Margaret Young Levi

Counsel

mlevi@wyattfirm.com

859.288.7469 O

859.259.0649 F

Lexington, KY

Practices and Industries

Health Care Data Privacy & Cyber Security

Margaret Levi is Counsel for the Firm’s Health Care Service Team. She has more than twenty-five years of experience advising health care providers in the areas of data privacy and cyber security, fraud and abuse, corporate compliance programs, clinical trials, The Joint Commission standards, EMTALA, end of life and other patient care matters. Her clients include hospitals, medical device manufacturers, long-term care facilities, physicians, hospices, and other health care providers.

She is the author of four editions of the very popular book The Impact of Health Care Reform on Kentucky Employers published by the Kentucky Chamber of Commerce. She also frequently contributes to the Wyatt HITECH Law Blog (wyatthitechlaw.com), which focuses on legal developments related to health information technology, privacy and security.

REPRESENTATIVE MATTERS

Ms. Levi frequently advises health care providers and other clients on data privacy and cybersecurity. She has drafted policies and assisted clients with implementing privacy and security programs for compliance with HIPAA/HITECH, information blocking, and state data laws. She has helped clients develop record retention programs. She assists clients in responding to data breaches under HIPAA or state data breach laws. She has also drafted and reviewed countless HIPAA business associate agreements for covered entities and business associates.
She advises healthcare clients regarding complex healthcare fraud and abuse issues and helps clients structure transactions to comply with the Physician Self-Referral (Stark) Law, the Anti-Kickback Statute, the False Claims Act and similar federal and state fraud and abuse laws.
Ms. Levi works with clients to proactively implement programs, policies and procedures to comply with new and emerging laws, regulations and standards that are tailored to the clients’ needs.
She negotiates, drafts and reviews various agreements on behalf of clients, including managed care contracts and clinical trial agreements between industry sponsors and health care institutions.
She advises healthcare clients with patient care and risk management issues.
She assists clients with state licensing and Medicare and Medicaid certification, including assisting with state pharmacy board licensure for the manufacture and distribution of medical devices and home medical equipment.
Ms. Levi also assists with due diligence in connection with the acquisition of health care companies.

EDUCATION

J.D., University of Kentucky College of Law, 1995

Moot Court Board

M.A., College of William and Mary, 1991 (English)

B.A., Centre College, 1988 (English)

National Merit Scholar

ADMISSIONS

Supreme Court of Kentucky, 1995
United States District Court for the Eastern and Western Districts of Kentucky
United States Court of Appeals for the Sixth Circuit

PROFESSIONAL EXPERIENCE

Adjunct Professor, University of Louisville Louis D. Brandeis School of Law, 2018-present, teaching privacy and security law.
General Counsel and Corporate Compliance Officer, Ephraim McDowell Health, Inc., 1999-2009. While at Ephraim, Ms. Levi advised the organization on a variety of day-to-day health law and contracting issues. She was responsible for HIPAA privacy and security implementation, corporate policies, risk management, liability, insurance, workers compensation and corporate compliance, and she was a member of the hospital’s Institutional Review Board. She negotiated the purchase and sale of hospitals and other health care entities. Ms. Levi successfully lobbied to change the law and then obtained a certificate of need permitting Ephraim to be, at that time, one of two hospitals in Kentucky eligible to perform angioplasty without an open heart surgery program.
Adjunct Professor, University of Kentucky College of Law, 1999-2001, teaching legal writing.
Attorney, McBrayer, McGinnis, Leslie & Kirkland, PLLC, 1995-1999. Ms. Levi represented hospitals, home health agencies, skilled nursing facilities and other health care providers in certificate of need and licensing issues. Advised health care clients on compliance with EMTALA, Stark, Anti-Kickback, and other federal laws.

