Skip to main content

Dianne J. Bourque

Member

[email protected]

+1.617.348.1614

Follow:
Share:

Dianne advises a variety of health care clients on a broad range of issues, including licensure, regulatory, contractual, and risk management matters, and patient care. As former in-house counsel to an academic medical center, a large part of her practice involves counseling researchers and research sponsors in matters related to FDA and OHRP regulated clinical research, including patient consent, access to and use of tissue and associated patient information, and the Institutional Review Board process. 

She also counsels health care clients and other business entities on a broad range of privacy and data security issues, including the HIPAA Privacy Rule and Security Standards, including requirements under HITECH and the HIPAA Omnibus Rule, 42 CFR Part 2, and state-imposed medical privacy laws. She regularly assists clients with data breach response and mitigation, the implementation of HIPAA-mandated policies and procedures, privacy audits, third-party requests for information, and review of HIPAA-related contracts and forms. She has successfully defended clients in both civil and criminal HIPAA enforcement actions and regularly assists clients with the management of data breaches and other losses of protected health information.

Before joining Mintz, Dianne was an associate staff attorney at the Lahey Clinic, where she provided general counsel services to medical, professional, and administrative staff. She also served as counsel to the Institutional Review Board, the Ethics Committee, the Intellectual Property and Technology Transfer Committee, and the Genetics Advisory Board. Before joining the Lahey Clinic’s legal staff, she worked in the research administration department. Her responsibilities included drafting a regulatory compliance manual detailing laws of concern in basic, clinical, and animal research, continually reviewing relevant regulations to ensure compliance for institutional programs, and researching and advising clients on a broad range of regulatory matters.

Dianne was the first Suffolk University law student to graduate with a concentration in Health Care and Biomedical Law. She formerly served as an adjunct professor at Stonehill College, teaching an undergraduate Health Care Law course.

Dianne is a contributor to the Mintz Health Law & Policy Matters blog as well as the Privacy & Security Matters blog.

Experience

  • Provided strategic counsel to a start-up medical application company that has devised a method to detect mild cognitive impairment as a precursor to more significant cognitive diseases.
  • Counseled a publically traded medical device company on risk management advice and helped them manage multiple significant adverse events following suspension of trial by the FDA.
  • Assisted our client, a manufacturer of smart, wireless prescription bottles, with structuring their patient interface to be consistent with privacy and data security laws and other regulatory issues.
Read less

