Life Sciences Cyber, Biosecurity and Data Privacy

Data protection, biosecurity and cybersecurity have reached an apex, with international national security concerns driving recent legislation such as the BIOSECURE Act, the DOJ Final Rule, and the EU NIS2 Directive. Join us in this session as our international speaker faculty discusses the drivers of such legislation, including:

• Understanding and navigating the ever-changing regulatory landscape, including data privacy and security laws, and restrictions on data transfers to China and other “countries of concern”
• Highlighting the critical operational and compliance risks from geopolitical instability
• Analyzing the risks in global cross-border biosecurity research
• Breaking down the categories and bulk thresholds of covered data
• Setting the stage for actionable strategies to safeguard operations and innovation

There are many laws “on the books” regarding healthcare privacy, with increasing confusion about what “health information” really means – and why it should be protected more than other data. To complicate matters even more, it is getting harder and harder to explain why everything we classify as health information deserves extra protection. Join us in this session as we explore why healthcare privacy is a growing challenge and clarify why it matters for your compliance efforts. Topics for discussion include:

• Understanding the applicability and limitations of HIPAA
• Reviewing new state laws filling gaps where HIPAA does not apply
• Mastering the evolving legislative landscape, ensuring compliance, and managing risk
• Examining Dobbs laws, and the enormous compliance challenges that make it difficult to reconcile with HIPAA provisions

It is essential for life sciences organizations to examine, create and consistently enforce protocols for assessing data privacy and security issues when choosing and implementing AI technologies – including risks associated with healthcare vendors. While AI can generate useful insights more rapidly and improve the delivery of diagnosis and treatment, it is critical to consider the impact of risks associated with potential violations of HIPAA compliance and patient protected health information (PHI). Join us as we explore some of the important factors and safeguards that life sciences companies must consider when utilizing AI, such as:

• Regulating data and authorizing the use of PHI when using AI technology
• Minimizing the amount of PHI necessary for intended purposes
• Ensuring only “role-based” access to PHI, and making certain that there are access controls in place
• Implementing strict security measures to adequately protect the integrity, confidentiality, and availability of the PHI
• Updating training to include:
  • The proper use of PHI with AI technology
  • The risks of HIPAA non-compliance when using AI technology

The NIS2 Directive establishes a unified legal framework to uphold cybersecurity in several critical sectors across the EU, including life sciences. The Directive mandates that each Member State adopt a national cybersecurity strategy, which includes policies for supply chain security, vulnerability management, and cybersecurity education and awareness. Topics for discussion in this session include:

• Understanding key cybersecurity obligations for healthcare and life sciences organizations, including under the evolving EU NIS2 and CER Directives
• Examining the practical insights into operationalizing EU cybersecurity requirements and improving data governance across global operations for:
  • Medical device manufacturers
  • Pharmaceutical companies
  • Digital health providers
• Strategies for developing a practical and harmonized approach based on evolving EU and global regulations

The recently adopted amendment to the National Defense Authorization Act (NDAA) added an updated version of the BIOSECURE Act (the Act) to the annual defense legislation. The updated legislation reflects key updates from prior versions of the Act and requires life sciences companies and institutions to vigorously assess their supply chains and existing business practices. Topics for discussion in this session include:

• Reviewing the updated legislation, administrative processes, effective dates, grandfathering, and potential implementation timelines
• Managing privacy compliance in clinical trials
  • ICF consent
  • Secondary research
• Balancing compliance costs with maintaining R&D efficiency and trial continuity
• Understanding the Biden Executive Order and DOJ Final Rule on sensitive data transfers to China and other “countries of concern”
• Examining the relevant implications for life sciences companies, and practical operational steps for compliance
• Evaluating strategies for life sciences organizations to address prohibitions and ambiguities