PROFESSIONAL ACTIVITIES AND MEMBERSHIPS

The International Association of Privacy Professionals (IAPP)
American Health Law Association, 1995-Present
Kentucky Academy of Hospital Attorneys, Board Member
Kentucky and American Bar Associations (Chair, Kentucky Health Law Section, 2004-2006)

CIVIC INVOLVEMENT

The Gathering Artists, Member, 2020-Present; Co-Chair, 2023-2024
Kentucky State Board for the Certification of Librarians, Member, 2021- 2024, Chairperson, 2023-2024
Boyle County Public Library District Board of Trustees, President, 2007-2014, 2021-2024
Boyle County Cooperative Extension Service, Council Member, 2016 – 2024
Danville Library, Inc., Member, 2007 – 2024
Danville Schools PTO, President, 2019 – 2023
Danville High School PTO, President, 2019 – 2023
The Art Center of the Bluegrass, Board of Directors, 2022 – Present
Leadership Kentucky, Member Class of 2002
City of Danville’s Beautification Committee, Former Member and Past President
City of Danville’s Cemetery Committee, Former Member and Past President
John W. Bate Middle School PTO, President, 2016 – 2019
Rotary Club of Danville, Past President, Member 2000-2020

PUBLICATIONS

“New HIPAA Final Rule Supporting Reproductive Health Care Privacy Also Requires Amending Notices of Privacy Practices”
Wyatt HITECH Law, April 26, 2024.
“CMS Issues Updated Guidance on Texting Patient Orders,” Wyatt HITECH Law, February 22, 2024.
“Breach Notification Deadline is February 29th,” Wyatt HITECH Law, February 16, 2024.
“The Impact of Health Care Reform on Kentucky Employers,” a book published by the Kentucky Chamber of Commerce, Fourth edition, 2022
Co-Author, “Information Blocking Rule Effective April 5, 2021: Are Providers Ready?” Wyatt HITECH Law, April 6, 2021.
Co-Author, “HITECH Act Amendment: Using ‘Recognized Security Practices’ May Lead to More Favorable HHS Review and Reduced Fines After Data Breach,” Wyatt HITECH Law, February 5, 2021.
Co-Author, “Federal Agencies Warn of Cyberattacks on U.S. Hospitals,” Wyatt HITECH Law, October 29, 2020.
Co-Author, “New Treasury Department Ransomware Advisories Warn That Ransom Payment May be Sanctionable,” Wyatt HITECH Law, October 22, 2020.
Co-Author, “Data Security in the ‘New Normal’ of Teleworking,” Lorman Education Services, September 17, 2020 and Wyatt HITECH Law, May 1, 2020.
Co-Author, “Audio-Video Conferencing Risks and Tips for Healthcare Providers,” Lorman Education Services, September 10, 2020 and Wyatt HITECH Law, April 24, 2020.
Co-Author, “CISA/NCSC Joint Alert Warns of APT Groups Targeting Healthcare and Essential Services,” Lorman Education Services, August 27, 2020 and Wyatt HITECH Law, May 8, 2020.
Co-Author, “Data Security in the ‘New Normal’ of Teleworking,” Wyatt HITECH Law, May 1, 2020.
Co-Author, “CMS Issues COVID-19 Related Extension of the Deadline for Hospitals to Implement Electronic Patient Event Notifications,” Wyatt HITECH Law, April 28, 2020.
Co-Author, “Audio-Video Conferencing Risks and Tips for Healthcare Providers,” Wyatt HITECH Law, May 1, 2020.
Co-Author, “OCR’s 2019 Right of Access Initiative Bears First Fruit,” Wyatt HITECH Law, September 12, 2019.
Co-Author, “Healthcare organizations encouraged to enhance data security,” Medical News, June 30, 2020.
Co-Author, “CMS Proposes New Hospital CoPs for EHR Electronic Patient Event Notifications,” Lorman White Paper, May 22, 2019
Co-Author, “CMS Proposed Rule on Hospital EHR ‘Electronic Patient Event Notifications,'” Wyatt HITECH Law, April 9, 2019
“Healthcare Privacy Practices Must Include Nondiscrimination Notice,” Wyatt HITECH Law, February 26, 2018
Quoted in “Seeing it from all sides: Physicians, attorneys provide ‘variety of perspectives’ about the state of health care,” The Advocate-Messenger, February 17, 2017
“OCR Settlement a Message to Providers: Every Day Counts to Notify Affected Persons After a HIPAA Data Breach,” Wyatt HITECH Law, January 30, 2017
