Steven "Steve" D. Gravely


Business Phone: 804.697.1308
Business Fax: 804.698.5158


Steve Gravely focuses his practice in the areas of health law, information privacy and cybersecurity and emergency preparedness and response issues for critical infrastructure industries. He has represented healthcare organizations for over 20 years in a full spectrum of healthcare legal issues. Steve is certified by the International Association of Privacy Professionals (IAPP) as a Certified Information Privacy Professional in the United States (CIPP/US).

Representative Matters


Regulatory Compliance

  • Provide on-going advice on state and federal legal and regulatory issues. 
  • Advise clients on complex reimbursement and payment issues.

Healthcare Mergers and Acquisitions

  • Successfully represented healthcare organizations in the acquisition and sale of healthcare facilities.
  • Serve as regulatory counsel to acquisitions of multi-state healthcare companies.
  • Serve as regulatory counsel on financing healthcare transactions.
  • Successfully merged healthcare providers into new provider entities.

Health Information Technology

  • Lead Author of the Data Use Reciprocal Support Agreement in support of interoperable health data exchange using the Nationwide Health Information Network.
  • Lead and facilitate multiple national workgroups on complex issues related to the legal structure, trust agreements and governance issues of the Nationwide Health Information Network.
  • Assist with the development of Health Information Exchanges including advising on the following:
    • Legal structure,
    • Governance,
    • Privacy and security frameworks,
    • Operational policies and procedures,
    • Breach notification,
    • Data exchange agreements,
    • Advise clients on e-health issues including HIPAA Privacy and Security, FISMA, ARRA and HITECH, and 
    • Provide strategic advice on emerging issues around privacy and security, “meaningful use” and health IT developments.

 Healthcare Compliance

  • Represented major hospital providers in several multimillion dollar federal Medicare fraud investigations negotiating successful settlements.
  • Advise healthcare clients on internal investigations and voluntary disclosures.
  • Serve as counsel to hospital compliance committees.

Homeland Security & Emergency Preparedness

  • Lead Author of comprehensive whitepapers on key emergency preparedness issues for healthcare providers related to:
    • Alternate Care Facilities,
    • Continuity of Operations,
    • Human Resource Planning,
    • Liability and Altered Standards of Care,
    • HIPAA, and
    • EMTALA.
  • Serve as lead on an Essential Services Grant for the U.S. Centers for Disease Control and Prevention (CDC) resulting in a revised Critical Resource Shortage Planning Guide, a Critical Resource Shortage Implementation Guide and a set of Implementation Resources.
  • Lead and facilitate multiple complex workgroups on legal and policy issues related to emergency preparedness and response including H1N1.
  • Advise the Secure Commonwealth Panel, Health & Medical Sub-Panel on legal aspects of preparedness issues.
  • Advise state hospital associations on multiple issues related to emergency preparedness and response.
  • Coordinated multi-year initiative to update Virginia law on liability of healthcare providers during declared disasters resulting in passage of legislation in the 2008 Virginia General Assembly.
  • Coordinated effort to update Virginia law to extend liability protection to volunteers of Medical Reserve Corps and Citizen Emergency Response Teams passed by the Virginia General Assembly in 2008.
  • Coordinate, and principal author of, comprehensive rewrite of Virginia laws on quarantine and isolation which were unanimously passed by the Virginia General Assembly, 2004.
  • Advise healthcare providers and public health officials on issues related to surge capacity and response to emergencies.
  • Advise major electric utility on emergency preparedness issues for H1N1 and other public health emergencies.
  • Serve as co-facilitator of CDC Foundation Toronto Workshop, SARS Lessons Learned by the Business Community; Toronto Canada - March 2005.
  • Serve as Technical Advisor on numerous emergency preparedness table top exercises.

