, we've done an audit,
24
00:02:17,120 --> 00:02:23,200
we've worked with synergy, we've identified some issues. Here's the report. Can you help us now
25
00:02:23,200 --> 00:02:29,120
like keep it all privileged and confidential? I can't do that. You've already got a document
26
00:02:29,120 --> 00:02:34,720
that has a roadmap of your technological shortfalls. If you had come to me first,
27
00:02:34,720 --> 00:02:39,760
then we could do that investigation and the audit on privilege. So that is one caution for
28
00:02:39,760 --> 00:02:45,440
anybody who's out there. Now, there's a HIPAA requirement that you do audits as well. And those
29
00:02:45,440 --> 00:02:49,600
aren't protected, but some of the other stuff that's peripheral and that's sort of day to day
30
00:02:49,600 --> 00:02:54,720
operations, it really is important that they are working with counsel, not because we have any
31
00:02:54,720 --> 00:03:01,280
tech expertise, but rather to protect it legally. So if I'm preparing for a cybersecurity audit,
32
00:03:02,320 --> 00:03:07,520
what I really should be doing is calling in you or the counsel that I'm working with and saying,
33
00:03:07,520 --> 00:03:13,600
work with me alongside this audit to prepare for it. It's almost, it's hard to describe it,
34
00:03:13,600 --> 00:03:21,520
almost like in front. So we serve as the intermediary. So what happens is the client hires my law firm
35
00:03:21,520 --> 00:03:30,000
and we subcontract with the tech vendor. So the tech vendor answers to me as counsel,
36
00:03:30,000 --> 00:03:36,640
and then I advise my clients based on the tech response. But if you go directly to the tech
37
00:03:36,640 --> 00:03:41,280
vendor, you can enjoy privilege and you can't go back. There's no retroactive privilege.
38
00:03:41,280 --> 00:03:48,880
Okay. So how does that change things then? If I didn't do that and though, and my organization
39
00:03:48,880 --> 00:03:54,720
suffered a breach, what's the implications there? Well, there's a variety of things that can happen,
40
00:03:54,720 --> 00:04:02,240
but one of them is if you get into any sort of issues with the government and they are trying to
41
00:04:02,800 --> 00:04:10,160
get to the bottom of what happened, if you have counsel engaged, then you at least have an argument
42
00:04:10,160 --> 00:04:14,800
that they don't get to see all the work product and all the machinations that go into it.
43
00:04:14,800 --> 00:04:19,440
Because in many cases, what will happen is you'll get an audit and they identify some
44
00:04:20,160 --> 00:04:26,480
areas of potential problems. And the expectation is that you go and fix them. But if you've got a
45
00:04:26,480 --> 00:04:31,440
document that says, well, you've known about this vulnerability for a year and a half and you didn't
46
00:04:31,440 --> 00:04:37,760
fix it, that's a big, big problem. So at least having the layer of potential privilege, I say
47
00:04:37,760 --> 00:04:43,360
potential because it's not guaranteed. But at least you've got that argument to make as opposed to
48
00:04:43,360 --> 00:04:49,680
just having a roadmap for civil potential or potentially criminal penalties from the government.
49
00:04:50,400 --> 00:04:56,480
Wow. I think most people would not even consider that. Most organizations probably haven't thought
50
00:04:56,480 --> 00:05:04,480
about that at all. And so now, I'm going to say this out loud and I'm not speaking it into existence.
51
00:05:04,480 --> 00:05:10,320
Now I've been breached. What am I doing? First and foremost, you better have cyber insurance
52
00:05:10,320 --> 00:05:18,080
and you better call your cyber insurance company. Usually, that's the first call. A lot of times,
53
00:05:18,960 --> 00:05:24,880
I and my colleagues are the first call. And what we routinely do is say, okay, you need to get off
54
00:05:24,880 --> 00:05:29,680
the phone with me right now, go call your insurance company. And part of the reason that is just
55
00:05:29,680 --> 00:05:36,240
protecting your bottom line. Most, and this has been an evolution of cyber insurance over the last
56
00:05:36,240 --> 00:05:43,760
decade or so, most of them now use panel counsel in the same way that medical malpractice or liability,
57
00:05:43,760 --> 00:05:50,720
they've got a set of lawyers around the country, that's all they do for the health insurers.
58
00:05:51,440 --> 00:05:55,200
And so I'm happy to work with somebody, but they're going to be paying my rates
59
00:05:55,200 --> 00:06:02,000
as my rates as opposed to the discount rate. But it's also important you don't want to potentially
60
00:06:03,440 --> 00:06:09,920
miss the window for having a claim be qualified and things like that. But usually, my recommendation
61
00:06:09,920 --> 00:06:17,840
is get insurance involved immediately. For some of my clients, I will serve as a backstop or like
62
00:06:17,840 --> 00:06:25,040
a second opinion. So they'll get referred off to panel counsel and panel counsel do a bunch of stuff
63
00:06:25,040 --> 00:06:29,360
and it's confusing and they don't understand what's going on. The panel counsel is moving too fast,
64
00:06:29,360 --> 00:06:33,920
they've got too many other things, so they'll come to me and say, Nathan, what are they doing here?
65
00:06:33,920 --> 00:06:39,040
Can you explain this? And so that's the way that sometimes I support my clients is supplemental
66
00:06:39,680 --> 00:06:47,680
in that regard. And otherwise, one of the big things that my role entails with a breach is just
67
00:06:47,680 --> 00:06:55,440
helping clients calm down. It feels like the world is about to end and you feel like you're
68
00:06:55,440 --> 00:07:00,080
the target of something and it's personal and all these things. And as I'm sure you know too,
69
00:07:01,200 --> 00:07:09,280
the cyber criminals are ahead of the best technology, but I think it's the last time I saw
70
00:07:09,280 --> 00:07:14,240
it was like six months. So they're hitting everybody that they can when they find a vulnerability,
71
00:07:14,240 --> 00:07:19,920
do it. It's not personal. And so that's one of the things it's just like trying to keep them calm.
72
00:07:21,520 --> 00:07:28,720
There's a lot of value in that, there really is. Do you get involved at all in helping craft
73
00:07:28,720 --> 00:07:35,360
statements to the public? Oh yes. So you've probably received those letters that happen.
74
00:07:35,360 --> 00:07:40,880
We all do. Part of it is we sort of just get immune to them because we see so many. But yes,
75
00:07:40,880 --> 00:07:45,600
I get involved in drafting those. Sometimes there's media statements. Sometimes there's
76
00:07:45,600 --> 00:07:49,760
holding statements that we'll have for the media, depending on the nature of a breach.
77
00:07:49,760 --> 00:07:56,640
And some of those are pretty tricky because again, you don't want to be introducing
78
00:07:57,280 --> 00:08:01,680
potential liability for yourself based on what you're disclosing about the facts.
79
00:08:02,320 --> 00:08:06,800
But at the same time, particularly in healthcare, people are freaked out because
80
00:08:06,800 --> 00:08:14,000
health information is special in that it's everlasting. So like if you get a credit card
81
00:08:14,000 --> 00:08:18,960
stolen or your bank account gets hacked in some way, they just change the numbers.
82
00:08:18,960 --> 00:08:23,120
And you change the logins and all that stuff and you're fine. But you can't change your health
83
00:08:23,120 --> 00:08:29,600
history. That's with you forever. And so that's one of the reasons that health information is
84
00:08:29,600 --> 00:08:36,960
routinely when they do sort of the price list, if you will, on the black web, the dark web, health
85
00:08:36,960 --> 00:08:43,200
insurance is always way more valuable than financial information because of its evergreen
86
00:08:43,200 --> 00:08:53,280
qualities. Really? So how, and I'm not in this space at all, how I recognize that my medical
87
00:08:53,280 --> 00:08:59,280
history doesn't change, but how is that valuable to somebody? I'm not a cyber criminal, so I don't
88
00:08:59,280 --> 00:09:06,080
have it all dialed in. But what I can tell you is there are all sorts of schemes to use health
89
00:09:06,080 --> 00:09:12,480
information for like false billing. So if you've assembled somebody's medical record and you know
90
00:09:12,480 --> 00:09:19,600
about their, how does it make this up? You know they have diabetes, right? And so they are going to get
91
00:09:20,720 --> 00:09:27,120
insulin and other services on a routine basis. Well, somebody who hacks into that can produce
92
00:09:27,120 --> 00:09:33,520
bogus invoices, send them to pharmacies, get paid, you know, there's all sorts of things that they
93
00:09:33,520 --> 00:09:38,720
can do. But those are some of the ways it's mostly insurance fraud of various sorts. But
94
00:09:39,760 --> 00:09:45,840
theoretically it could be blackmail kinds of things. You know, I've given an example of all
95
00:09:45,840 --> 00:09:51,200
the connected devices. Like, can you imagine what would happen if you discovered that you have a
96
00:09:51,200 --> 00:09:57,520
connected pacemaker and someone's hacked it? And they're like, you pay up otherwise I shut your
97
00:09:57,520 --> 00:10:04,320
heart down. Wow. I'm not aware of that happening, but like I see the potential for that. And so
98
00:10:04,320 --> 00:10:10,640
that's another place where just the more connected we get, the more vulnerability there is. And
99
00:10:10,640 --> 00:10:18,080
yeah, yeah, you know, I use, so I wear a watch, you're an athlete also, so you probably do similar
100
00:10:18,080 --> 00:10:21,840
things. I wear this watch that tracks like literally everything, all the long as you know,
101
00:10:21,840 --> 00:10:29,280
my heart rate, my HRVs sort of all of that. And Gorman had a pretty good hack a few years ago.
