Shannon Britton Hartsfield

Shannon B. Hartsfield is a health lawyer and the executive partner of Holland & Knight's Tallahassee office. Ms. Hartsfield's practice focuses on the intersection of healthcare delivery and regulation, with a particular emphasis on compliance, technology, digital health and privacy. She is Board Certified in Health Law by The Florida Bar Board of Legal Specialization and Education. She is a co-author of HIPAA: A Practical Guide to the Privacy and Security of Health Data, Second Edition, in association with the American Bar Association (ABA).

Ms. Hartsfield advises clients – from technology startups to multi-national corporations – on state and federal healthcare regulatory matters. Her clients include a full spectrum of healthcare companies, including pharmaceutical manufacturers, wholesale distributors and pharmacies, as well as hospital systems, long-term care providers, medical app developers and large clinics. She counsels clients on practical approaches to achieving business objectives while adhering to a complex state and federal regulatory landscape.

Additionally, Ms. Hartsfield has experience in the following areas:

• Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health (HITECH) Act and Data Privacy and Security Compliance: Designed HIPAA compliance programs and provided advice and counsel on risk analyses, policies and procedures, business associate agreements, transaction diligence and training for hospitals, health plans, pharmaceutical manufacturers, clinical trial sponsors and other research entities, healthcare providers and vendors, and advised on matters related to 42 CFR Part 2, the Gramm-Leach-Bliley Act, Federal Trade Commission (FTC) regulations and state privacy laws
• Artificial Intelligence (AI): Advised regarding potential privacy implications of using AI solutions for a customer interface
• Data Strategy: Advised hospitals and other healthcare companies regarding permissible uses of de-identified data, as well as privacy matters regarding data license contracts
• Breach Response: Advised providers, health plans, manufacturers, data analytics companies and other entities regarding data breach and security incident response, reporting, risk assessments and mitigation
• Patient Engagement: Designed patient-facing consents and authorization
• Internal Investigations: Conducted internal investigations relating to regulatory compliance assessments and data breach investigations
• Government Investigations: Advised healthcare providers and business associates on responding to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in HIPAA-related investigations
• Telehealth and Telemedicine: Advised medical app developers and providers regarding regulatory compliance and privacy issues involving telehealth
• Laboratories and Genetic Testing: Advised clients regarding informed consent and privacy requirements relating to DNA and genetic testing, as well as clinical laboratory requirements
• Consumer Protection: Advised clients in designing consumer-facing privacy documents, including consent forms, notices of privacy practices and similar documents
• Pharmaceutical Supply Chain: Advised pharmaceutical manufacturers, pharmacies and drug wholesalers regarding licensure, transaction documents, privacy, specialty pharmacy operations, HUB and patient assistance services, and other regulatory matters
• Hospital Systems: Advised multi-state hospital corporations regarding data privacy and security, 42 CFR Part 2 compliance, fraud and abuse laws and behavioral health, as well as responding to Centers for Medicare & Medicaid Services (CMS) investigations and immediate jeopardy findings

Chambers USA – America's Leading Lawyers for Business guide has recognized Ms. Hartsfield since 2006. Here are some excerpts from past editions:

• "Shannon Hartsfield is very knowledgeable on HIPAA issues." Another interview added: "Shannon is extremely responsive, thoughtful and helpful in navigating state regulatory issues." Others noted her "level of expertise and responsiveness is outstanding."
• "She is an expert in a unique area. She's nationally noted, and we're very happy with her practical guidance. She has her finger on the pulse." Another interviewee added: "She's amazingly responsive and quick to reply."
• "Sources say she 'is an indisputable expert in HIPAA with great instincts for difficult questions.'"
• "According to impressed clients, Shannon is 'an expert on privacy matters' across the general healthcare industry." An interviewee adds: "She really understands healthcare and is one of the most thorough people I have ever met. She is fabulous; she does everything so exceptionally well." Others say: "She's very responsive, gives great guidance and is my go-to person for anything that relates to privacy or security matters in HIPAA regulations."
• "Interviewees hold Shannon Hartsfield Salimone in high esteem as a 'deal-maker who never creates unnecessary impediments,' while noting that she 'has great depth of expertise and is an invaluable resource.' She has notable experience in advising on data privacy issues."

In addition to her legal practice, Ms. Hartsfield is a past chair of the eHealth, Privacy & Security Interest Group of the ABA's Health Law Section. She is also a regular contributor to Holland & Knight's Cybersecurity and Privacy Blog.