Shannon Britton Hartsfield

Shannon B. Hartsfield helps healthcare organizations navigate complex regulatory challenges with practical, business-focused legal solutions. Ms. Hartsfield serves as the executive partner of Holland & Knight's Tallahassee office, and she is Board Certified in Health Law by The Florida Bar Board of Legal Specialization and Education. Her practice focuses on the intersection of healthcare delivery and regulation, with a particular emphasis on compliance, technology, digital health and privacy. She is a co-author of HIPAA: A Practical Guide to the Privacy and Security of Health Data, Second Edition, in association with the American Bar Association (ABA).

Ms. Hartsfield guides clients, from technology startups to multinational corporations, as they address state and federal healthcare regulatory matters in ways that align with their business objectives. Her clients include a full spectrum of healthcare companies, including pharmaceutical manufacturers, wholesale distributors and pharmacies, as well as hospital systems, long-term care providers, medical app developers and large clinics. She counsels clients on practical approaches to achieving business objectives while adhering to a complex state and federal regulatory landscape. Ms. Hartsfield is a past chair of the eHealth, Privacy & Security Interest Group of the ABA's Health Law Section. She is also a regular contributor to Holland & Knight's Cybersecurity and Privacy Blog.

Additionally, Ms. Hartsfield has experience in the following areas:

• Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health (HITECH) Act and Data Privacy and Security Compliance: Designed HIPAA compliance programs and provided advice and counsel on risk analyses, policies and procedures, business associate agreements, transaction diligence and training for hospitals, health plans, pharmaceutical manufacturers, clinical trial sponsors and other research entities, healthcare providers and vendors, and advised on matters related to 42 C.F.R. Part 2, the Gramm-Leach-Bliley Act, Federal Trade Commission (FTC) regulations and state privacy laws
• Artificial Intelligence (AI): Advised regarding potential privacy implications of using AI solutions and counseled clients on navigating risk
• Data Strategy: Advised hospitals and other healthcare companies regarding permissible uses of de-identified data, as well as privacy matters regarding data license contracts, human subjects research and state law compliance
• Breach and Incident Response: Advised providers, health plans, manufacturers, data analytics companies and other entities regarding data breach and security incident response, reporting, risk assessments and mitigation
• Internal Investigations: Conducted internal investigations relating to regulatory compliance assessments and data breach investigations
• Government Investigations: Advised healthcare providers and business associates on responding to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in HIPAA-related investigations
• Telehealth and Telemedicine: Advised medical app developers and providers regarding regulatory compliance and privacy issues involving telehealth
• Laboratories and Genetic Testing: Advised clients regarding informed consent and privacy requirements relating to DNA and genetic testing
• Consumer Protection and Patient Engagement: Advised clients in designing consumer-facing privacy documents, including consent forms, authorizations and notices of privacy practices
• Pharmaceutical Supply Chain: Advised pharmaceutical manufacturers, pharmacies and drug wholesalers regarding licensure, transaction documents, privacy, specialty pharmacy operations, HUB and patient assistance services, and other regulatory matters
• Hospital Systems: Advised multi-state hospital corporations regarding data privacy and security, 42 C.F.R. Part 2 compliance, fraud and abuse laws and behavioral health, as well as responding to Centers for Medicare & Medicaid Services (CMS) investigations and immediate jeopardy findings

Chambers USA – America's Leading Lawyers for Business guide has recognized Ms. Hartsfield since 2006. Here are some excerpts from past editions:

• "Shannon is a nationally regarded leader in the field of health privacy and security law. She worked to understand our business, asking probing questions and provided the best, most practical advice."
• "Shannon is extremely responsive, thoughtful and helpful in navigating state regulatory issues." Others noted her "level of expertise and responsiveness is outstanding."
• "She is an expert in a unique area. She's nationally noted, and we're very happy with her practical guidance. She has her finger on the pulse." Another interviewee added: "She's amazingly responsive and quick to reply."
• "Sources say she 'is an indisputable expert in HIPAA with great instincts for difficult questions.'"
• "She really understands healthcare and is one of the most thorough people I have ever met. She is fabulous; she does everything so exceptionally well."
• "Interviewees hold [her] in high esteem as a 'deal-maker who never creates unnecessary impediments.'"