Healthcare sector mergers and acquisitions dramatically amplify cybersecurity and data privacy exposure for potential buyers and sellers, said attorney Jonian Rafti of law firm Proskauer. But there are critical steps entities can take to reduce those risks.
“When you’re a buyer in a healthcare transaction, you’re not just buying assets of a healthcare company – you’re also buying potential regulatory risks or compliance gaps that come with that,” he said.
Buyers typically approach this in two ways. Legal experts examining the seller’s compliance with applicable law, such as HIPAA and state privacy laws, and their policies, procedures and compliance programs.
“And then cybersecurity consultants are also often engaged to look under the hood at systems, at workflows, from a highly technical, security-focused perspective,” he said.
A top lesson for sellers, “is putting your best foot forward,” he said. “If you know a transaction’s on the horizon, be prepared for the questions that will arise: Do you have HIPAA policies and procedures in place? Is there a compliance program in place? Do you have an appointed security officer and privacy officer? Have you performed risk assessment – which are different than day-to-day cybersecurity reviews or day-to-day cybersecurity penetration testing?”
In the interview (see audio link below photo), Rafti also discussed:
- M&A risks involving IT inventory, legacy systems, devices and unpatched vulnerabilities;
- Cyber insurance, vendor oversight and ecosystem risks and other considerations in M&As;
- Top cybersecurity and data privacy risk considerations and mitigation actions for sellers and buyers in healthcare M&A transactions;
- Related state and federal regulatory and legislative issues to watch in the year ahead.
Rafti is an associate in the corporate department and a member of the health care group at law firm Proskauer. He regularly represents private equity investors, health systems, management companies, physician groups, and lenders in complex transactional and health care regulatory matters. Rafti leverages his healthcare industry expertise to provide practical and market-driven insight to clients undertaking transactions and to advise on regulatory requirements, HIPAA and health data privacy, and healthcare technology matters.