“Immediate Repeal of ACA Unlikely,” The Commercial Appeal, January 25, 2017
“The Impact of Health Care Reform on Kentucky Employers,” a book published by the Kentucky Chamber of Commerce, Third Edition, 2016
“LabMD Appeals; Court Grants Temporary Stay,” Wyatt HITECH Law, December 2, 2016
“FTC issues Final Order and data security lesson in LabMD case,” Wyatt HITECH Law, August 16, 2016
“New HIPAA Guidance on Ransomware: OCR’s encryption “gold standard” is no longer “golden,”” Wyatt HiTECH Law, August 8, 2016
“A Single Stolen, Unencrypted Laptop Can Cost Entities Millions of Dollars,” Wyatt HITECH Law, March 21, 2016
“To Freeze or Not to Freeze? That Is the Question,” Wyatt HITECH Law, March 1, 2016
“New HIPAA Exception Allows Covered Entities to Report Behavioral Health Considerations Applicable to Possessing a Firearm,” Wyatt HITECH Law, February 22, 2016
“Administrative Law Judge Dismisses FTC Complaint Against LabMD,” Wyatt HITECH Law, November 24, 2015
“Recent OIG Studies Recommend Tighter Enforcement of the Privacy and Security Rules,” Wyatt HITECH Law, October 2, 2015
“Stages 1, 2, And Now 3, Meaningful Use Criteria,” Wyatt HITECH Law, April 17, 2015
“April 1 Deadline for Hospitals to Earn HER Incentives,” Wyatt HITECH Law, March 16, 2015
“FTC Releases Report and Practical Advice on the Internet of Things,” Wyatt HITECH Law, February 26, 2015
“Providers Talk, CMS Listens: CMS Announces Plan to Modify Meaningful Use Requirements,” Wyatt HITECH Law, January 30, 2015
“The HIPAA Security Risk Analysis,” Wyatt HITECH Law, December 12, 2014
“CMS Extends 2014 Meaningful Use Attestation and Quality Deadlines,” Wyatt HITECH Law, November 25, 2014
“FDA Issues Cybersecurity Guidance to Medical Device Manufacturers,” Wyatt HITECH Law, October 20, 2014
“HIPAA and Same-sex Marriage: Understanding Spouse, Family Member, and Marriage in the Privacy Rule,” Wyatt Employment Law Report, October 20, 2014
“The Impact of Health Care Reform on Kentucky Employers,” a book published by the Kentucky Chamber of Commerce, Second edition, 2014
“September 22, 2014 Deadline for Business Associate Agreements,” Wyatt HITECH Law, August 22, 2014
“Federal Government Report Summarizes Health Care Privacy Compliance Efforts,” Wyatt HITECH Law, July 29, 2014
“Federal Government Report on Data Breaches in Health Care,” Wyatt HITECH Law, July 21, 2014
“New Kentucky Data Breach Rules Go into Effect,” Wyatt HITECH Law, July 15, 2014
“March 31st Attestation Deadline for Eligible Professionals,” Wyatt HITECH Law, March 18, 2014
“CMS Issues EHR Meaningful Use Hardship Exceptions for Health Care Providers Subject to 2015 Medicare Reimbursement Reduction (Includes Automatic One-Year Reprieve for 2013 Meaningful Users),” Wyatt HITECH Law, March 11, 2014
“No Further Extensions for ICD-10 and MU Stage 2,” Wyatt HITECH Law, February 28, 2014
“MU Deadlines for Eligible Professionals,” Wyatt HITECH Law, December 23, 2013
Co-Author, “Lessons Learned from Meaningful Use Audits,” Wyatt HITECH Law, December 5, 2013
“Don’t Forget to Protect your Paper Health Records!,” Wyatt HITECH Law, December 2, 2013
Co-Author, “Conducting HIPAA Breach Risk Assessments Using the ‘LoProCo’ Analysis,” Wyatt HITECH Law, December 2, 2013
“November 30th Meaningful Use Deadline for Hospitals,” Wyatt HITECH Law, November 27, 2013
“Retention of Paper Medical Records After Converting to Electronic Health Records,” Wyatt HITECH Law, September 30, 2013
“Mobile Device Management,” Wyatt HITECH Law, September 24, 2013
“OCR Delays Revisions to Laboratories’ Notices of Privacy Practices,” Wyatt HITECH Law, September 23, 2013
“HIPAA BAA Deadline is Monday, September 23, 2013,” Wyatt HITECH Law, August 26, 2013
The Impact of Health Care Reform on Kentucky Employers, a book published by the Kentucky Chamber of Commerce, First edition, 2012
Co-Author, “OCR Steps Up HIPAA Audits,” Valeo Magazine, July 2011
Co-Author, “Kentucky” Chapter of Lobbying, PACs and Campaign Finance, 1994 – 2000 editions

