Alan Fong, ’12

Privacy Officer, Catholic Health Initiatives


Do you consider yourself to be a health lawyer? And what does it mean to you to be a “health lawyer”?

No, I am not a health lawyer. I think of a health lawyer as somebody who is working as a lawyer in the healthcare industry, not necessarily in a hospital setting, but somewhere in the broader healthcare world, in a firm or legal department. Even though I work for a health care provider, and a health plan, my focus is more on information privacy. The privacy part is a much larger component of what I do.

In the privacy community or industry, particularly in health privacy, there is a very broad spectrum of backgrounds. While many individuals who enter into health information privacy or health care compliance are attorneys or have legal backgrounds, there are also quite a few people who have more operational, health oriented backgrounds, such as doctors or nurses. It is not a necessity to have a legal background.

For me, understanding how rules and regulations are made and applied is helpful. So, when I get asked questions, and there isn't a clear answer, I know where to look it up to find out. What’s required for my job is an understanding of privacy laws, the regulatory structures at the state and federal level, as well as an understanding of how healthcare works. It’s a blend of both worlds.


What was your impression of healthcare law back when you were a student at UC Hastings?

When I was a student, the Affordable Care Act was being debated and ultimately passed by Congress. The process was unlike anything I had experienced in my lifetime. I remember following it very closely and noticing how engaged everybody was in the debate. People had such strong emotions and stances, and this made it exciting. It was a lot of fun to experience this while in law school. I was very interested in the vast overhaul that was taking place and how it would ultimately change the healthcare system in this country. I knew that I wanted to be a part of it in some way, not necessarily in information privacy, but just part of the changes that were going on.

Similarly, I think privacy has always been appealing to me as an area of interest. While I didn't have a huge focus on it in law school, it was something that I was always attracted to on a personal level, as well as on an academic level. So this work was a natural fit for me. There is a major change going on with the way that information is gathered, produced, collected and stored, and I wanted to get involved.

Also I think that I am probably more of a private person than most. Being private has posed unique challenges as far as the way I interact with technology, in terms of sharing information and putting things out there. Because it is necessary to do that in this world, I was always interested in the framework around information sharing and wanted to learn more about it.

At the core of privacy is trust. Choosing who you want to disclose your private information to is something you should be informed of and have the opportunity to decide on your own. I think this goes hand in hand with health care because we have a health care system that puts informed consent in an important position. Your conversations with doctors are some of the most intimate conversations you will ever have. If you don't have the trust or confidence that what you say, and how you say it, will be protected, and if you don’t know how your information will be used and shared, trust will be eroded and there will be a very negative impact on treatment.


What most excites you about your work?

"Being at the cutting edge of a constantly evolving industry where there is a great deal of awareness and appreciation for privacy issues."

Being at the cutting edge of a constantly evolving industry where there is a great deal of awareness and appreciation for privacy issues. Each day it seems like there is a new headline tackling a new aspect of information privacy or information sharing. Just this morning actually, there was an article on how small, individual HIPAA violations can often end up being more impactful than large data breaches.

In terms of data breaches, whether it is the Blue Cross, the Office of Personnel Management  or the Ashley Madison breach, the headlines are increasing and people are becoming more concerned about their privacy rights and how their information is being gathered, collected and used. With this greater consciousness of the issues, it’s exciting to be involved on the front lines and shaping the direction that Prominence and Catholic Health Initiatives (Prominence’s parent company), take with respect to information privacy.


What is the biggest challenge in your work?

Probably the continuous change with healthcare and technology. There are so many forces at work that are driving this change and the way in which we can gather information, use it, and disseminate it. As a result, it feels like you are often playing catch up a little bit. There is always some new technology or exciting idea involving the use or disclosure of personal information, and that’s good, because they are helping to improve healthcare.  But balance is needed and the privacy piece helps with that balance.

Also, it can sometimes feel like the healthcare industry in general is getting conflicting instructions. On the one hand, we get a lot of incentives to share and leverage information in for numerous reasons such as improving outcomes or lowering costs. There are a whole host of initiatives structured around making information flow more easily. But that necessarily comes at the cost of confidentiality, in many ways. It’s not that they can’t be reconciled, but it can be challenging, and sometimes it means sacrificing a little bit of one, to protect the other, or vice versa.


What aspects of your training or background most inform the work you do now?

I think of skills that I have learned throughout my life that got solidified and refined in law school. Learning how to work in groups. Learning to analyze problems and advise in a way that is thoughtful and actually provides helpful guidance. It wasn’t a particular class or a particular set of studies. It’s really just the skills that you strengthen when you are in law school that prepare you to be detailed to and consider both sides of an issue before you answer a question. Communication skills have been very important as well.

Also, understanding how the healthcare system operates has been very helpful.  Possessing a strong foundational knowledge of healthcare processes and workflows is essential.  It is difficult to provide advice, implement controls or help structure projects that comply with the regulations unless you know how these things function in practice.


Tell me about a day in the life of you.

I don’t know if there is a traditional day. You can plan your calendar out to the last minute, but it’s very often the case that something will get dropped in your lap and it will completely disrupt your whole calendar and what you had planned for the day. It’s probably not the first thing people think of when they think of compliance or corporate responsibility but it is very fast paced.

However, in general, my day breaks down into three primary categories of work: advisory activities, investigative activities, and risk mitigation activities. I receive questions and get approached with issues, projects or potential violations. My job is to be a subject matter expert on the privacy issues and to advise my colleagues and leadership on the risks as well as what we can do to protect confidential information and minimize exposure for the organization.

I get new and unusual questions all day long, and I have to stop, think, research the issues, and work with others throughout the organization to figure out a solution that tries to meet everyone's needs. Sometimes I deal with long term questions and other times things that need to be addressed right away. Ultimately, it’s difficult to really say there is a typical day, but the need to be flexible and adaptable as events change and problems arise is a common theme.


Can you say a little bit about your work/life balance and how it might compare to some of your colleagues who work in other areas of the law?

There is a good work/life balance here. That’s not to say that there is never a need work late or take things home, but for the most part even though the job can be very hectic, there is a pretty good work/life balance. It is probably a little more relaxed than some of my colleagues who work in more traditional legal jobs. I work about sixty hours/week.

I do find time to take vacations and spend time with family. That being said, I also feel like I am on call when I am on vacation, and that if something comes up I need to be able to respond. I think that is definitely true for other legal jobs as well, that if something comes up, you have to be able to be responsive and drop what you are doing to address it.


Now, more than ever, there is pressure on lawyers entering the workforce. Do you have any advice you would like to give the next generation of law students interested in healthcare law?

Yes. I think for individuals who are interested in health law it helps to have some practical experience working in the healthcare industry. It can be as simple as learning medical terminology or learning about how things work in a healthcare environment, but that knowledge will definitely help you to better understand and address the legal issues.  It will also help make you more attractive to potential employers.

Interview by: 

Rachel Goodman, MFT

Senior Academic Program Coordinator with the UC Hastings Center for State and Local Government Law. She is also a psychotherapist in private practice in Berkeley, CA.