Thora Johnson

Thora Johnson is the co-leader of Orrick’s Life Sciences & HealthTech Working Group. A trusted cyber, privacy and healthtech regulatory advisor, Thora practices at the intersection of health data privacy and artificial intelligence (AI). She focuses on guiding clients through the full lifecycle of health data, from collecting and managing data to designing compliance programs and responding to privacy and security incidents.

• Engagements

  Confidentiality of Health Information

  • Structures HIPAA compliance and incident response programs
  • Counsels clients on leveraging AI and the use of health data, including developing and reviewing appropriate disclosures and consents for internal, patient and consumer-facing applications
  • Guidance on the intersection of HIPAA, Part 2 and state consumer privacy and health laws governing the confidentiality of health data
  • Represented companies in negotiating and implementing HIPAA Resolution Agreements and Corrective Action Plans with the U.S. Department of Heath and Human Services’ Office for Civil Rights (OCR)
  • Represented covered entities and business associates in HIPAA desk audits
  • Regularly represents covered entities and business associates in resolving complaints with the regional offices of OCR
  • Advises companies using adtech in the healthcare space
  • Works with clients establishing medical registries and running research studies

  Health and Welfare Plan Compliance

  • Advises employers on how ACA legislation affects their health plans, including how to provide ACA-compliant health coverage to avoid penalties
  • Provides day-to-day advice on health and welfare compliance to employers, including drafting plan documents, summary plan descriptions, and summaries of benefits and coverages; and negotiating administrative service agreements
  • Counsels employers on alternative means of providing healthcare, including onsite medical clinics
  • Serves as counsel in lawsuits brought against health plans and health insurers by out-of-network providers under ERISA
  • Provides guidance on third-party vendor privacy and security incidents

  Other Healthcare Regulatory Compliance

  • Advises on Section 1557 nondiscrimination requirements applicable to certain healthcare providers, health insurers and group health plans
  • Provides counsel on interoperability and care quality improvement initiatives
  • Represents multiple clients regarding their compliance obligations as First Tier, Downstream, and Related Entities (FDRs) to Medicare Advantage and Medicare prescription drug plans
  • Counsels wellness companies on a wide variety of complex regulatory and corporate issues, including HIPAA, the ACA, regulations on wellness programs issued under the ADA, Medicare and Medicaid compliance and other miscellaneous federal and state regulatory matters, such as cost transparency laws