Zick

Colin J. Zick

Partner
Chair, Healthcare Compliance Practice
Chair, Privacy and Data Security Practice
Boston

I am a “go-to” problem-solver for clients, with 30-plus years of experience unraveling regulatory and compliance problems.

Colin Zick’s practice is focused on healthcare and compliance issues, and often involves the intersection of those two subjects in investigations, administrative proceedings, or litigation. His work has had a particular emphasis on compliance issues related to life sciences, pharmaceutical and medical device companies, laboratories, hospitals, healthcare providers, and provider organizations. 

This compliance work includes helping clients establish and maintain effective compliance programs. Colin also defends clients in disputes alleging kickbacks, overpayments, and billing and coding problems, and represents clients before state healthcare licensing and regulatory entities. 
 
Colin also frequently counsels healthcare, life science, technology and consumer-facing clients on issues involving information privacy and security (including HIPAA and other federal and state data privacy and security laws, EU/GDPR privacy and security issues, and data breach response). Colin co-founded the firm's Data Security and Privacy Practice Group and regularly contributes to its "Security, Privacy and the Law" blog. 
 
Colin’s practice also includes work on healthcare transactional matters. These projects include mergers and acquisitions, the establishment of joint ventures, the creation of new entities, drafting and negotiation of management service and employment contracts, creation of patient assistance programs, and negotiating data use and clinical trial agreements. He also has successfully litigated commercial disputes, covenants not to compete, antitrust and unfair competition claims, and copyright infringement claims. 

Education

  • University of Michigan Law School, J.D., cum laude
  • University of Michigan, B.A., with highest distinction, Phi Beta Kappa

Bar and Court Admissions

BAR ADMISSIONS
  • Massachusetts
  • New Hampshire
COURT ADMISSIONS
  • U.S. District Court for the District of New Hampshire
  • U.S. District Court for the District of Massachusetts
  • U.S. Court of Appeals for the First Circuit
  • U.S. Court of Appeals for the Ninth Circuit

Experience

FRAUD, ABUSE & COMPLIANCE
  • Defended national health insurer against state unfair business practices claims
  • Advised genetic testing companies on fraud and abuse issues related to physician and patient interactions
  • Advised healthcare provider organization on response to federal grand jury subpoena
  • Served as special outside counsel for hospital investigation of Stark and Anti-Kickback issues
  • Represented the interstate specialty pharmacy in state False Claims Act investigation
  • Represented specialty health care provider in state False Claims Act litigation
  • Conducted review and analysis of health care compliance plan of publicly-held pharmaceutical company with over $2 billion in annual revenues and 8,500 employees
  • Successfully defended an independent physician association against claims under the federal anti-kickback statute
  • Represented a national health insurance company in responding to an investigation and lawsuit by a state attorney general’s office
  • Advised medical device and pharmaceutical manufacturers on federal and state "sunshine" laws regarding payments to physicians
PRIVACY
  • Advised owner of world's largest collection of human genomes on E.U./U.S./international data privacy issues related to formation of partnership to discover and develop novel therapeutics and companion diagnostics 
  • Advised international consumer products company on compliance with the California Consumer Privacy Act 
SECURITY
  • Represented health insurer in data breach response and related indemnification claims against party responsible for breach, collecting seven-figure settlement
  • Advised Fortune 1000 companies on information security and health information practices and data breach response 
  • Advised social media company on breach response under GDPR
  • Secured a positive anti-kickback advisory opinion from the Department of Health and Human Services Office of Inspector General
TRANSACTIONS
  • Advised Metropolitan Partners Group, in a senior secured credit facility to the operator of multi-location, multi-specialty ambulatory surgical centers across New York and New Jersey
  • Represented crediton/interested party in Steward Healthcare bankruptcy
  • Advised major athletic conference on the establishment of a COVID testing regime
  • Represented multi-specialty physician practice in creation of urgent care joint venture with teaching hospital
  • Advised multi-specialty physician practice in merger to create 1000+ physician practice with over $2 billion in annual revenue
REPORTED CASES