102
00:10:29,280 --> 00:10:34,000
I don't think they were collecting the kind of health data that they're collecting on people
103
00:10:34,000 --> 00:10:41,440
now. And I always wonder like, what if they got hacked and someone got access to, you know,
104
00:10:41,440 --> 00:10:49,200
my resting heart rate, my kind of all this stuff. Where is the value in that? And I wonder if, you
105
00:10:49,200 --> 00:10:54,720
know, we're probably not that far away from, can somebody start to use biometric data that now
106
00:10:54,720 --> 00:11:01,760
they have had? My guess is that the value of that is not an independent, it's not in the inherent
107
00:11:01,760 --> 00:11:08,800
value of that. It's when you take that information, you somehow merge it with other data. That's where
108
00:11:08,800 --> 00:11:13,040
it probably becomes valuable. One of the interesting things that we deal with all the time is this
109
00:11:13,040 --> 00:11:17,520
perception that everything related to health is covered by HIPAA. Everyone knows about HIPAA.
110
00:11:17,520 --> 00:11:24,400
But your Gorman information is not covered by HIPAA. It's not health care related. And so people sort
111
00:11:26,400 --> 00:11:31,600
of project HIPAA on places that it doesn't belong. The other interesting thing about HIPAA that I
112
00:11:31,600 --> 00:11:36,000
think some of your listeners might be interested in is knowing that for all the things that we do
113
00:11:36,000 --> 00:11:40,640
about HIPAA and all the concerns that we have, there is no private right of action under HIPAA.
114
00:11:40,640 --> 00:11:47,840
So if you were a patient who's been the victim of a misuse of your health insurance, you think like
115
00:11:47,840 --> 00:11:54,160
HIPAA is this big structure, you know, you've got all these protections and rights, can I sue the
116
00:11:54,160 --> 00:12:00,880
provider for that? There's no mechanism for that. It's wild. The only recourse as a patient
117
00:12:00,880 --> 00:12:06,560
is to file a complaint with the government. It's like in a scenario where I have
118
00:12:07,360 --> 00:12:12,640
ample insurance and anthem gets hacked. I have no claim against anthem. That is interesting. I did
119
00:12:12,640 --> 00:12:19,680
not know that. You theoretically have a claim at the state level, but most of them are around the
120
00:12:19,680 --> 00:12:25,520
state or sort of around the country are capped at $1,000 damages. So as an individual, you're never
121
00:12:25,520 --> 00:12:30,240
going to find a lawyer who's going to go sue the anthem for $1,000. But what they do do is they
122
00:12:30,240 --> 00:12:36,160
take all the people and go with the class action. And so that's where you get to see these massive,
123
00:12:36,160 --> 00:12:43,360
massive lawsuits against folks who've been hacked. But that's not exactly for the HIPAA breach. It's
124
00:12:43,360 --> 00:12:50,480
more just a general, hey, my information is affected. You said something to me earlier
125
00:12:50,480 --> 00:12:56,480
when we were having coffee that was interesting. And that was that under HIPAA, you really have
126
00:12:56,480 --> 00:13:06,240
60 days to notify of a breach. I had no idea. Yeah. So it's no more than 60 days is what the
127
00:13:06,240 --> 00:13:13,920
reg says. And of course, you can't treat that as like a deadline, like a target. The notion is you
128
00:13:13,920 --> 00:13:19,760
got to move fast. And particularly in this data driven world that we live in, if you become known
129
00:13:19,760 --> 00:13:27,360
as an entity that's been sitting on a breach, you're going to get scoured in the regular media,
130
00:13:27,360 --> 00:13:34,960
social media or whatever. So really, the expectation is you've got to move quick. One of the things I
131
00:13:34,960 --> 00:13:40,160
see all the time with these business associate agreements that are in place between lawyers
132
00:13:40,160 --> 00:13:46,080
and providers, contractors and providers, and they'll ask for 24 hours notice, which makes great
133
00:13:46,080 --> 00:13:50,640
sense if you're the hospital. But if you're a big company, you'll even know up from down when you've
134
00:13:50,640 --> 00:13:55,920
got an alleged breach in 24 hours. Like it takes time. So it's a push and pull between
135
00:13:56,960 --> 00:14:03,200
needing to move fast, but needing to be moving carefully so that you're not causing undue alarm.
136
00:14:04,400 --> 00:14:08,000
Sometimes something that looks like a breach really isn't. So you don't want to be like
137
00:14:08,000 --> 00:14:16,080
crying wolf and things like that. So and then the flip side is these some of the worst situations are
138
00:14:16,080 --> 00:14:22,080
ransomware attacks lately, where they're not really going for the data. They're going for
139
00:14:22,080 --> 00:14:29,760
the fact that they've locked up the data. And so not always, but if a company pays the ransom,
140
00:14:29,760 --> 00:14:39,040
and they get their data unencrypted again, that at least needs to be treated as a breach.
141
00:14:40,080 --> 00:14:46,720
And you probably have a lousy argument that it wasn't a breach. But it's kind of a weird thing
142
00:14:46,720 --> 00:14:51,600
to have to tell you. You dated and leave. Well, you think it didn't leave. But you don't have.
143
00:14:51,600 --> 00:14:59,200
You've been given an assurance by a cyber criminal. So how much do you put faith in that?
144
00:14:59,200 --> 00:15:04,160
So those are some of the ones that are tricky for our clients to understand. Like, well,
145
00:15:04,160 --> 00:15:08,320
we got the data back was the problem. Like, that's just kind of how it is.
146
00:15:08,320 --> 00:15:14,080
Yeah, I mean, my questions would be, so there would be some things that we would recommend to do.
147
00:15:14,080 --> 00:15:19,680
First of all, we recommend that you apply labeling and tag all of your data, you know,
148
00:15:19,680 --> 00:15:25,760
so that if it leaves, it can't necessarily be opened. That doesn't change that your data is
149
00:15:25,760 --> 00:15:29,520
being held hostage. You know, just because you've, and this is a little bit technical,
150
00:15:29,520 --> 00:15:35,040
but just because you've applied data labeling and encryption to data doesn't mean you can't
151
00:15:35,040 --> 00:15:41,600
encrypt around it. Right. So, but my concern would always be the cyber criminal might tell
152
00:15:41,600 --> 00:15:48,000
me that my data didn't leave, but it may have left anyway. And what if now, you know, three years
153
00:15:48,000 --> 00:15:54,800
from now, it's hostage again. Yeah. Or they give it back, but they give it back with a warmer virus.
154
00:15:54,800 --> 00:16:02,880
Right. Deploys sometime later. You know, the other thing we've seen with ransomware is if you pay
155
00:16:02,880 --> 00:16:08,000
once, does that mean you're going to be willing to pay again? So like the repeat target. Right.
156
00:16:08,000 --> 00:16:12,640
So there's all sorts of things. I actually joke that it's not really a joke that it's really
157
00:16:12,640 --> 00:16:19,040
sort of a game theory issue. So the cyber criminals have to behave with some level of integrity.