Presentations and Speaking Engagements

  • Legal Analyst, “The ABCs of Cyber in Your Captive: Assessing Risk, Bench-Marking Exposures, and Creating Coverage,” North Carolina Captive Insurance Association Annual Meeting, August 2017.
  • Legal Analyst, “Healthcare Cybersecurity: Maintaining Operations when Operations Fail’” UAB 37th National Symposium for Healthcare Executives, August 2017.
  • Webinar, “Health Information Exchange: A National Perspective,” The Intersection of Public Health and Health Care: Health Care Data and the Law in the 21st Century, Part III: Sharing Data: Modern Legal Issues and Trends, August 2017.
  • Webinar, “Healthcare Updates and the Future of the Affordable Care Act”, June 2017.
  • Webinar, “Wanna Cry Ransomware: Understanding the Cyber Attack that Rocked Healthcare Organizations Around the World,” The Crypsis Group, May 2017.
  • Webinar, “Trump’s first 100 days: health and life sciences,” EY, April 2017.
  • Legal Analyst, “The New Administration’s Impact on Healthcare,” HiMSS Advocacy Day, January 2017.
  • Legal Analyst, “Complying with the New CMS Emergency Preparedness Rule for Medicare and Medicaid Providers and Suppliers,” Strafford CLE, January 2017.
  • Legal Analyst, “Understanding the DURSA” The Sequoia Project, December 2016.
  • Legal Analyst, Webinar “Connected Devices in the Healthcare Industry,” Troutman Sanders and Lockton Webinar Series, November 17, 2016.
  • Legal Analyst, Missouri Hospital Association Annual Conference, October 13, 2016.
  • Moderator, “Common Good - 2016 Innovation Conference,” Health Technology Forum, Stanford University, May 23, 2016.
  • Legal Analyst, Webinar “Cybersecurity in the Healthcare Industry: Ransomware,” Troutman Sanders and Lockton Webinar Series, May 19, 2016.
  • Co-Host, New York City MedTech Forum, March 9, 2016.
  • Moderator and Legal Analyst, Webinar “Electronic Health Records (EHRs) and Inter-operability: Improved Health Technology and Transformed Health Care in 2016,” The Knowledge Group, February 11, 2016.
  • Legal Analyst, "Addressing Additional Risk from the ‘Internet of Things’: Lessons from the Healthcare Sector/Technological Trends in eHealth Services, Supporting Infrastructure, and What to Expect for Future Remote Monitoring Devices," Law Seminars International, January 13, 2015.
  • Legal Analyst, “Legal View with Ashleigh Banfield: When is Quarantining Legal/Illegal?”, CNN, October 28, 2014.
  • Legal Analyst, “The World, Hosted by Marco Werman,” KCRW, Santa Monica, CA, October 28, 2014.
  • Webinar, “Legal Agreements for Exchange,” National eHealth Collaborative, May 2011.
  • Webinar, “The Trust Fabric of the NHIN: Making Exchange a Good Choice,” National eHealth Collaborative, May 2010.
  • Virginia Hospital and Healthcare Association Webinar series on legal issues related to H1N1 preparedness, September - October 2009.
  • Virginia Hospital and Healthcare Association Annual Hospital Forum on Emergency Preparedness, 2005 - 2009.
  • U.S. Department of Health and Human Services, Office of Critical Infrastructure Protection, Workgroup on Healthcare Preparedness, September 2009.
  • 19th Annual Executive Leadership Conference, American Counsel for Technology/Industry Advisory Council, October 2009.
  • NACCHO Public Health Preparedness Summit, San Diego, CA, February 2009.
  • Homeland Defense Journal Surge Capacity Conference, Washington, DC, October 2008.
  • Indiana Hospital Emergency Preparedness Workshop, September 2008.
  • Confronting the Ethics of Pandemic Influenza Planning: 2008 Summit of the States, Indianapolis, IN, July 2008.
  • Henrico Doctors Hospital Medical Staff CME on Altered Standards of Care, May 2008.
  • Catastrophic Event Resource Planning Workshop, May 2008.
  • Virginia Health Care Association Legislative Conference, Richmond, VA, February 2008.
  • Virginia Society for Healthcare Human Resources Association, Richmond, VA, October 2007.
  • American Health Information Community: HIMSS 2008 Conference, Nationwide.
  • Community Health Information Network: Data Use and Reciprocal Support, February 2008.
  • American Bar Association/CDC Conference on XDR TB, July 2007.
  • American Nurses Association Quadrennial Policy Conference, Atlanta, GA, June 2007.
  • CDC Legal Preparedness Summit, Atlanta, GA, June 2007.
  • New Jersey Hospital Association Pandemic Influenza Preparedness, Princeton, NJ, June 2007, January 2008.
  • EUCI Pandemic Influenza Conference for Electric Utilities, Seattle, WA, May 2007.
  • Harvard School of Public Health/School of Business Symposium on Pandemic Influenza, Boston, MA, May 2007.
  • Conference of Emergency Preparedness Coordinators, Altered Standards of Care, Savannah, GA, March 2007.
  • Atlanta Bar Association CLE - Pan Flu Planning, Atlanta, GA, November 2006.
  • EEI Pandemic Influenza Conference, Washington, DC, October 2006.
  • Virginia Society for Hospital Risk Management Conference, Fredericksburg, VA, September 2006.
  • American Bar Association Teleconference – Pan Flu Preparedness, June 2006.
  • UVA Institute for Practical Ethics and Public Life, Hospital Bio-Ethics & Pandemic Influenza, Charlottesville, VA, May 2006.
  • Commonwealth of Virginia - Pandemic Influenza Summit, Breakout Session on First Responders, March 2006.
  • VDH Community Based Emergency Response (CBER) Program, Speaker on Communicable Disease Containment Issues - Multiple programs throughout state during 2006.
  • Louisiana Hospital Association Hospital Law Symposium, Baton Rouge, LA, November 2005.
  • American Bar Association, Health Law Section, Emerging Legal Issues Conference, Disaster Preparedness Legal Issues, Orlando, FL, February 2005.
  • American Public Health Association 132nd Annual Meeting & Exposition, Public Health and the Environment, Washington, DC, November 2004.
  • CDC Public Health & the Law Conference in the 21st Century, Atlanta, GA, June 2004, June 2006.