Other Publications

  • Co-Author, AHLA's "Health Care Fraud Law: A 50-State Survey," Connecticut and New Hampshire Chapters (2025)
  • Co-author, "Navigating the Post-Dobbs World: Key Considerations for Health Care Providers," Chapter in Health Law Handbook (November 2023)
  • Co-author, "Digital Health: Navigating Regulatory Challenges as Innovation Charges Ahead," Health Law Handbook, 2023-2024 Edition (October 2023)
  • Contributor, Opioid Prescribing - An AHLA 50 State Survey, American Health Lawyers Association (February 2020) 
  • No Harm, No Foul? Private and Public Litigation in Cybersecurity Law, INSIDE COUNSEL (July 2016)
  • Summary of Fraud and Abuse Statues & Regulations - New Hampshire, AMERICAN HEALTH LAWYERS ASSOCIATION (September 2008-present)
  • The Massachusetts eHealth Collaborative and Its Efforts to Bring Electronic Health Records to Massachusetts (with Micky Tripathi), 1 THE BOSTON HEALTH LAW REPORTER 18 (Spring 2006) 
  • Editor, THE MEDICOLEGAL GUIDE TO HEALTH RECORD INFORMATION (Massachusetts Health Information Management Association) (1997 and 2005 editions) 
  • HIPAA: The New Federal Privacy Rules and Their Implications, BOSTON BAR JOURNAL (September/October 2002) 
  • The Continuing Dilemma of Compliance with Requests for Health Information, BOSTON BAR JOURNAL (May/June 1999) 
  • Compensation for Telemedicine Services, 2 JOURNAL OF MEDICINE AND LAW 117 (Spring 1998)
IN THE MEDIA

Honors & Involvement

HONORS
  • Received "Meredith Clapp Community Outreach Award" from Hill House Boston Community Center (2025)
  • Named to "Best Lawyers" for Healthcare Law (2015-2027), Privacy and Data Security Law (2019-2027), Criminal Defense: White Collar (2026-2027), and Litigation - Healthcare (2026-2027)
  • Named a Top Lawyer in the area of Health Care Law by Boston Magazine (2021-2025)
  • Named a “Go To Lawyer” for Cybersecurity & Data Privacy in 2022 by Massachusetts Lawyers Weekly
  • Selected by his peers for inclusion in THE BEST LAWYERS IN AMERICA in the fields of Health Care and Privacy and Data Security
  • Ranked by CHAMBERS USA: AMERICA'S LEADING LAWYERS FOR BUSINESS as one of Massachusetts' leading Healthcare attorneys (2010-2026)
  • Massachusetts Super Lawyers: Health Care Law (2004-2026)
  • High Honor, Massachusetts Supreme Judicial Court Pro Bono Honor Roll (2019-2024)
  • JD Supra “Top Author” Readers’ Choice Award (2017)
  • Martindale-Hubbell AV Preeminent (R) rating
  • Massachusetts Health Information Management Association HIM Advocacy Award recipient (2014)
  • Campbell Moot Court Competition semi-finalist, University of Michigan School of Law (1990)
INVOLVEMENT
  • Member, New Hampshire Bar Association, Special Committee on Artificial Intelligence (2024-present)
  • Boston Bar Association, Co-Chair, Health Law Section (2010 - 2012) and Steering Committee member (2010 - 2017)
  • Lex Mundi (international law firm network) 
    • Chair - Health Care Industries Practice Group (September 2011 - May 2015)
    • North America Regional Vice-Chair, Health Care Industries Practice Group (October 2009 - August 2011)
    • North America Regional Vice-Chair, Data Privacy and Security Practice Group (May 2025 - present)
  • American Health Lawyers Association, Member (Participant, Fraud and Abuse Enforcement Panel)
  • Health Care Compliance Association, Member
  • The Alumni Association of the University of Michigan, Director (2000 - 2008)
  • President, Beacon Hill Civic Association (2024-present)
  • Board Member, Beacon Hill Civic Association (2007 - 2024)
  • Board Member, Friends of the Public Garden (2007-2013, 2026-present), Vice Chair (2013 - 2026)
  • Board Member and Clerk, Trinity Boston Foundation (2010 - 2017), Board of Visitors (2018 - 2026)

Events

The Current State of Cyber & AI Regulations Page
Speaking Engagement 03/05/2025
FDA and Life Sciences Summit Page
Foley Hoag Event 05/21/2024
AI in the Practice of Law Page
Speaking Engagement 05/08/2024
MEDTECH Cybersecurity: Elusive but Possible Page
Speaking Engagement 10/05/2020
Returning to Work in the COVID-19 Era Page
Foley Hoag Event 05/26/2020
Policy and CyberMA Seminar Page
Speaking Engagement 09/12/2019
HIPAA Crimes Webinar Page
Foley Hoag Event 05/17/2016
New England M&A Forum Page
Foley Hoag Event 01/19/2016
Security and Privacy in the Cloud Page
Foley Hoag Event 07/30/2015
Compliance Beyond HIPAA Seminar Page
Foley Hoag Event 04/30/2015

