John Norton is a Partner at Mullen Coughlin and focuses his practice on incident response. He responds to, and investigates, data privacy and security incidents on behalf of victim organizations across all industry sectors and of all sizes. In this role, he coordinates the third-party forensic investigation and then counsels the victim organization on their legal and/or regulatory obligations stemming from the incident. John also represents organizations in regulatory investigations related to data privacy and security incidents.

Prior to joining Mullen Coughlin, John was an associate at a civil litigation firm where he handled cases related to general and professional liability defense matters. He also was a Judicial Intern for the Honorable Gary Gilman in the Bucks County Court of Common Pleas.

John received his J.D. from Drexel University Thomas R. Kline School of Law and his B.S. in Accounting from the University of Delaware.

REPRESENTATIVE MATTERS

• Counseled medical liability providers and management servicers through data privacy and security incident investigations involving ransomware and/or unauthorized access to email accounts which resulted in notice obligations to thousands of clients and individuals
• Counseled large healthcare providers through widespread ransomware incidents causing service outages and involving the compromise of patient data, satisfying notice and reporting obligations under applicable contracts, state law and federal laws, including the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act)
• Advised large law firms through incidents that impacted the security of client information and provided guidance on disclosure obligations to clients and opposing parties

SPEAKING ENGAGEMENTS & PRESENTATIONS

• “Legal Updates – Federal & Beyond,” Continuing Legal Education, Devon, PA, March 24, 2025