Professional and Community Involvement

  • American Health Lawyers Association
  • American Bar Association, Health Law Section
  • Virginia State Bar Health Law Section
  • Virginia Bar Association, Health Law Section
  • Health Care Compliance Association
  • Health Care Financial Management Association
  • American Public Health Association
  • Central Virginia Health Care Executive Group (ACHE Chapter)

Rankings and Recognition

  • Named to Virginia Business magazine's Legal Elite in Health law, 2003, 2005, 2006, 2009-2014, 2016.
  • Selected by Law & Politics as a Virginia Super Lawyer in Healthcare Law, 2006-2016.
  • Recognized in The Best Lawyers in America in Healthcare Law, 2010-2018.

Professional Experience

  • Partner, Troutman Sanders LLP, 2000–present
  • Partner, McCandlish Kaine, 1987–2000
  • Partner, Seawell, Dalton, Hughes & Timms, 1984–1987
  • Law Clerk, Virginia Supreme Court, 1983–1984
  • Office of the Attorney General, Commonwealth of Virginia, Summer 1982
  • Office of the Chief Medical Examiner, Commonwealth of Virginia, Summer 1981
Hospital Operations
  • Richmond Memorial Hospital, 1980–1982
  • Southside Regional Medical Center, 1979–1980
  • Blue Cross Blue Shield of Virginia, 1979
  • Riverside Hospital and Healthcare System, Newport News, VA, 1977–1978
  • Williamsburg Community Hospital, Williamsburg, VA, 1973–1977
Emergency Medical Services
  • Williamsburg Fire Department and Rescue Squad, 1973–1977



  • University of Richmond, J.D., 1983
  • Medical College of Virginia, M.S., 1980
    Master of Health Administration
  • College of William and Mary, B.A., 1977

Bar Admissions

  • Virginia