Speaking Engagements

  • "Artificial Intelligence for Healthcare Providers:  Practical Guidance and Traps for the Unwary," Massachusetts Health Information Management Association (with Sam Hoff), September 16, 2026
  • Privacy, Security and AI in Robotics: Navigating Legal and Regulatory Issues," MassRobotics, June 23, 2026
  • "Health Center Compliance Academy: Federal Tort Claims Act (FTCA) and Other Risk Management Considerations," Massachusetts League of Community Health Centers (with Sam Hoff), June 4, 2026
  • Moderator, "Rethinking Data Privacy & Security in an AI World," Advanced Cyber Security Center 4th Annual AI & Cyber Risk Governance Workshop, May 13, 2026
  • "Artificial Intelligence in the Community Health Center: Navigating Compliance, Data Privacy, and Other Considerations in a Rapidly Evolving Landscape," (with Sam Hoff), 2026 Community Health Institute Annual Conference, May 4, 2026
  • "AI Governance in Pharma," ACI’s 2nd Annual Summit on Life Sciences Cyber, Biosecurity and Data Privacy (April 2026)
  • "AI in Data Privacy and Cybersecurity Law: Navigating Risk, Responsibility, and Regulation," Lex Mundi (March 2026)
  • "Robotics and Health Information: Navigating Clinical Deployments in Light of Current Trends in Health Information Privacy and Security", MassRobotics Healthcare Catalyst Program (March 2026)
  • "Law & Technology in the Digital Era," Suffolk University Law School (Panelist) (March 2026)
  • "AI/Cyber Policy, Regulations, and Standards," Advanced Cyber Security Center, with Lavonne Burke, Esq. of Dell and Avi Gessner, Esq. of Debevoise (February 2026)
  • "42 CFR Part 2: What Changed, Why It Matters, and How It Aligns with HIPAAs," Massachusetts Health Information Management Association (November 2025)
  • "Winning the Competition for Trusted AI: A Risk and Security Agenda," Advanced Cyber Security Center (Moderator) (November 2025)
  • "Privacy and Data Security Considerations," MassRobotics, with Chris Hart and John Lanza (October 2025)
  • "Enforcement Trends and Litigation Risks in Life Sciences - 2025 and Beyond," Foley Hoag's Boston Life Sciences Summit, with David Lazarus and Professor Jacob Elberg (October 2025)
  • "Evaluating Artificial Intelligence Platforms," New Hampshire Bar Association (October 2025)
  • "From Coldplay to Crisis: Real-World Lessons in Law Firm Cybersecurity and Data Breach Response," Mass Lawyers Weekly Crisis Management Conference, with David Sun (September 2025)
  • “AI & Digital Transformation in Bioprocessing—Opportunities versus Realities?," 17th Annual Bioprocessing Summit (August 2025)
  • "Making Your Case:  AI Governance and Boardroom Skeptics," Advanced Cyber Security Center Annual AI & Cyber Risk Governance Workshop, (May 2025)
  • "Federally Qualified Health CenterRisk Management: Regulatory Updates & Best Practice Highlights (with Sam Hoff)," 2025 Community Health Institute Annual Conference (April 2025)
  • "Artificial Intelligence in the Law Today," New Hampshire Bar Association (April 2025)
  • "The Current State of Cyber & AI Regulations," Advanced Cyber Security Center (March 2025)
  • "Evolving AI Governance, AI Councils, and Risk Frameworks," ACSC Member Conference (November 2024)
  • “AI & Technology: Navigating Innovation, Technological Advancements, and Evolving  Regulations," Bioprocessing Venture, Innovation and Partnering Conference (August 2024)
  • "Reimbursement and Healthcare Compliance," Foley Hoag FDA and Life Sciences Summit (May 2024)
  • "Sales and Market Access Programs: Current Legal Perspectives & Compliance Challenges," 27th Diagnostic Coverage & Reimbursement Conference (May 2024)
  • "Cyber Risk Governance Workshop," Advanced Cyber Security Center (May 2024)
  • "AI in the Practice of Law," Lex Mundi Connect + Collaborate Annual Conference (May 2024)
  • "Legal Perspective: Data Privacy Considerations Within Medical Information Operations," 9th Customer Centric Medical Information Conference (April 2024)
  • "Transforming Care - Strategies for Integration of Artificial Intelligence in Healthcare,"  New England Healthcare Executive Network (April 2024)
  • "Data Privacy Considerations Within Medical Information Operations," Q1 Productions Annual Customer Centric Medical Information Conference (April 2024)
  • "Responding to the New SEC Incident Reporting Regulations and Standards," ACSC Cyber Risk Governance Series Program (March 2024)
  • "The Future of Artificial Intelligence for Lawyers - Useful Tool or the End of the Profession?," New Hampshire Bar Association Midyear Meeting (February 2024)
  • "What Do the SEC’s New Regulations and the SEC’s Pursuit of SolarWinds Mean for Internal Security Professionals," InfraGard (January 2024)