PRESENTATIONS

“Sex, Drugs and Rock & Roll,” Kentucky Hospital Association’s Town Hall Meeting, March 26, 2024
“HIPAA Overview,” Berea, Kentucky, April 18, 2019
“HIPAA’s Not Just for Health Care Providers,” Co-presenter with Sherry Porter, webinar, January 31, 2019
“American Healthcare: Medical and Legal Challenges Moving Forward,” Centre College, February 15, 2017
“Five Important Health Law Issues for General Practitioners,” Kentucky Bar Association’s Kentucky Law Update, Louisville, KY, October 6, 2016
“ACA Overview,” Centre College, January 7, 2015
“The Affordable Care Act – Where Are We Now?,” Kentucky Bar Association’s Kentucky Law Update, Lexington, KY, October 2, 2014
“Recent Developments in the Affordable Care Act (including DOMA Impact),” co-presenter with Sherry Porter, Kentucky Chamber of Commerce, Lexington, Kentucky, May 28, 2014
“Catching Some Sun with CMS – Open Payments Reporting,” contributed to presentation by Kathie McDonald-McClure and Daniel C. Soldato, HCCA Mid Central Regional Annual Conference, Louisville, Kentucky, November 8, 2013
“Affordable Care Act: How Did We Get Here?,” Kentucky Bar Association’s Kentucky Law Update, Bowling Green, Kentucky, November 7, 2013
“The Affordable Care Act Seminar: Roadmap Through Reform,” co-presenter with Sherry Porter and Douglas L. McSwain, Kentucky Chamber of Commerce, Louisville, Kentucky, November 6, 2013
“Affordable Care Act: How Did We Get Here?,” Kentucky Bar Association’s Kentucky Law Update, Owensboro, Kentucky, October 4, 2013
“Overview of Health Care Reform,” co-presenter with Douglas L. McSwain, Kentucky and Greater Louisville Association of Health Underwriters, Louisville, Kentucky, August 28, 2013
“Overview of Health Care Reform,” Kentucky Bar Association 2013 Annual Convention, Covington, Kentucky, June 20, 2013
“Expanding Access to Health Insurance Under the Affordable Care Act,” Kentucky Hospital Association/Kentucky Academy of Hospital Attorneys 2013 Annual Meeting, Lexington, Kentucky, May 10, 2013
“What Employers Need to Know Under the Affordable Care Act,” co-presenter with Sherry P. Porter and Douglas L. McSwain, Wyatt, Tarrant & Combs Labor and Employment Seminar, Lexington, Kentucky, April 24, 2013
“Overview of Health Care Reform,” co-presenter with Douglas L. McSwain, Energy Insurance Agency, Lexington, Kentucky, April 9, 2013
“Overview of Health Care Reform,” Frankfort-Bluegrass Chapter of ARMA International, Lexington, Kentucky, March 20, 2013
“Overview of Health Care Reform,” co-presenter with Douglas L. McSwain, Commerce Lexington, Inc., Lexington, Kentucky, February 12, 2013
“Overview of Health Care Reform for States and Individuals,” Powell-Walton-Milward, Lexington, Kentucky, February 11, 2013
“Back to Business: Implementing PPACA Now That The Supreme Court Has Ruled,” Kentucky Chamber of Commerce, Lexington, Kentucky, September 12, 2012
“The Joint Commission: What to Expect in 2012,” Wyatt, Tarrant & Combs Healthcare Seminar, Lexington, Kentucky, April 27, 2012
“New Patient Visitations Standards from The Joint Commission and New Medicare Conditions of Participation,” Wyatt, Tarrant & Combs Healthcare Seminar, Lexington, Kentucky, April 27, 2011