158
00:16:19,040 --> 00:16:25,760
So for some portion of the folks that they're asking for ransom and get paid, they got to give the
159
00:16:25,760 --> 00:16:29,920
data back. Otherwise, the industry is going to talk and they're like, well, don't pay that,
160
00:16:29,920 --> 00:16:34,720
you'll never get it back. And so, you know, it's just sort of like this. How much do you pay? How
161
00:16:34,720 --> 00:16:39,600
much you not pay? What it's a complicated dance for sure. If you were going to guess,
162
00:16:41,600 --> 00:16:47,120
again, you can choose not to answer this, in that scenario, how often do people,
163
00:16:47,120 --> 00:16:53,920
do companies really pay versus try and do something else? I don't know because they don't,
164
00:16:53,920 --> 00:16:58,400
you know, it's one of these things where you kind of want to stay under the radar,
165
00:16:58,400 --> 00:17:04,720
but I do know that payment happens on a regular basis. I guess the one caution that I'd say is
166
00:17:04,720 --> 00:17:12,480
that there are lists of organizations that are mostly foreign or otherwise criminal,
167
00:17:12,480 --> 00:17:16,880
that if you make a payment to one of those, you're actually committing a federal crime.
168
00:17:16,880 --> 00:17:23,120
Really? So there's some extra reasons to be cautious about paying. And then there's like
169
00:17:23,120 --> 00:17:28,480
these payment brokers, which sort of blows my mind, but they're professionals who their job
170
00:17:28,480 --> 00:17:34,160
is to be an intermediary to negotiate the extent of the ransom between the good guys and the bad guys.
171
00:17:34,800 --> 00:17:42,160
It is mind blowing. Virtual repo, man. Yeah. Yeah. Yeah. But people do pay and some who pay
172
00:17:42,160 --> 00:17:47,520
get their information back, and that's one of the reasons why people keep, they keep paying.
173
00:17:47,520 --> 00:17:57,600
I had no idea. In the healthcare world, what constitutes a breach, and I'm going to caveat
174
00:17:57,600 --> 00:18:03,280
that with, you know, you might have someone gain access to your environment, but at what point do
175
00:18:03,280 --> 00:18:08,960
you really need to disclose that something's happened? Is there a magnitude of size? Or?
176
00:18:08,960 --> 00:18:17,680
There is a four question analysis that has to be done, a breach analysis. And the ultimate
177
00:18:17,680 --> 00:18:26,320
answer is whether or not there is a low probability of compromise. There are no bright lines in any
178
00:18:26,320 --> 00:18:33,840
of the four questions. And so it's like this sort of pushing and pulling and a little bit of Ouija
179
00:18:33,840 --> 00:18:41,200
board, a little bit of Venn diagram and some just sort of gut feeling. But the problem is the presumption
180
00:18:41,200 --> 00:18:46,320
is there's been a breach unless you prove otherwise. You're not trying to prove a breach,
181
00:18:46,320 --> 00:18:52,160
you're trying to prove no breach. And that's where you run into a challenge, like with the ransomware.
182
00:18:52,160 --> 00:19:00,320
So you've had your data compromised through encryption, it gets locked up. Can you really
183
00:19:00,320 --> 00:19:06,560
say that it wasn't compromised? You can't say that it hasn't. And so you can't overcome the
184
00:19:06,560 --> 00:19:12,720
presumption in the law. And that's why you end up having to notify several thousands, millions, you know.
185
00:19:12,720 --> 00:19:19,600
Yeah. I mean, it's big numbers. It's certainly every CIO is worse nightmare. And it's every CEO is
186
00:19:19,600 --> 00:19:23,680
worse nightmare. Probably five minutes. It's everybody's worse nightmare. No one wants to
187
00:19:23,680 --> 00:19:28,880
end up on the front page for something like that. You know, it's just none of us to. Not at all.
188
00:19:28,880 --> 00:19:33,040
Yeah. Well, it's interesting. I think, you know, for as much as we're talking about tech,
189
00:19:34,400 --> 00:19:39,680
we have to talk about people. Right. Because when you when you get down to the reality of
190
00:19:39,680 --> 00:19:47,600
most breaches, it's actually a person issue. You know, getting through technology, I don't do this,
191
00:19:47,600 --> 00:19:53,200
but that's hard stuff. Like, you're having to compete with the bad guys are competing with the
192
00:19:53,200 --> 00:19:59,120
good guys. But human fallibility is out there in unlimited quantities. And that's why we see
193
00:19:59,120 --> 00:20:05,120
phishing. That's why we see all these other things. That's not going away. So one of the things that
194
00:20:06,080 --> 00:20:12,080
I think organizations need to be really mindful of is, I don't care how good your tech is. If your
195
00:20:12,080 --> 00:20:18,560
people aren't watching. Agreed. It's virtually useless. Agreed. Agreed. And then almost every
196
00:20:18,560 --> 00:20:27,120
security issue that we deal with from our customers is the result of a human being not paying attention
197
00:20:27,120 --> 00:20:35,280
or we were starting to see this now MFA fatigue, where you you have to, you know, do a second
198
00:20:35,280 --> 00:20:41,280
factor for everything. And it's happening so often that people are just, yep, yep, I did it, I did
199
00:20:41,280 --> 00:20:50,800
it. And when in reality, it's not them. So what we're starting to see is, is with MFA, for the
200
00:20:50,800 --> 00:20:56,160
most part, we work with Microsoft technology, when that prompt comes up, it tells you the actual
201
00:20:56,800 --> 00:21:02,880
location of where the person is attempting to sign in from. So you can say, okay, no, I'm not in
202
00:21:02,880 --> 00:21:09,520
Phoenix, Arizona right now. This is not me. Yeah. Because that's what's happening. People are just
203
00:21:09,520 --> 00:21:18,640
yep, yep, yep. Well, as a real live example of the magnitude of the issue. I have a former
204
00:21:18,640 --> 00:21:29,520
colleague who was the chair of our cyber legal team. And he got the yellow screen experience
205
00:21:30,320 --> 00:21:35,760
because he was on a webinar, he was multitasking, he was just trying to clean out his inbox. And so
206
00:21:35,760 --> 00:21:41,520
he's just going through stuff. And he clicked on something that was fishing. It was actually a,
207
00:21:41,520 --> 00:21:45,200
you know, was one of those intentional phishings where they were trying to do education within
208
00:21:45,200 --> 00:21:52,800
the firm. And so you think of all the people who would be ready to know what's out there and to see
209
00:21:53,840 --> 00:22:01,200
the phishing coming. And it's because he was distracted. So it's so easy to just let your
210
00:22:01,200 --> 00:22:05,840
guard down. Yeah, particularly if you're on your phone. Yeah, it's very, very easy on your phone to
211
00:22:05,840 --> 00:22:09,840
just say, oh, yeah, let me look at this PDF for this, whatever it is, it's been sent to me. I
212
00:22:09,840 --> 00:22:16,480
mean, I personally don't open any attachments unless I know who they're coming from because it's
213
00:22:17,680 --> 00:22:24,160
such a big deal. And that's undoubtedly a best practice. Again, we spend so much time talking
214
00:22:24,160 --> 00:22:31,520
about thinking about documenting, contracting around all the technology. And it is the people
215
00:22:32,080 --> 00:22:38,000
part is so important. Yes, yeah, I agree. I'm going to pivot on you for just just a minute here,
216
00:22:38,800 --> 00:22:45,840
because this is a question that really I have being a business owner. How do you feel about
217
00:22:45,840 --> 00:22:52,800
AI in the legal world? And how does that impact you? Well, either the sky is falling or it's a
218
00:22:52,800 --> 00:22:59,760
wonderful addition to what we do is layers. I think it's somewhere in between. And as we were
219
00:22:59,760 --> 00:23:08,880
talking at Coffee, we I think the best way to approach AI in the legal field is to think of it
220
00:23:08,880 --> 00:23:16,960
as a tool. It's not a solution. It's kind of like having another associate when it's not doesn't have
221
00:23:16,960 --> 00:23:23,360
a heartbeat. But in the same way that that when younger attorneys bring me a work product, it's
222
00:23:23,360 --> 00:23:31,600
my job to check it. Right. I don't know where AI is pulling its case law from where it's pulling
223
00:23:31,600 --> 00:23:40,080
its information. It's only as good as as the foundation of data that it's consuming and processing.