  • "Cybersecurity and the Healthcare Industry: A Continuously Changing Threat," New England Healthcare Executive Network (November 2023)
  • "Developments in HIPAA and Related Issues in Health Information Law (that You Can’t Learn from ChatGPT)," MaHIMA Dot Wagg Memorial Legislative Seminar (November 2023)
  • "Federal and State Privacy Laws: Practical Issues and Implications," Suffolk University Law School (October 2023)
  • "What NY Attorneys (and Everyone Else) Need to Know: Privacy, Cybersecurity, and Data Protection," Foley Hoag (October 2023)
  • "Notable Legislative Developments for Laboratories," DxCon 2023 (September 2023)
  • “Boston Cyber Briefing,” SentinelOne (July 2023)
  • “Privacy, Cyber Security and Data Protection 101: A Primer That Addresses New York’s New Mandatory CLE Requirement,” Foley Hoag (June 2023)
  • “Law Firms, Municipalities and Hospitals are Under Attack: Security, Privacy and the Law,” Toss C3, (June 2023)
  • “Law Firms Are Under Attack: Security, Privacy and the Law – Be Prepared and Protect Your Organization,” Toss C3 (May 2023)
  • “Marketing in an Increasingly Privacy-First World,” New England Corporate Counsel Association (February 2023)
  • “Healthcare Under Attack,” Charleston CyberLaw Forum (January 2023)
  • “As the Experts: MaHIMA Dot Wagg Legislative Seminar,” with Linda Sanches, Senior Advisor for HIT and Privacy Policy, Office for Civil Rights · U.S. Department of Health and Human Services (November 2022)
  • "Real Life Health Information Compliance Issues," HIPAA, the Pandemic, and More MaHIMA Annual Conference (June 2022)
  • "Adjusting COVID-19 Protocols Amid the Rise of the Delta Variant," Foley Hoag Webinar (August 2021)
  • “U.S. Legal Developments: California and Beyond,” Boston Bar Association, Virtual Privacy and Cybersecurity Conference (December 2020)
  • "New Developments in HIPAA and Related Issues in Health Information Law," MaHIMA Dot Wagg Memorial Legislative Seminar (October 2020)
  • "MEDTECH Cybersecurity: Elusive but Possible," New England Healthcare Executive Network (October 2020)
  • “CCPA: What you need to know now and what to expect in the future,” Webinar, MassTLC (April 2020)
  • “Market Access Programs: A Legal Perspective.” DxConference - Advancing Market Access for Diagnostics (October 2019)
  • "GDPR, CCPA, and All That Jazz," Mass Technology Leadership Council (September 2019)
  • "The Interplay of HIPAA, Privacy and Data Security Principles, and Health Information Interoperability," MedInnovation Boston (June 2018)
  • "Setting Security Strategies and Getting Real About GDPR," MassTechnology Leadership Council CISO Roundtable (February 2018)
  • "Privacy and Data Breach Issues for Pharmaceutical/Medical Device Manufacturers and Other Life Sciences Companies," Lex Mundi Health Care and Life Sciences Practice Group Meeting (January 2017)
  • "HIPAA, Industry-Provider Interactions, and Related Compliance Matters," MichBIO Bioscience Regulatory Compliance Workshop (January 2017)
  • "Legal, Regulatory and Compliance Issues for Labs," American Clinical Laboratory Association Annual Meeting (May 2015)
  • "Connecting Medical Products to the Internet of Things:  Legal and Related Challenges for Connected and Mobile Medical Devices," Medical Development Group Seminar (April 2015)
  • "Cyber Risk and the Boardroom: The Role of Cyber Insurance," New York Stock Exchange Governance Series (April 2015)
  • "In the Belly of the Breach: What Every In-House Counsel Needs to Know about Data Breach Response," ACC International Legal Affairs Committee (with Gant Redmon, Co3 Systems) (May 2014)
  • "The Final CMS Sunshine Rule: Analysis, Interpretation and Implementation," American Conference Institute Webinar (March 2013)
  • "HIPAA Compliance: Understanding the New Federal Omnibus Rules and Preparing to Respond to a State/Federal Audit," Massachusetts Hospital Association (February 2013) (with Kevin C. Conroy)
  • "Protecting Health Information: Health Data Security Training," Attorney General Martha Coakley and Massachusetts Medical Society (October 2012)
  • "Patient Access Programs: A Legal Perspective," The Diagnostic Conference (DXCON14) (October 2012)
  • "Understanding the New U.S. Sunshine Act and Its Impact on Health Care Providers and Industry," Lex Mundi Webinar (January 2012)
  • "Good Governance Practices for Health Care, Educational & Other Non-Profit Organizations," Boston Bar Association (October 2011)
  • "What Every In-House Counsel Needs to Know About Data Security and Privacy," Association of Corporate Counsel and Lex Mundi, with Ed Palmieri, Privacy Counsel, Facebook (September 2011) 
  • "What Law Applies in the Cloud," CloudCamp (June 2011)