viewpoints

Health Care Viewpoints Thumbnail
As we reflect on the flurry of activity in the health care data privacy and security space in 2023 and look ahead to what will continue to be a busy 2024, we are seeing the early stages of federal agency movement to align the regulatory environment with modern health care delivery, cutting-edge technologies, and innovative data-sharing techniques. Some of this work has been done in the form of federal agency guidance in which health care organizations will be looking for additional updates and there are also a handful of pending U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) proposals that call for substantial changes to the HIPAA Privacy Rule.
Read more
Health Care Viewpoints Thumbnail
In April, 2020, in an effort to facilitate a national pivot to telehealth in light of the COVID-19 Public Health Emergency (PHE), the U.S. Department of Health & Human Services Office for Civil Rights (OCR) announced a policy of Health Insurance Portability and Accountability Act of 1996 (HIPAA) enforcement discretion for regulated health care providers (Covered Entities) implementing communications technologies that weren’t fully compliant with HIPAA or using those technologies in a manner that didn’t comply with HIPAA. Examples of flexibilities included allowing technology providers access to protected health information (PHI) without a HIPAA Business Associate Agreement (BAA). OCR’s enforcement discretion enabled Covered Entities to minimize the need for in-person visits for all kinds of health care services, not just COVID-19 related care. OCR also implemented flexibilities to promote public health during the COVID-19 pandemic; for example, it allowed for Business Associates to share COVID-19 data with government agencies for such purposes without specific authority to do so under BAAs.  
Read more
Health Care Viewpoints Thumbnail
In response to concerns about the confidentiality of protected health information (PHI) related to reproductive health care less than one year after Dobbs v. Jackson Women’s Health Organization decision, and the prospect of such PHI being weaponized by states and used against patients, the U.S. Department of Health & Human Services Office for Civil Rights (OCR) has proposed amendments to the HIPAA Privacy Rule to protect that information.
Read more
Podcast Viewpoint Image
Bridgette Keller speaks with the Mintz Health Law team about what they are grateful for as they look back on a year of client service, mentorship, and working together as a team.
Read more
Covered Entities and Business Associates should promptly and carefully review their use of online tracking technologies on their websites and mobile apps following a bulletin (Bulletin) published by the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) last week.  The Bulletin addresses multiple facets of compliance with HIPAA when using online third-party tracking technologies (Tracking Technologies).  In doing so, OCR significantly expands its interpretation of the definition of Protected Health Information (PHI) to include, in some instances, identifiable information gathered by Tracking Technologies where a user visits a website and does not interact with the entity in any other way. In its Bulletin, OCR interprets the act of an individual visiting a website as evidence of a relationship or anticipated future relationship between the visitor and the entity.
Read more
In this second of our two-part blog series on protecting health information post Roe, we discuss legal and practical strategies that health care providers can take to protect the information of their patients. State laws that restrict or criminalize abortions will require significant amounts of health information to enforce, putting new pressure on health care providers caught in the middle of  competing obligations to their patients and to regulatory and law enforcement authorities making lawful requests for this information.
Read more
Much has been written about how existing privacy laws such as HIPAA are unhelpful to women in the wake of Dobbs vs. Jackon Women's Health Organization ruling. In the first of this two-part blog post series, the Mintz team breaks down the legal rights and practical strategies that women can use to protect their own information.
Read more
A recent settlement agreement between a clinical laboratory and the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) to resolve potential HIPAA Security Rule violations proves to be a cautionary tale for covered health care providers everywhere. There are two key lessons to note. First, a monetary penalty or fine may the least financially burdensome consequence of HIPAA non-compliance, because corrective action plans (CAPs) can be extremely costly. Second, in the context of a health care transaction, such as a merger or acquisition, non-compliance by one party to the transaction can prompt enforcement against the other party and even that party’s future business partners. This is the case even if the non-compliance preceded closing.
Read more
Health Care Viewpoints Thumbnail
The Department of Health and Human Services’ Office for Civil Rights (OCR) has announced that it will exercise its enforcement discretion for health care providers’ and their business associates’ noncompliance with the HIPAA rules with respect to their good faith use of online or web-based scheduling applications for scheduling COVID-19 vaccination appointments. OCR will not impose penalties for such noncompliance during the COVID-19 nationwide public health emergency.
Read more
With a notably sharply worded opinion, the Fifth Circuit recently vacated over $4.3 million in penalties levied against the University of Texas M.D. Anderson Cancer Center (M.D. Anderson) by the Department of Health and Human Services (HHS) for a series of alleged HIPAA violations. The case stems from three separate incidents that occurred between 2012 and 2013. In two instances, M.D. Anderson workforce members lost unencrypted protected health information (PHI), while the third incident involved the theft of a faculty member’s laptop also containing unencrypted PHI. On appeal, the Fifth Circuit concluded that HHS’s civil monetary penalties order against M.D. Anderson was arbitrary, capricious, and contrary to law, vacating the penalties and pointedly criticizing the agency’s actions and arguments in this matter.

Beyond its harsh words for HHS, this opinion is notable for calling into question some longstanding HHS enforcement practices and interpretations of the HIPAA regulations. The opinion also makes clear that regulated entities should check the math when HHS levies a fine. Although limited in its precedential authority, the Fifth Circuit’s opinion, at the very least, gives HIPAA-regulated entities some new food for thought if faced with an HHS enforcement action.
Read more
Read less