224
00:23:40,080 --> 00:23:46,080
So we've already seen cases where attorneys have been reprimanded for just filing something that
225
00:23:46,080 --> 00:23:52,800
they produce through AI. And that's that even happen? Like, I get how it happens. But how as an
226
00:23:52,800 --> 00:24:00,960
attorney, do you file something that you haven't verified? Well, I think some of it can be a
227
00:24:00,960 --> 00:24:09,360
workload issue. Okay, some of it is just lazy lawyering. Some of it could be like extreme
228
00:24:09,360 --> 00:24:13,440
fee sensitivity where the client's just like, Hey, I just want you to file something, just get
229
00:24:13,440 --> 00:24:20,160
us in a court, do whatever. And if you're in that situation, you're the lawyer, you're not really
230
00:24:20,160 --> 00:24:28,400
thinking, Well, I'm actually, you know, a custodian of the law, like an agent of the court or whatever
231
00:24:28,400 --> 00:24:34,640
that term is. You're not thinking about that when you've got your client hounding you to just get
232
00:24:34,640 --> 00:24:40,480
something filed and get it out the door. And so I think that's how it sometimes happens.
233
00:24:40,480 --> 00:24:50,400
I completely understand the sanctions from courts that say, I don't care what your pressure is.
234
00:24:50,400 --> 00:24:56,000
Yeah, particularly if you're in a law firm, the assumption is you've got other people to check
235
00:24:56,000 --> 00:25:01,120
it. So if you're a solo practitioner, maybe there's a little bit of leeway there. But there's usually
236
00:25:01,120 --> 00:25:05,600
not a whole lot of grace given when you've got colleagues who you can say, Hey, can you read
237
00:25:05,600 --> 00:25:11,200
this brief of mine? That's the expectation. That's why you work in a firm. Right, right. I think of
238
00:25:11,200 --> 00:25:17,760
AI the same way. You know, we use AI every day, we certainly use it in our marketing organization,
239
00:25:17,760 --> 00:25:26,880
and we use it for a lot of things. My opinion on it is AI today, and I'm talking about tools like
240
00:25:26,880 --> 00:25:33,760
chat GPT or even Microsoft 365 co-pilot is like a really good intern. Like you could have an intern
241
00:25:33,760 --> 00:25:37,520
that's really, really smart, and they can do really good research and they can put together
242
00:25:37,520 --> 00:25:42,320
something that's really great for you. But in the end, you got to read it, you got to check it,
243
00:25:42,320 --> 00:25:46,240
and you're going to have to fix it because they're an intern, they don't have the business
244
00:25:46,240 --> 00:25:51,040
experience that you do that, you know, they don't necessarily know what to look for, except for what
245
00:25:51,040 --> 00:25:58,640
they've been told to look for. And AI is great, but human intuition is a real thing. And you can
246
00:25:58,640 --> 00:26:03,120
read something and say what that, but just I don't know why it doesn't feel right, but it
247
00:26:03,120 --> 00:26:08,480
doesn't feel right. Well, an AI is designed to replicate. And so you could be perpetually
248
00:26:09,200 --> 00:26:15,280
replicating something that's just a lousy model or it's inefficient or things that if you were to
249
00:26:15,280 --> 00:26:23,760
just step back and look at it with a human brain, you might say, isn't time to evolve that document,
250
00:26:23,760 --> 00:26:28,720
that process, that legal theory, whatever, but you're not going to get that. You'll never get that.
251
00:26:28,720 --> 00:26:37,200
Right, right. And it can only replicate what it's been trained on. Right. So the interesting place
252
00:26:37,200 --> 00:26:43,840
for me in that in the legal world is, you know, there are all kinds of cases that were the first
253
00:26:43,840 --> 00:26:48,800
of their time. AI is never going to replicate that because it's never going to think about, okay,
254
00:26:48,800 --> 00:26:53,680
well, that law was written 100 years ago. Maybe we need to change it or maybe, you know, and I'm
255
00:26:53,680 --> 00:26:59,360
not a lawyer, I'm making stuff up here, but it just feels to me like the opportunity for everything
256
00:26:59,360 --> 00:27:06,640
to look the same and for us to remain stagnant as a society is real. Well, you want the law to
257
00:27:06,640 --> 00:27:15,040
evolve. And that's just part of how it's that never ending evolution towards perfection,
258
00:27:15,040 --> 00:27:18,960
which of course will never be achieved, but it is supposed to be getting incrementally better.
259
00:27:18,960 --> 00:27:24,000
Right. And the only way it's going to get incrementally better is when somebody does
260
00:27:24,000 --> 00:27:28,640
something like look at a, I mean, we're seeing this right now, right? You look at a
261
00:27:29,760 --> 00:27:36,400
US Constitution amendment and you're like, huh, I wonder if we've all been looking at that wrong.
262
00:27:36,400 --> 00:27:42,320
Right. And let's see if we can make this particular argument. AI is never going to do that.
263
00:27:42,320 --> 00:27:51,200
Right. Ever. So I think there is a component of the law that's just going to depend on brains
264
00:27:51,760 --> 00:27:56,800
forever. Right. And that's a good thing. That is a good thing. As a lawyer, that's a good thing.
265
00:27:56,800 --> 00:28:03,120
Yes. Yes. And I think it's going to potentially make things a little bit easier for you, but it's
266
00:28:03,120 --> 00:28:09,760
not going to change what you do. You're still going to. No, it tends to be a situation where it just
267
00:28:09,760 --> 00:28:15,440
shifts some of the focus and shifts where the workload ends up being. I don't think it's going
268
00:28:15,440 --> 00:28:22,880
to back off. And if anything, what it may do is expand the volume of work because it's so much
269
00:28:22,880 --> 00:28:27,840
easier to produce things like a brief. Right. And we just get more of them. And longer.
270
00:28:27,840 --> 00:28:39,200
And longer. Exactly. And so we may end up what we lose in sort of efficiency as lawyers when they
271
00:28:39,200 --> 00:28:45,040
pick up in volume just because more they are, it's easier to do. Right. Right. Yeah. So, you know,
272
00:28:45,040 --> 00:28:50,720
the prevailing question is, is AI going to take jobs away? And what you're saying is, for lawyers,
273
00:28:50,720 --> 00:28:57,520
probably not. Yeah. Probably not. We're pretty good at keeping job security as a profession.
274
00:28:57,520 --> 00:29:01,120
I would agree with that. Yes. Because as soon as there's one involved, there's.
275
00:29:01,120 --> 00:29:05,680
Yeah. For better or for worse. Like rabbits. I try not to practice that way, but it is kind of a
276
00:29:05,680 --> 00:29:11,760
a feature of the practice. Yes. Yes. Yes. Yes. I get it. Awesome. Well, thank you. I really appreciate
277
00:29:11,760 --> 00:29:16,080
coming in to chat. Oh, it's a pleasure to chat. Yeah. It's super fun. All right. Well, just, you
278
00:29:16,080 --> 00:29:20,640
know, let's keep in touch. And hopefully we don't have to work together on anything because that
279
00:29:20,640 --> 00:29:25,120
means somebody's been breached, likely. Or at least we're working on the front end. Yes, exactly.
280
00:29:25,120 --> 00:29:36,400
That would be delightful. Yes. Awesome. Thank you. You bet. Thank you.
00:00:00,000 --> 00:00:04,560
Welcome to Breaking Down the Buzz, the podcast where we explore the thrilling world of tech
2
00:00:04,560 --> 00:00:09,760
industry leaders. From AI to the latest trends, we cut through the noise and decode the tech buzz
3
00:00:09,760 --> 00:00:12,320
and share our collected insights and insider knowledge.
4
00:00:22,160 --> 00:00:27,760
Welcome back to Breaking Down the Buzz. In this episode, I interviewed Nathan Cotkamp. Nathan
5
00:00:27,760 --> 00:00:32,320
Cotkamp is not only a distinguished attorney that specializes in healthcare regulations,
6
00:00:32,320 --> 00:00:37,840
but also a competitive cyclist. In today's episode, we'll navigate through the complexities of ransom
7
00:00:37,840 --> 00:00:43,200
wear in healthcare, explore legal strategies for cybersecurity, and even take a detour into how Nathan
8
00:00:43,200 --> 00:00:48,160
Cycling Discipline influences his professional resilience. Stay tuned for an enlightening
9
00:00:48,160 --> 00:00:52,960
conversation full of legal insights and life lessons from the fast link. Thank you for joining us.
10
00:00:52,960 --> 00:00:56,960
We're super excited to have you here on the podcast. I'd love it if you could tell us kind
11
00:00:56,960 --> 00:01:02,400
of about what you do. Sure. I'm Nathan Cotkamp and I am a healthcare attorney here in Richmond.
