Andrew J. Droke, CIPP/US

Worked with health IT companies and health care providers to analyze and establish complex data use and sharing relationships.

Counseled regional health system on the implementation of interoperability and information blocking requirements.

Worked with large not-for-profit hospital systems, behavioral health systems, and health IT companies to develop and implement comprehensive information privacy and security programs addressing HIPAA, 42 CFR Part 2, and applicable state laws.

Assisted in structuring, drafting, and negotiating technology, digital health, software, vendor, and other service provider agreements and business associate agreements.

Assisted national retailers and data analytics companies in strategic planning with respect to data collection, use, and intra-organization sharing.

Create privacy notices for retailers, distributors, health care providers, health care technology companies, mobile applications, non-profit organizations, and professional sports organizations.

Coordinated information privacy and security aspects of a $450M acquisition of a hotel data and analytics company.

Helped electronic medical record vendor analyze its obligations under the GDPR and revise its website terms of use and privacy notices.

Assisted regional health system with Promoting Interoperability program participation requirements.

Worked with clients to develop external notices and internal policies to facilitate compliant data collection and handling, including privacy notices, data privacy policies and privacy risk assessments.

Assisted with sales and acquisitions of health systems, physician groups, and technology companies, including information privacy and security diligence.