News & Press

News Thumbnail
In a Report on Patient Privacy article, Members Dianne Bourque and Lara Compton shed light on the termination of HIPAA enforcement discretions post-COVID-19. The HHS Office for Civil Rights officially reinstated its authority over telehealth on August 9, necessitating a rapid reassessment of compliance for covered entities and business associates.
Press Release Thumbnail
Mintz is pleased to announce that 120 firm attorneys have been recognized as leaders by Best Lawyers® in the 2024 edition of The Best Lawyers in America©.
Press Release Thumbnail
BOSTON –Mintz announced today that 39 of its practices and 81 of its attorneys earned recognition in the 2023 edition of Chambers USA, a guide to the country’s leading law firms.
News Thumbnail
Health Care Dive interviewed Member Dianne Bourque about the Biden administration's proposed new rule that would ban health care entities from sharing patient information.
News Thumbnail
Member Dianne Bourque spoke to Bloomberg Law about Regal Medical Group's cyberattack that resulted in the exposure of over 3 million patients' health information.
News Thumbnail
Axios interviewed Member Dianne Bourque about health privacy in the post-Roe digital age.
News Thumbnail
Mintz Member Dianne Bourque was quoted in an article published by Bloomberg Law about how the Centers for Medicare & Medicaid Services (CMS) has proposed the use of an algorithm in hospitals that guesses people’s race to improve health inequity gaps. The artificial intelligence is intended to serve as a stand-in until CMS can get patients to self-identify.
News Thumbnail
Mintz Member Dianne J. Bourque was quoted in an article published by MedCity News speaking on the errant email that exposed hundreds of One Medical patients' email addresses. Specifically, she addressed reporting obligations and the impact of the security lapse.
News Thumbnail
Mintz Member Dianne J. Bourque was quoted in an article published by Bloomberg Law on privacy concerns associated with the federal government’s collection of personal information, including race and ethnicity information, to track Americans getting the COVID-19 vaccine.
News Thumbnail
Mintz Member Dianne J. Bourque was quoted in an article published by Bloomberg Law on a cyberhack of the U.S. federal courts filing system. Specifically, she addressed why it may be particularly problematic for patients and health-care providers that are involved in litigation.
News Thumbnail
In Bloomberg Law, Mintz Member Dianne Bourque commented on some of the state and federal privacy laws protecting patient data that Amazon will have to navigate with the launch of its new online pharmacy business.
News Thumbnail
In Bloomberg Law, Mintz Member Dianne Bourque shared cybersecurity best practices for health care providers, particularly in light of recent ransomware attacks targeting hospitals across the country.
News Thumbnail
Mintz Member Dianne Bourque was quoted in an article published by Bloomberg Law on privacy concerns with mobile fertility apps as they are not covered by the Health Insurance Portability and Accountability Act.
News Thumbnail
Mintz Member Dianne Bourque was quoted in an article published by Bloomberg Law on privacy protections and related concerns as the federal government is working with states and private companies to allow immunization databases to share data as part of a COVID-19 vaccine distribution plan.
Press Release Thumbnail
Firm provides pro bono legal counsel to global health nonprofit on groundbreaking initiative to slow the spread of COVID-19 in the Commonwealth of Massachusetts.
News Thumbnail
Mintz Member Dianne Bourque was quoted in an article published by the Washington Post on New York’s efforts to distribute tens of thousands of doses of anti-malarial drugs as an experimental, unproven treatment for seriously ill coronavirus patients.
News Thumbnail
Mintz Member Dianne J. Bourque was quoted extensively in an article published by MedCity News on privacy considerations for individuals that opt to share their data with mobile health apps.
News Thumbnail
Mintz Member Dianne Bourque appeared on Bloomberg Television’s “Bloomberg Technology” news program to discuss Google’s partnership with Ascension, the nation’s second-largest health system, which includes sharing the personal health data of tens of millions of patients. Ms. Bourque addressed the legality of the arrangement under the Health Insurance Portability and Accountability Act (HIPAA), compliance under the federal privacy law, and legal limitations for using the health data.