12
00:01:02,960 --> 00:01:09,520
I have a practice that covers pretty much the full array of healthcare providers,
13
00:01:10,160 --> 00:01:15,920
whether it's physician practices, hospitals, senior living facilities, and I'm kind of a jack
14
00:01:15,920 --> 00:01:23,280
of all trades. When things go off, I try and come in and fix problems. And otherwise, I deal with
15
00:01:23,280 --> 00:01:29,680
all the things that happen behind the desk when you come in and sign in. All that stuff is sort of
16
00:01:29,680 --> 00:01:36,320
in my bailiwick. Okay. So obviously, I'm a technologist and so we're going to talk a little bit
17
00:01:36,320 --> 00:01:43,040
about technology. And I know that you are involved from a legal perspective in how companies
18
00:01:44,000 --> 00:01:50,320
prepare for breaches and also respond to breaches, not from a technology perspective,
19
00:01:50,320 --> 00:01:55,760
but from a legal perspective. We'd love to hear about that. Right. What you mentioned is actually
20
00:01:55,760 --> 00:02:00,960
very important because I do get questions from my clients about the particulars of technology.
21
00:02:00,960 --> 00:02:06,080
And I said, look, I'm not a tech person. Go to synergy, go to somewhere else that is going to be
22
00:02:06,080 --> 00:02:10,560
able to help you in that manner. And it's actually a point of caution that I want to mention is,
23
00:02:11,200 --> 00:02:17,120
sometimes I've got clients who will come to me and they've said, oh, we've done an audit,
24
00:02:17,120 --> 00:02:23,200
we've worked with synergy, we've identified some issues. Here's the report. Can you help us now
25
00:02:23,200 --> 00:02:29,120
like keep it all privileged and confidential? I can't do that. You've already got a document
26
00:02:29,120 --> 00:02:34,720
that has a roadmap of your technological shortfalls. If you had come to me first,
27
00:02:34,720 --> 00:02:39,760
then we could do that investigation and the audit on privilege. So that is one caution for
28
00:02:39,760 --> 00:02:45,440
anybody who's out there. Now, there's a HIPAA requirement that you do audits as well. And those
29
00:02:45,440 --> 00:02:49,600
aren't protected, but some of the other stuff that's peripheral and that's sort of day to day
30
00:02:49,600 --> 00:02:54,720
operations, it really is important that they are working with counsel, not because we have any
31
00:02:54,720 --> 00:03:01,280
tech expertise, but rather to protect it legally. So if I'm preparing for a cybersecurity audit,
32
00:03:02,320 --> 00:03:07,520
what I really should be doing is calling in you or the counsel that I'm working with and saying,
33
00:03:07,520 --> 00:03:13,600
work with me alongside this audit to prepare for it. It's almost, it's hard to describe it,
34
00:03:13,600 --> 00:03:21,520
almost like in front. So we serve as the intermediary. So what happens is the client hires my law firm
35
00:03:21,520 --> 00:03:30,000
and we subcontract with the tech vendor. So the tech vendor answers to me as counsel,
36
00:03:30,000 --> 00:03:36,640
and then I advise my clients based on the tech response. But if you go directly to the tech
37
00:03:36,640 --> 00:03:41,280
vendor, you can enjoy privilege and you can't go back. There's no retroactive privilege.
38
00:03:41,280 --> 00:03:48,880
Okay. So how does that change things then? If I didn't do that and though, and my organization
39
00:03:48,880 --> 00:03:54,720
suffered a breach, what's the implications there? Well, there's a variety of things that can happen,
40
00:03:54,720 --> 00:04:02,240
but one of them is if you get into any sort of issues with the government and they are trying to
41
00:04:02,800 --> 00:04:10,160
get to the bottom of what happened, if you have counsel engaged, then you at least have an argument
42
00:04:10,160 --> 00:04:14,800
that they don't get to see all the work product and all the machinations that go into it.
43
00:04:14,800 --> 00:04:19,440
Because in many cases, what will happen is you'll get an audit and they identify some
44
00:04:20,160 --> 00:04:26,480
areas of potential problems. And the expectation is that you go and fix them. But if you've got a
45
00:04:26,480 --> 00:04:31,440
document that says, well, you've known about this vulnerability for a year and a half and you didn't
46
00:04:31,440 --> 00:04:37,760
fix it, that's a big, big problem. So at least having the layer of potential privilege, I say
47
00:04:37,760 --> 00:04:43,360
potential because it's not guaranteed. But at least you've got that argument to make as opposed to
48
00:04:43,360 --> 00:04:49,680
just having a roadmap for civil potential or potentially criminal penalties from the government.
49
00:04:50,400 --> 00:04:56,480
Wow. I think most people would not even consider that. Most organizations probably haven't thought
50
00:04:56,480 --> 00:05:04,480
about that at all. And so now, I'm going to say this out loud and I'm not speaking it into existence.
51
00:05:04,480 --> 00:05:10,320
Now I've been breached. What am I doing? First and foremost, you better have cyber insurance
52
00:05:10,320 --> 00:05:18,080
and you better call your cyber insurance company. Usually, that's the first call. A lot of times,
53
00:05:18,960 --> 00:05:24,880
I and my colleagues are the first call. And what we routinely do is say, okay, you need to get off
54
00:05:24,880 --> 00:05:29,680
the phone with me right now, go call your insurance company. And part of the reason that is just
55
00:05:29,680 --> 00:05:36,240
protecting your bottom line. Most, and this has been an evolution of cyber insurance over the last
56
00:05:36,240 --> 00:05:43,760
decade or so, most of them now use panel counsel in the same way that medical malpractice or liability,
57
00:05:43,760 --> 00:05:50,720
they've got a set of lawyers around the country, that's all they do for the health insurers.
58
00:05:51,440 --> 00:05:55,200
And so I'm happy to work with somebody, but they're going to be paying my rates
59
00:05:55,200 --> 00:06:02,000
as my rates as opposed to the discount rate. But it's also important you don't want to potentially
60
00:06:03,440 --> 00:06:09,920
miss the window for having a claim be qualified and things like that. But usually, my recommendation
61
00:06:09,920 --> 00:06:17,840
is get insurance involved immediately. For some of my clients, I will serve as a backstop or like
62
00:06:17,840 --> 00:06:25,040
a second opinion. So they'll get referred off to panel counsel and panel counsel do a bunch of stuff
63
00:06:25,040 --> 00:06:29,360
and it's confusing and they don't understand what's going on. The panel counsel is moving too fast,
64
00:06:29,360 --> 00:06:33,920
they've got too many other things, so they'll come to me and say, Nathan, what are they doing here?
65
00:06:33,920 --> 00:06:39,040
Can you explain this? And so that's the way that sometimes I support my clients is supplemental
66
00:06:39,680 --> 00:06:47,680
in that regard. And otherwise, one of the big things that my role entails with a breach is just
67
00:06:47,680 --> 00:06:55,440
helping clients calm down. It feels like the world is about to end and you feel like you're
68
00:06:55,440 --> 00:07:00,080
the target of something and it's personal and all these things. And as I'm sure you know too,
69
00:07:01,200 --> 00:07:09,280
the cyber criminals are ahead of the best technology, but I think it's the last time I saw
70
00:07:09,280 --> 00:07:14,240
it was like six months. So they're hitting everybody that they can when they find a vulnerability,
71
00:07:14,240 --> 00:07:19,920
do it. It's not personal. And so that's one of the things it's just like trying to keep them calm.
72
00:07:21,520 --> 00:07:28,720
There's a lot of value in that, there really is. Do you get involved at all in helping craft
73
00:07:28,720 --> 00:07:35,360
statements to the public? Oh yes. So you've probably received those letters that happen.
74
00:07:35,360 --> 00:07:40,880
We all do. Part of it is we sort of just get immune to them because we see so many. But yes,
75
00:07:40,880 --> 00:07:45,600
I get involved in drafting those. Sometimes there's media statements. Sometimes there's
76
00:07:45,600 --> 00:07:49,760
holding statements that we'll have for the media, depending on the nature of a breach.
77
00:07:49,760 --> 00:07:56,640
And some of those are pretty tricky because again, you don't want to be introducing
78
00:07:57,280 --> 00:08:01,680
potential liability for yourself based on what you're disclosing about the facts.
79
00:08:02,320 --> 00:08:06,800
But at the same time, particularly in healthcare, people are freaked out because
80
00:08:06,800 --> 00:08:14,000
health information is special in that it's everlasting. So like if you get a credit card
81
00:08:14,000 --> 00:08:18,960
stolen or your bank account gets hacked in some way, they just change the numbers.
