Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

BakerHostetler Team Files Amicus Brief Against SEC by The Digital Chamber

Edward Beckwith Helps Launch Legacy Giving Advisory Council for Washington, DC, Theater

James Sherer Remarks on New York Telling Insurers to Test AI for Compliance with Consumer Protection Laws

Michael Semes Provides Detail on Zilka v. City of Philadelphia Tax Review Board in Law360 Article

Sara has led BakerHostetler’s response to several high-profile data security incidents that involved the data of hundreds of firm clients. As the leader of these matters, she developed the strategy for the incident response process, oversaw the team of attorneys working directly with clients and created processes and protocols for the attorney team to follow.

Prior to joining BakerHostetler, Sara was the vice president and general counsel of the nation’s second-largest provider of release of information and disclosure management services, where she was responsible for overseeing all of the company’s legal and compliance-related matters. This experience gives her a depth of knowledge regarding clients’ needs, bringing a business-oriented perspective to her practice and allowing her to provide legal guidance that is realistic and practical for clients.

Sara has been quoted in numerous publications, including The Wall Street Journal, Law360, Fierce Healthcare, Becker’s Healthcare and Healthcare Info Security Podcast. She has also authored a variety of articles on privacy and data security in publications such as Westlaw Journal Computer and Internet, Journal of the American Health Information Management Association, The Group Practice Journal and Health Affairs. In addition, Sara served as an Editor-in-Chief of BakerHostetler’s annual Data Security Incident Response (DSIR) Report from 2021 to 2024. Sara has been invited to speak to organizations across the country about compliance with federal and state privacy laws and the incident response process. She also served as an adjunct professor of law at Drexel University, where she taught a course on the Health Insurance Portability and Accountability Act (HIPAA) and patient privacy.

core/freeform

J.D., Health Law, Drexel University Thomas R. Kline School of Law, 2011

B.A., Government and Italian, Smith College, 2008

<ul>
<li>Law360: Cybersecurity and Privacy: Rising Star (2021)</li>
<li>The Pennsylvania Legal Intelligencer: Lawyers on the Fast Track (2021)</li>
<li>The Legal 500 United States
<ul>
<li>Media, Technology and Telecoms: Cyber Law (including data privacy and data protection) (2023 to 2024)</li>
</ul>
</li>
<li>The Best Lawyers in America®
<ul>
<li>&#8220;Ones to Watch&#8221; in Pennsylvania for Technology Law (2024)</li>
</ul>
</li>
</ul>

Philadelphia

BakerHostetler attorneys, practice areas stand out in The Legal 500 annual guide

DADM Practice Group Selected for Vault’s “Guide to Legal Practice Areas” for 7th Consecutive Year

Sara Goldstein Comments on Change Healthcare Breach in Wall Street Journal Article

Change Healthcare Incident: Update on ‘Impacted Data’ Analysis and Notification Plan

Sara Goldstein Discusses Significant Impact of the Change Healthcare Mega Hack on Podcast and in Several Articles

Theodore Kobus, Sara Goldstein, Lynn Sessions Weigh in On Change Healthcare’s Data Security Incident

Imminent Cybersecurity Threats to Healthcare Revenue Cycle Management

BakerHostetler Attorneys and Practice Areas Recognized in The Legal 500 2023 Guide

Data Counsel

Pennsylvania’s Data Breach Notification Law Is Changing: What Does It Mean for Entities Doing Business in the Keystone State?

Sara Goldstein Addresses Cybersecurity for Cancer Centers Compliance Committee

Sara Goldstein Speaks at Incident Response Forum Europe 2022

Sara Goldstein Addresses CCI Healthcare Chief Legal Officer Roundtable

Sara Goldstein Presents to Tech Directors on Cybersecurity

Sounding the Alarm: New Federal Law Will Mandate the Reporting of Cybersecurity Incidents Involving Critical Infrastructure – What Companies Need to do now to be Prepared

Sara Goldstein Shares Cybersecurity Tactics with School Business Officials

Sara Goldstein Addresses Healthcare Cybersecurity on Career Series Panel

Sara Goldstein A Speaker at CCI Healthcare Chief Legal Officer Roundtable

Sara Goldstein Speaks on Cyber Threats

Sara Goldstein, Craig Hoffman Speak at American Council of Life Insurers Conference

Sara Goldstein Talks about Careers in Law and Technology

Sara Goldstein Speaks at Drexel Law School on HIPAA Law

New Director of HHS Office for Civil Rights Announced: What could Lisa J. Pino’s appointment mean for future HIPAA enforcement?

