IAPP KnowledgeNet: Healthcare, AI and Privacy Perspectives for 2026

Speaking Engagement | February.10.2026 | 5:30pm - 8:00pm (Eastern Standard Time)

Orrick New York

Orrick and IAPP's New York KnowledgeNet Chapter are hosting a panel discussion featuring both in-house and outside counsel on the latest developments in health data privacy.

This panel will unpack emerging state consumer privacy requirements and recent enforcement actions impacting health and wellness data, and examine practical risks and opportunities posed by AI – especially patient-facing tools like chatbots and symptom checkers. The discussion will provide concrete takeaways legal, compliance and product teams to use now.

Discussion topics include:

State consumer privacy trends: New and evolving rules affecting health and wellness data, sensitive data definitions, consent and geofencing/use-based restrictions.
AI in healthcare contexts: Ambient scribes, chatbots, and symptom checkers – disclosures, consent, safety-by-design and monitoring.
Tracking technologies: Managing pixels, SDKs and cookies on health-related sites and apps; advertising and analytics risk controls.
Vendor and data governance: Assessing processors and model providers, data mapping, DSR workflows and retention/minimization strategies.
Enforcement landscape: Recent investigations and actions by regulators, penalties and what they signal for risk prioritization.

Panelists:

Yelena Ambartsumian, Founder, AMBART LAW – Moderator
Becky Bye, Associate General Counsel, Bazooka Brands
Thora Johnson, Partner and Co-Chair of Life Sciences & HealthTech Group, Orrick
Melissa Mitchell, Chief Privacy Officer, Phreesia

A networking reception will immediately follow the panel discussion for an opportunity to connect with other industry professionals.

If you are an IAPP member, please register below. If you are not a member but would like to attend, please reach out to Jillian Redash.

CLE Credits Available: Y

Contacts

Thora Johnson Partner, Life Sciences & HealthTech, Cyber, Privacy & Data Innovation

Washington, D.C.

See my bio

Practice:

Technology & Innovation Sector
Life Sciences & HealthTech
Cyber, Privacy & Data Innovation
Strategic Advisory & Government Enforcement (SAGE)

vCard

See full bio

Thora Johnson Partner

Washington, D.C.

Thora works with medical device, pharmaceutical, biotech and digital health companies, helping them navigate the increasingly complex patchwork of state and federal health privacy laws. One client described her to the Legal 500 as a “very practical” advisor providing “exceptional guidance” on health information privacy and HIPAA compliance matters.

Her breadth and depth of experience enable Thora to assist clients in harnessing the power of artificial intelligence and executing data-sharing arrangements, all while protecting health data. As a result, Thora spends much of her time counseling pioneering startups and high-growth companies on responsible innovation in healthcare and life sciences.

Thora brings extensive experience counseling clients, including Fortune 500 companies and brick and mortar providers, on the Health Insurance Portability and Accountability Act (HIPAA) and other state and federal health privacy and regulatory compliance regimes including:

Office of the National Coordinator for Health Information Technology’s interoperability and information blocking regulations
Centers for Medicare & Medicaid Service’s (CMS’s) interoperability and patient access regulations
Part 2 confidentiality requirements applicable to substance abuse records
State health information privacy laws
State consumer privacy laws with special controls for health data
Medicare/Medicaid compliance
Mental Health Parity and Addiction Equity Act (MHPAEA)
Genetic Information Nondiscrimination Act (GINA)
Affordable Care Act (ACA) compliance
Regulatory requirements of the Employer Retirement Income Security Act (ERISA), the Internal Revenue Code, HIPAA, and the ACA as they apply to employer health and wellness plans

Thora routinely helps companies and large employers prepare for and respond to privacy and security incidents involving health information. She also defends clients in government investigations initiated by the OCR, OIG, DOJ, FTC and State AGs, among others.