82
00:08:18,960 --> 00:08:23,120
And you change the logins and all that stuff and you're fine. But you can't change your health
83
00:08:23,120 --> 00:08:29,600
history. That's with you forever. And so that's one of the reasons that health information is
84
00:08:29,600 --> 00:08:36,960
routinely when they do sort of the price list, if you will, on the black web, the dark web, health
85
00:08:36,960 --> 00:08:43,200
insurance is always way more valuable than financial information because of its evergreen
86
00:08:43,200 --> 00:08:53,280
qualities. Really? So how, and I'm not in this space at all, how I recognize that my medical
87
00:08:53,280 --> 00:08:59,280
history doesn't change, but how is that valuable to somebody? I'm not a cyber criminal, so I don't
88
00:08:59,280 --> 00:09:06,080
have it all dialed in. But what I can tell you is there are all sorts of schemes to use health
89
00:09:06,080 --> 00:09:12,480
information for like false billing. So if you've assembled somebody's medical record and you know
90
00:09:12,480 --> 00:09:19,600
about their, how does it make this up? You know they have diabetes, right? And so they are going to get
91
00:09:20,720 --> 00:09:27,120
insulin and other services on a routine basis. Well, somebody who hacks into that can produce
92
00:09:27,120 --> 00:09:33,520
bogus invoices, send them to pharmacies, get paid, you know, there's all sorts of things that they
93
00:09:33,520 --> 00:09:38,720
can do. But those are some of the ways it's mostly insurance fraud of various sorts. But
94
00:09:39,760 --> 00:09:45,840
theoretically it could be blackmail kinds of things. You know, I've given an example of all
95
00:09:45,840 --> 00:09:51,200
the connected devices. Like, can you imagine what would happen if you discovered that you have a
96
00:09:51,200 --> 00:09:57,520
connected pacemaker and someone's hacked it? And they're like, you pay up otherwise I shut your
97
00:09:57,520 --> 00:10:04,320
heart down. Wow. I'm not aware of that happening, but like I see the potential for that. And so
98
00:10:04,320 --> 00:10:10,640
that's another place where just the more connected we get, the more vulnerability there is. And
99
00:10:10,640 --> 00:10:18,080
yeah, yeah, you know, I use, so I wear a watch, you're an athlete also, so you probably do similar
100
00:10:18,080 --> 00:10:21,840
things. I wear this watch that tracks like literally everything, all the long as you know,
101
00:10:21,840 --> 00:10:29,280
my heart rate, my HRVs sort of all of that. And Gorman had a pretty good hack a few years ago.
102
00:10:29,280 --> 00:10:34,000
I don't think they were collecting the kind of health data that they're collecting on people
103
00:10:34,000 --> 00:10:41,440
now. And I always wonder like, what if they got hacked and someone got access to, you know,
104
00:10:41,440 --> 00:10:49,200
my resting heart rate, my kind of all this stuff. Where is the value in that? And I wonder if, you
105
00:10:49,200 --> 00:10:54,720
know, we're probably not that far away from, can somebody start to use biometric data that now
106
00:10:54,720 --> 00:11:01,760
they have had? My guess is that the value of that is not an independent, it's not in the inherent
107
00:11:01,760 --> 00:11:08,800
value of that. It's when you take that information, you somehow merge it with other data. That's where
108
00:11:08,800 --> 00:11:13,040
it probably becomes valuable. One of the interesting things that we deal with all the time is this
109
00:11:13,040 --> 00:11:17,520
perception that everything related to health is covered by HIPAA. Everyone knows about HIPAA.
110
00:11:17,520 --> 00:11:24,400
But your Gorman information is not covered by HIPAA. It's not health care related. And so people sort
111
00:11:26,400 --> 00:11:31,600
of project HIPAA on places that it doesn't belong. The other interesting thing about HIPAA that I
112
00:11:31,600 --> 00:11:36,000
think some of your listeners might be interested in is knowing that for all the things that we do
113
00:11:36,000 --> 00:11:40,640
about HIPAA and all the concerns that we have, there is no private right of action under HIPAA.
114
00:11:40,640 --> 00:11:47,840
So if you were a patient who's been the victim of a misuse of your health insurance, you think like
115
00:11:47,840 --> 00:11:54,160
HIPAA is this big structure, you know, you've got all these protections and rights, can I sue the
116
00:11:54,160 --> 00:12:00,880
provider for that? There's no mechanism for that. It's wild. The only recourse as a patient
117
00:12:00,880 --> 00:12:06,560
is to file a complaint with the government. It's like in a scenario where I have
118
00:12:07,360 --> 00:12:12,640
ample insurance and anthem gets hacked. I have no claim against anthem. That is interesting. I did
119
00:12:12,640 --> 00:12:19,680
not know that. You theoretically have a claim at the state level, but most of them are around the
120
00:12:19,680 --> 00:12:25,520
state or sort of around the country are capped at $1,000 damages. So as an individual, you're never
121
00:12:25,520 --> 00:12:30,240
going to find a lawyer who's going to go sue the anthem for $1,000. But what they do do is they
122
00:12:30,240 --> 00:12:36,160
take all the people and go with the class action. And so that's where you get to see these massive,
123
00:12:36,160 --> 00:12:43,360
massive lawsuits against folks who've been hacked. But that's not exactly for the HIPAA breach. It's
124
00:12:43,360 --> 00:12:50,480
more just a general, hey, my information is affected. You said something to me earlier
125
00:12:50,480 --> 00:12:56,480
when we were having coffee that was interesting. And that was that under HIPAA, you really have
126
00:12:56,480 --> 00:13:06,240
60 days to notify of a breach. I had no idea. Yeah. So it's no more than 60 days is what the
127
00:13:06,240 --> 00:13:13,920
reg says. And of course, you can't treat that as like a deadline, like a target. The notion is you
128
00:13:13,920 --> 00:13:19,760
got to move fast. And particularly in this data driven world that we live in, if you become known
129
00:13:19,760 --> 00:13:27,360
as an entity that's been sitting on a breach, you're going to get scoured in the regular media,
130
00:13:27,360 --> 00:13:34,960
social media or whatever. So really, the expectation is you've got to move quick. One of the things I
131
00:13:34,960 --> 00:13:40,160
see all the time with these business associate agreements that are in place between lawyers
132
00:13:40,160 --> 00:13:46,080
and providers, contractors and providers, and they'll ask for 24 hours notice, which makes great
133
00:13:46,080 --> 00:13:50,640
sense if you're the hospital. But if you're a big company, you'll even know up from down when you've
134
00:13:50,640 --> 00:13:55,920
got an alleged breach in 24 hours. Like it takes time. So it's a push and pull between
135
00:13:56,960 --> 00:14:03,200
needing to move fast, but needing to be moving carefully so that you're not causing undue alarm.
136
00:14:04,400 --> 00:14:08,000
Sometimes something that looks like a breach really isn't. So you don't want to be like
137
00:14:08,000 --> 00:14:16,080
crying wolf and things like that. So and then the flip side is these some of the worst situations are
138
00:14:16,080 --> 00:14:22,080
ransomware attacks lately, where they're not really going for the data. They're going for
139
00:14:22,080 --> 00:14:29,760
the fact that they've locked up the data. And so not always, but if a company pays the ransom,
140
00:14:29,760 --> 00:14:39,040
and they get their data unencrypted again, that at least needs to be treated as a breach.
141
00:14:40,080 --> 00:14:46,720
And you probably have a lousy argument that it wasn't a breach. But it's kind of a weird thing
142
00:14:46,720 --> 00:14:51,600
to have to tell you. You dated and leave. Well, you think it didn't leave. But you don't have.
143
00:14:51,600 --> 00:14:59,200
You've been given an assurance by a cyber criminal. So how much do you put faith in that?
144
00:14:59,200 --> 00:15:04,160
So those are some of the ones that are tricky for our clients to understand. Like, well,
145
00:15:04,160 --> 00:15:08,320
we got the data back was the problem. Like, that's just kind of how it is.
146
00:15:08,320 --> 00:15:14,080
Yeah, I mean, my questions would be, so there would be some things that we would recommend to do.