Sara Goldstein Joins Panel Discussion on Ransomware Attacks

Sara Goldstein on Panel to Discuss “Quantifying Risk in the Investigative Process”

Sara Goldstein Profiled as “Rising Star” in Cybersecurity, Privacy Law

Camille Bent, Sara Goldstein Named Among Law360’s “Top Attorneys Under 40”

Executive Order on Improving the Nation’s Cybersecurity: What Does It Mean for Business?

Sara Goldstein Comments on Biden Administration Order Requiring Tougher Cybersecurity Measures

Sara Goldstein to Discuss Data Privacy at Real Estate Law Conference

Sara Goldstein Speaks on COVID-19 Vaccination Records and HIPAA

Sara Goldstein Named a “Lawyer on the Fast Track” by The Legal Intelligencer

Sara Goldstein Speaks on Cybersecurity Threats

Sara Goldstein, David Sherman Discuss European Privacy Concerns

Sara Goldstein, Jessica Captain Novick, Lynn Sessions Author Article about Challenge to HHS Privacy Fines

Court Finds HHS Had No Lawful Basis Under HIPAA for a $4.3 Million Civil Money Penalty: What Does This Mean for Future HHS Enforcement Actions?

Compliance and Cybersecurity Best Practices Rewarded with HIPAA Safe Harbor

BakerHostetler Elevates 22 Attorneys to Firm Partnership

Andreas Kaltsounis, Sara Goldstein Address Cyber Risks of Remote Work

CISA Updates Advisory on Large-Scale Impending and Credible Ransomware Threat to Healthcare to Include Additional IOCs

Webinar: Cyber Risks Facing GCs: What We’ve Learned From 6 Months of Remote Work

Digital Assets and Data Management

Healthcare Privacy and Compliance

Digital Risk Advisory and Cybersecurity

Industries

Healthcare

State Attorney General Enforcement, Investigations and Litigation

<ul>
<li>Advises clients in the healthcare, energy, retail, financial, higher education, public and nonprofit sectors on responding to cybersecurity and data privacy incidents in the U.S. and abroad, ranging from phishing incidents to sophisticated, state-sponsored network intrusions.</li>
<li>Leads investigations of data security incidents, including the selection and engagement of third-party forensic investigators and interactions with law enforcement.</li>
<li>Provides clients with guidance on federal, state and international breach notification law requirements, as well as contractual notification obligations.</li>
<li>Drafts notification materials, including notification letters, press releases, website notices, internal client communications and regulatory notices.</li>
<li>Oversees the post-breach response process, including the preparation of responses to questions from notice letter recipients, employees, customers, the media and regulators.</li>
<li>Represents clients in post-breach investigations from the U.S. Department of Health and Human Services Office for Civil Rights, state insurance departments, state attorneys general (including multistate taskforce) and other regulators arising from large and small data security incidents.</li>
<li>Provides guidance on HIPAA, health information management and privacy to healthcare providers across the country.</li>
<li>Conducts data security training and tabletop exercises for companies to help them develop their incident response plans.</li>
<li>Develops comprehensive HIPAA privacy and security policies and procedures, business associate agreements, privacy notices and training materials.</li>
<li>Completed a secondment at one of the top cybersecurity insurance carriers in the world.</li>
<li>Provided on-site support and guidance to a large health insurer following the discovery of a data security incident involving the personal information of over 3 million individuals.</li>
<li>Drafted the regulatory notices for one of the largest data security incidents in history that involved the personal data of over 500 million individuals worldwide.</li>
<li>Served as vice president and general counsel for the second-largest provider of disclosure management and release of information services in the U.S.</li>
</ul>

Sara M. Goldstein

Sara M. Goldstein

Experience

Recognitions and Memberships

Insights and News

Prior Positions

Credentials

Languages

Community and Pro Bono

Areas of Focus

Industries

Services

Featured Insights