The full show is available here, and the segment featuring Ms. Bourque runs from 29:47 - 35:15.
News Thumbnail
An article published by Wired detailed Google’s partnership with Ascension, the nation’s second-largest health system, which includes sharing the personal health data of tens of millions of patients. In the article, Mintz Member Dianne Bourque was quoted on the legality of the arrangement under the Health Insurance Portability and Accountability Act (HIPAA) and legal limitations for using the health data.
Mintz health care lawyer Dianne Bourque is quoted in this article, which addresses a host of state legislatures—often via consumer protection laws—are redefining what is considered a breach and how providers will need to handle reporting.
This feature article discuses key takeaways following Anthem’s $115 million settlement – one of the largest following a consumer data breach. Mintz Member Dianne Bourque is among the sources discussing what the health care industry can learn.
This article takes a closer look at a hack of Obamacare enrollment records. The piece notes that the breach could lead to an in-depth investigation of the government agency responsible for the federal health-care exchange. It is further noted that this hack could serve as a wake-up call for the government. Member Dianne Bourque is among the industry sources quoted.
Mintz Member Dianne Bourque was quoted in a Bloomberg Law article regarding the possible exposure of patients’ personal data due to cyberattacks on computer chips. Health care organizations are urged to install the most current security patches for their computer networks.
Dianne Bourque, a Member in the firm’s Health Law Practice, was among the group of experts quoted in a Law360 article regarding how a Blue Cross Executive’s divulging of private information about a patient likely triggered an alert with HIPAA's privacy protections. 
Press Release Thumbnail
Mintz Members will be participating in multiple panel discussions at the 2017 Boston Conference on Cyber Security hosted by Boston College and the FBI. The event presents an opportunity for leading minds to come together and fashion a more secure cyberspace.
Attorneys from Mintz represented Myriad Genetics, Inc. in its acquisition of Assurex Health, an informatics-based precision medicine company providing treatment decision support to health care providers for mental health patients.
Dianne Bourque, a Member in the firm’s Health Law Practice, is quoted in this Law360 article on a Chicago nurse’s tweets of pictures of a shooting victim’s hospital room. The tweet brought about allegations of privacy violations and a lawsuit against the hospital claiming as much.
Firm’s National Healthcare Practice, NY Corporate/M&A and Litigation: General Commercial Among Newest Rankings
Dianne Bourque, a Member in the firm’s Health Law Practice, is quoted in this Part B News article discussing the new HIPAA federal privacy rule for gun control.
The 2015 Chambers USA: America's Leading Lawyers for Business guide names 52 Mintz, Cohn, Ferris, Glovsky and Popeo, P.C.  attorneys as “Leaders in Their Fields.”
Read less

Events & Speaking

Speaker
Dec
14
2021
Webinar Reference Image
Speaker
Oct
19
2021
Conference Reference Image
Sep
30
2020

Clinical Trial Risk Management during COVID-19

Advanced Medical Technology Association's Virtual MedTech Conference

Online Event

Webinar Reference Image
Apr
21
2020
Webinar Reference Image
Speaker
Mar
2
2020

Healthcare Law & Compliance Institute: Taming Technology

How to Maximize Innovation While Minimizing Risk

Amelia Island, Florida

Speaker
Nov
14
2019

Health and Hospital Law: MCLE BasicsPlus

MCLE Conference Center, 10 Winter Place, via Winter Street

Panelist
Jun
19
2019

Health Care & Cybersecurity: A Powerful Combination

ML Strategies, 701 Pennsylvania Ave, NW, Suite 900, Washington, DC 20004

Speaker
May
23
2019

MCLE New England's 20th Annual Hospital & Health Law Conference 2019

Conflict of Interest and Research Compliance

Ten Winter Place, Boston

Panelist
Mar
8
2017
Panelist
May
2
2016

New England Healthcare Executive Network Meeting

NE Healthcare Executive Network

Boston, MA

Faculty
Mar
1
2016

Anatomy of a HIPAA Breach Master Track

American Bar Association

Webinar

Panelist
Sep
27
2015

Employee Benefits & Healthcare Congress

Employer Healthcare & Benefits Congress (EHBC)

Orange County Convention Center, 9800 International Drive, Orlando, FL

Co-chair
Apr
29
2015
Speaker
Read less

Recognition & Awards

  • Chambers USA: Massachusetts – Healthcare (2015-2017; 2021-2023)

  • BTI Consulting Group Client Service All-Star (2022)

  • Featured in Best Lawyers in America: Health Care Law (2020-2024)

Read less

Involvement

  • Regular guest lecturer, Cybersecurity Policy & Governance Program, Boston College Woods College of Advancing Studies
Read less