147
00:15:14,080 --> 00:15:19,680
First of all, we recommend that you apply labeling and tag all of your data, you know,
148
00:15:19,680 --> 00:15:25,760
so that if it leaves, it can't necessarily be opened. That doesn't change that your data is
149
00:15:25,760 --> 00:15:29,520
being held hostage. You know, just because you've, and this is a little bit technical,
150
00:15:29,520 --> 00:15:35,040
but just because you've applied data labeling and encryption to data doesn't mean you can't
151
00:15:35,040 --> 00:15:41,600
encrypt around it. Right. So, but my concern would always be the cyber criminal might tell
152
00:15:41,600 --> 00:15:48,000
me that my data didn't leave, but it may have left anyway. And what if now, you know, three years
153
00:15:48,000 --> 00:15:54,800
from now, it's hostage again. Yeah. Or they give it back, but they give it back with a warmer virus.
154
00:15:54,800 --> 00:16:02,880
Right. Deploys sometime later. You know, the other thing we've seen with ransomware is if you pay
155
00:16:02,880 --> 00:16:08,000
once, does that mean you're going to be willing to pay again? So like the repeat target. Right.
156
00:16:08,000 --> 00:16:12,640
So there's all sorts of things. I actually joke that it's not really a joke that it's really
157
00:16:12,640 --> 00:16:19,040
sort of a game theory issue. So the cyber criminals have to behave with some level of integrity.
158
00:16:19,040 --> 00:16:25,760
So for some portion of the folks that they're asking for ransom and get paid, they got to give the
159
00:16:25,760 --> 00:16:29,920
data back. Otherwise, the industry is going to talk and they're like, well, don't pay that,
160
00:16:29,920 --> 00:16:34,720
you'll never get it back. And so, you know, it's just sort of like this. How much do you pay? How
161
00:16:34,720 --> 00:16:39,600
much you not pay? What it's a complicated dance for sure. If you were going to guess,
162
00:16:41,600 --> 00:16:47,120
again, you can choose not to answer this, in that scenario, how often do people,
163
00:16:47,120 --> 00:16:53,920
do companies really pay versus try and do something else? I don't know because they don't,
164
00:16:53,920 --> 00:16:58,400
you know, it's one of these things where you kind of want to stay under the radar,
165
00:16:58,400 --> 00:17:04,720
but I do know that payment happens on a regular basis. I guess the one caution that I'd say is
166
00:17:04,720 --> 00:17:12,480
that there are lists of organizations that are mostly foreign or otherwise criminal,
167
00:17:12,480 --> 00:17:16,880
that if you make a payment to one of those, you're actually committing a federal crime.
168
00:17:16,880 --> 00:17:23,120
Really? So there's some extra reasons to be cautious about paying. And then there's like
169
00:17:23,120 --> 00:17:28,480
these payment brokers, which sort of blows my mind, but they're professionals who their job
170
00:17:28,480 --> 00:17:34,160
is to be an intermediary to negotiate the extent of the ransom between the good guys and the bad guys.
171
00:17:34,800 --> 00:17:42,160
It is mind blowing. Virtual repo, man. Yeah. Yeah. Yeah. But people do pay and some who pay
172
00:17:42,160 --> 00:17:47,520
get their information back, and that's one of the reasons why people keep, they keep paying.
173
00:17:47,520 --> 00:17:57,600
I had no idea. In the healthcare world, what constitutes a breach, and I'm going to caveat
174
00:17:57,600 --> 00:18:03,280
that with, you know, you might have someone gain access to your environment, but at what point do
175
00:18:03,280 --> 00:18:08,960
you really need to disclose that something's happened? Is there a magnitude of size? Or?
176
00:18:08,960 --> 00:18:17,680
There is a four question analysis that has to be done, a breach analysis. And the ultimate
177
00:18:17,680 --> 00:18:26,320
answer is whether or not there is a low probability of compromise. There are no bright lines in any
178
00:18:26,320 --> 00:18:33,840
of the four questions. And so it's like this sort of pushing and pulling and a little bit of Ouija
179
00:18:33,840 --> 00:18:41,200
board, a little bit of Venn diagram and some just sort of gut feeling. But the problem is the presumption
180
00:18:41,200 --> 00:18:46,320
is there's been a breach unless you prove otherwise. You're not trying to prove a breach,
181
00:18:46,320 --> 00:18:52,160
you're trying to prove no breach. And that's where you run into a challenge, like with the ransomware.
182
00:18:52,160 --> 00:19:00,320
So you've had your data compromised through encryption, it gets locked up. Can you really
183
00:19:00,320 --> 00:19:06,560
say that it wasn't compromised? You can't say that it hasn't. And so you can't overcome the
184
00:19:06,560 --> 00:19:12,720
presumption in the law. And that's why you end up having to notify several thousands, millions, you know.
185
00:19:12,720 --> 00:19:19,600
Yeah. I mean, it's big numbers. It's certainly every CIO is worse nightmare. And it's every CEO is
186
00:19:19,600 --> 00:19:23,680
worse nightmare. Probably five minutes. It's everybody's worse nightmare. No one wants to
187
00:19:23,680 --> 00:19:28,880
end up on the front page for something like that. You know, it's just none of us to. Not at all.
188
00:19:28,880 --> 00:19:33,040
Yeah. Well, it's interesting. I think, you know, for as much as we're talking about tech,
189
00:19:34,400 --> 00:19:39,680
we have to talk about people. Right. Because when you when you get down to the reality of
190
00:19:39,680 --> 00:19:47,600
most breaches, it's actually a person issue. You know, getting through technology, I don't do this,
191
00:19:47,600 --> 00:19:53,200
but that's hard stuff. Like, you're having to compete with the bad guys are competing with the
192
00:19:53,200 --> 00:19:59,120
good guys. But human fallibility is out there in unlimited quantities. And that's why we see
193
00:19:59,120 --> 00:20:05,120
phishing. That's why we see all these other things. That's not going away. So one of the things that
194
00:20:06,080 --> 00:20:12,080
I think organizations need to be really mindful of is, I don't care how good your tech is. If your
195
00:20:12,080 --> 00:20:18,560
people aren't watching. Agreed. It's virtually useless. Agreed. Agreed. And then almost every
196
00:20:18,560 --> 00:20:27,120
security issue that we deal with from our customers is the result of a human being not paying attention
197
00:20:27,120 --> 00:20:35,280
or we were starting to see this now MFA fatigue, where you you have to, you know, do a second
198
00:20:35,280 --> 00:20:41,280
factor for everything. And it's happening so often that people are just, yep, yep, I did it, I did
199
00:20:41,280 --> 00:20:50,800
it. And when in reality, it's not them. So what we're starting to see is, is with MFA, for the
200
00:20:50,800 --> 00:20:56,160
most part, we work with Microsoft technology, when that prompt comes up, it tells you the actual
201
00:20:56,800 --> 00:21:02,880
location of where the person is attempting to sign in from. So you can say, okay, no, I'm not in
202
00:21:02,880 --> 00:21:09,520
Phoenix, Arizona right now. This is not me. Yeah. Because that's what's happening. People are just
203
00:21:09,520 --> 00:21:18,640
yep, yep, yep. Well, as a real live example of the magnitude of the issue. I have a former
204
00:21:18,640 --> 00:21:29,520
colleague who was the chair of our cyber legal team. And he got the yellow screen experience
205
00:21:30,320 --> 00:21:35,760
because he was on a webinar, he was multitasking, he was just trying to clean out his inbox. And so
206
00:21:35,760 --> 00:21:41,520
he's just going through stuff. And he clicked on something that was fishing. It was actually a,
207
00:21:41,520 --> 00:21:45,200
you know, was one of those intentional phishings where they were trying to do education within
208
00:21:45,200 --> 00:21:52,800
the firm. And so you think of all the people who would be ready to know what's out there and to see
209
00:21:53,840 --> 00:22:01,200
the phishing coming. And it's because he was distracted. So it's so easy to just let your
210
00:22:01,200 --> 00:22:05,840
guard down. Yeah, particularly if you're on your phone. Yeah, it's very, very easy on your phone to
211
00:22:05,840 --> 00:22:09,840
just say, oh, yeah, let me look at this PDF for this, whatever it is, it's been sent to me. I
212
00:22:09,840 --> 00:22:16,480
mean, I personally don't open any attachments unless I know who they're coming from because it's
213
00:22:17,680 --> 00:22:24,160
such a big deal. And that's undoubtedly a best practice. Again, we spend so much time talking
214
00:22:24,160 --> 00:22:31,520
about thinking about documenting, contracting around all the technology. And it is the people
215
00:22:32,080 --> 00:22:38,000
part is so important. Yes, yeah, I agree. I'm going to pivot on you for just just a minute here,
216
00:22:38,800 --> 00:22:45,840
because this is a question that really I have being a business owner. How do you feel about
217
00:22:45,840 --> 00:22:52,800
AI in the legal world? And how does that impact you? Well, either the sky is falling or it's a
218
00:22:52,800 --> 00:22:59,760
wonderful addition to what we do is layers. I think it's somewhere in between. And as we were
219
00:22:59,760 --> 00:23:08,880
talking at Coffee, we I think the best way to approach AI in the legal field is to think of it
220
00:23:08,880 --> 00:23:16,960
as a tool. It's not a solution. It's kind of like having another associate when it's not doesn't have
221
00:23:16,960 --> 00:23:23,360
a heartbeat. But in the same way that that when younger attorneys bring me a work product, it's
222
00:23:23,360 --> 00:23:31,600
my job to check it. Right. I don't know where AI is pulling its case law from where it's pulling
223
00:23:31,600 --> 00:23:40,080
its information. It's only as good as as the foundation of data that it's consuming and processing.
224
00:23:40,080 --> 00:23:46,080
So we've already seen cases where attorneys have been reprimanded for just filing something that
225
00:23:46,080 --> 00:23:52,800
they produce through AI. And that's that even happen? Like, I get how it happens. But how as an
226
00:23:52,800 --> 00:24:00,960
attorney, do you file something that you haven't verified? Well, I think some of it can be a
227
00:24:00,960 --> 00:24:09,360
workload issue. Okay, some of it is just lazy lawyering. Some of it could be like extreme
228
00:24:09,360 --> 00:24:13,440
fee sensitivity where the client's just like, Hey, I just want you to file something, just get
229
00:24:13,440 --> 00:24:20,160
us in a court, do whatever. And if you're in that situation, you're the lawyer, you're not really
230
00:24:20,160 --> 00:24:28,400
thinking, Well, I'm actually, you know, a custodian of the law, like an agent of the court or whatever
231
00:24:28,400 --> 00:24:34,640
that term is. You're not thinking about that when you've got your client hounding you to just get
232
00:24:34,640 --> 00:24:40,480
something filed and get it out the door. And so I think that's how it sometimes happens.
233
00:24:40,480 --> 00:24:50,400
I completely understand the sanctions from courts that say, I don't care what your pressure is.
234
00:24:50,400 --> 00:24:56,000
Yeah, particularly if you're in a law firm, the assumption is you've got other people to check
235
00:24:56,000 --> 00:25:01,120
it. So if you're a solo practitioner, maybe there's a little bit of leeway there. But there's usually
236
00:25:01,120 --> 00:25:05,600
not a whole lot of grace given when you've got colleagues who you can say, Hey, can you read
237
00:25:05,600 --> 00:25:11,200
this brief of mine? That's the expectation. That's why you work in a firm. Right, right. I think of
238
00:25:11,200 --> 00:25:17,760
AI the same way. You know, we use AI every day, we certainly use it in our marketing organization,
239
00:25:17,760 --> 00:25:26,880
and we use it for a lot of things. My opinion on it is AI today, and I'm talking about tools like
240
00:25:26,880 --> 00:25:33,760
chat GPT or even Microsoft 365 co-pilot is like a really good intern. Like you could have an intern
241
00:25:33,760 --> 00:25:37,520
that's really, really smart, and they can do really good research and they can put together
242
00:25:37,520 --> 00:25:42,320
something that's really great for you. But in the end, you got to read it, you got to check it,
243
00:25:42,320 --> 00:25:46,240
and you're going to have to fix it because they're an intern, they don't have the business
244
00:25:46,240 --> 00:25:51,040
experience that you do that, you know, they don't necessarily know what to look for, except for what
245
00:25:51,040 --> 00:25:58,640
they've been told to look for. And AI is great, but human intuition is a real thing. And you can
246
00:25:58,640 --> 00:26:03,120
read something and say what that, but just I don't know why it doesn't feel right, but it
247
00:26:03,120 --> 00:26:08,480
doesn't feel right. Well, an AI is designed to replicate. And so you could be perpetually
248
00:26:09,200 --> 00:26:15,280
replicating something that's just a lousy model or it's inefficient or things that if you were to
249
00:26:15,280 --> 00:26:23,760
just step back and look at it with a human brain, you might say, isn't time to evolve that document,
250
00:26:23,760 --> 00:26:28,720
that process, that legal theory, whatever, but you're not going to get that. You'll never get that.
251
00:26:28,720 --> 00:26:37,200
Right, right. And it can only replicate what it's been trained on. Right. So the interesting place
252
00:26:37,200 --> 00:26:43,840
for me in that in the legal world is, you know, there are all kinds of cases that were the first
253
00:26:43,840 --> 00:26:48,800
of their time. AI is never going to replicate that because it's never going to think about, okay,
254
00:26:48,800 --> 00:26:53,680
well, that law was written 100 years ago. Maybe we need to change it or maybe, you know, and I'm
255
00:26:53,680 --> 00:26:59,360
not a lawyer, I'm making stuff up here, but it just feels to me like the opportunity for everything
256
00:26:59,360 --> 00:27:06,640
to look the same and for us to remain stagnant as a society is real. Well, you want the law to
257
00:27:06,640 --> 00:27:15,040
evolve. And that's just part of how it's that never ending evolution towards perfection,
258
00:27:15,040 --> 00:27:18,960
which of course will never be achieved, but it is supposed to be getting incrementally better.
259
00:27:18,960 --> 00:27:24,000
Right. And the only way it's going to get incrementally better is when somebody does
260
00:27:24,000 --> 00:27:28,640
something like look at a, I mean, we're seeing this right now, right? You look at a
261
00:27:29,760 --> 00:27:36,400
US Constitution amendment and you're like, huh, I wonder if we've all been looking at that wrong.
262
00:27:36,400 --> 00:27:42,320
Right. And let's see if we can make this particular argument. AI is never going to do that.
263
00:27:42,320 --> 00:27:51,200
Right. Ever. So I think there is a component of the law that's just going to depend on brains
264
00:27:51,760 --> 00:27:56,800
forever. Right. And that's a good thing. That is a good thing. As a lawyer, that's a good thing.
265
00:27:56,800 --> 00:28:03,120
Yes. Yes. And I think it's going to potentially make things a little bit easier for you, but it's
266
00:28:03,120 --> 00:28:09,760
not going to change what you do. You're still going to. No, it tends to be a situation where it just
267
00:28:09,760 --> 00:28:15,440
shifts some of the focus and shifts where the workload ends up being. I don't think it's going
268
00:28:15,440 --> 00:28:22,880
to back off. And if anything, what it may do is expand the volume of work because it's so much
269
00:28:22,880 --> 00:28:27,840
easier to produce things like a brief. Right. And we just get more of them. And longer.
270
00:28:27,840 --> 00:28:39,200
And longer. Exactly. And so we may end up what we lose in sort of efficiency as lawyers when they
271
00:28:39,200 --> 00:28:45,040
pick up in volume just because more they are, it's easier to do. Right. Right. Yeah. So, you know,
272
00:28:45,040 --> 00:28:50,720
the prevailing question is, is AI going to take jobs away? And what you're saying is, for lawyers,
273
00:28:50,720 --> 00:28:57,520
probably not. Yeah. Probably not. We're pretty good at keeping job security as a profession.
274
00:28:57,520 --> 00:29:01,120
I would agree with that. Yes. Because as soon as there's one involved, there's.
275
00:29:01,120 --> 00:29:05,680
Yeah. For better or for worse. Like rabbits. I try not to practice that way, but it is kind of a
276
00:29:05,680 --> 00:29:11,760
a feature of the practice. Yes. Yes. Yes. Yes. I get it. Awesome. Well, thank you. I really appreciate
277
00:29:11,760 --> 00:29:16,080
coming in to chat. Oh, it's a pleasure to chat. Yeah. It's super fun. All right. Well, just, you
278
00:29:16,080 --> 00:29:20,640
know, let's keep in touch. And hopefully we don't have to work together on anything because that
279
00:29:20,640 --> 00:29:25,120
means somebody's been breached, likely. Or at least we're working on the front end. Yes, exactly.
280
00:29:25,120 --> 00:29:36,400
That would be delightful. Yes. Awesome. Thank you. You bet. Thank you.
