Legal News

Doctor Fined for Privacy Violations Following Abortion on 10-Year-Old Rape Victim

Posted by Steve Alder

Dr. Caitlin Bernard, an Indianapolis, IN-based obstetrician-gynecologist has been fined $3,000 by the Medical Licensing Board of Indiana and issued with a letter of reprimand for violating HIPAA and state privacy law after talking to the media about an abortion she provided to a 10-year-old rape victim on July 1, 2022.

Within hours of the Supreme Court’s decision that overturned Roe v Wade and removed the federal right to an abortion, Ohio banned abortions after 6 weeks of pregnancy. Three days later, on June 27, 2022, Dr. Bernard received a call from a child abuse doctor in Ohio about a 10-year-old patient who could not legally have an abortion in Ohio as she was three days past the legal cutoff. The victim then traveled from her home state of Ohio to Indiana to have the procedure performed by Dr. Bernard.

A reporter for the IndyStar overheard a conversation between Dr. Bernard and another doctor at an anti-abortion rally and approached Dr. Bernard and asked for comment. The IndyStar ran a story about the girl and the reduction of access to abortions following the Supreme Court’s decision, and the story rapidly became national news. The case was also referenced on multiple occasions by President Biden. Following the publication of the story, Dr. Bernard provided further statements to the media, was interviewed on national TV networks, and was featured in various media articles, in which Dr. Bernard highlighted the real-world impact of the change to federal law on abortions. In those media interviews, Dr. Bernard confirmed that she had performed an abortion procedure on a 10-year-old patient, but did not disclose the name of the patient.

Shortly after the publication of the IndyStar story, Indiana Attorney General Todd Rokita confirmed in a Fox News interview that Dr. Bernard would be investigated. Rokita filed an administrative complaint with the Medical Licensing Board of Indiana alleging Dr. Bernard had violated HIPAA and state law by failing to get written authorization to release patient information, and that Dr. Bernard had failed to immediately report suspected child abuse to local law enforcement in Indianapolis or the Indiana Department of Children Services. Rokita claimed that Dr. Bernard learned about possible child abuse on June 27, 2022, in a telephone call, yet failed to report it until July 2, 2022, the day after the procedure was performed. As such, the child was returned to the custody of the alleged rapist, where she remained until July 6, 2022. Law enforcement later confirmed, with a 99.99% probability, that the rapist was the child’s biological father, who was charged with two counts of rape in July 2022.

In a Medical Licencing Board hearing on Thursday, Dr. Bernard’s attorney explained that Dr. Bernard told an IU Health social worker about the case on the same day she received the initial call about the patient, and that discussion was in line with IU Health’s policies. She also confirmed that the abuse was reported on an Indiana state form and that the abuse had already been reported in Ohio where the abuse took place. The IU Health social worker testified that she reported the abuse in Ohio per IU Health policies, as that was where the abuse occurred. Dr. Bernard also confirmed with child protection staffers in Ohio that it was safe for the child to leave with her mother and testified that she did not violate state or federal privacy laws as she did not disclose any identifying information about the patient.

At the hearing, Deputy Attorney General Cory Voight asked Dr. Bernard why she had disclosed information about a real patient, rather than providing a hypothetical situation in her media interviews. “I think that it’s incredibly important for people to understand the real-world impacts of the laws of this country about abortion,” said Dr. Bernard in response. “I think it’s important for people to know what patients will have to go through because of legislation that is being passed, and a hypothetical does not make that impact.”

Andrew Mahler, a former official at the HHS’ Office for Civil Rights was an expert witness for the state and testified that the disclosures made by Dr. Bernard violated HIPAA, as it was certainly possible that the information disclosed by Dr. Bernard – age, state, and gender – would allow the girl to be identified. Paige Jayner, a privacy compliance officer and former OCR auditor, was a witness for the defense and disagreed with Mahler’s view, testifying that the information Dr. Bernard disclosed was not protected health information and that the disclosure was not a HIPAA violation. IU Health agreed and did not believe the HIPAA Rules had been violated. At the hearing, Dr. Bernard defended her right to speak to the media about medical issues when it is in the public interest and her attorney confirmed that there are no laws that prohibit physicians from speaking with the media.

Dr. John Strobel, President of the Medical Licensing Board believed Dr. Bernard disclosed too much information to the IndyStar reporter about the pending abortion and said consent should have been obtained before any information was disclosed. The majority decision of the Medical Licensing Board was the disclosures violated state and federal privacy laws and Dr. Bernard received a $1,000 fine for each of the three privacy violation counts. The Medical Licensing Board found the state had failed to meet the burden for the other two counts on reporting the child abuse and Dr. Bernard being unfit to practice, and therefore did not suspend Dr. Bernard or put her on probation so she is able to continue to practice in Indiana. Dr. Bernard will be given the right to appeal the decision.

The post Doctor Fined for Privacy Violations Following Abortion on 10-Year-Old Rape Victim appeared first on HIPAA Journal.

NY AG Fines Medical Management Company $550,000 for Patch Management Failures

Posted by HIPAA Journal

A medical management company has been fined $550,000 by the New York Attorney General for failing to prevent a cyberattack that exposed the personal and protected health information of 1.2 million individuals, including 428,000 New Yorkers.

Professional Business Systems Inc, which does business as Practicefirst Medical Management Solutions and PBS Medcode Corp, had its systems hacked in November 2020. The threat actor exfiltrated sensitive data from its systems and then deployed ransomware to encrypt files. As proof of data theft and to pressure Practicefirst into paying the ransom, files were uploaded to the threat actor’s dark web data leak site. The leaked data included screenshots of 13 patients’ protected health information. Practicefirst’s investigation confirmed the threat actor exfiltrated approximately 79,000 files from its systems, which contained names, dates of birth, driver’s license numbers, Social Security numbers, diagnoses, medication information, and financial information.

The investigation conducted by the Office of the New York Attorney General determined that the hacker gained initial access to Practicefirst’s systems by exploiting a critical vulnerability in its firewall. The firewall provider released an updated version of the firewall software in January 2019, but Practicefirst failed to apply the update. Practicefirst did not conduct penetration tests or vulnerability scans, or perform other security tests that would have highlighted the vulnerability before it was exploited.  The protected health information stored on its systems was also not encrypted. The New York Attorney General determined that these failures violated state law and the federal Health Insurance Portability and Accountability Act (HIPAA).

Practicefirst agreed to settle the alleged violations of HIPAA and state law. In addition to the financial penalty, Practicefirst has agreed to strengthen its data security practices and will offer affected individuals complimentary credit monitoring services. The data security measures agreed upon as part of the settlement include the development, implementation, and maintenance of a comprehensive information security program, encryption for health information stored on its systems, implementation of a patch management system with timely patching of vulnerabilities, regular vulnerability scans and penetration tests, and updates to its data collection, retention, and disposal practices.

“When a person is seeking medical care, their last concern should be the security of their personal information,” said Attorney General Letitia James. “Each and every company charged with maintaining and handling patient data should take their responsibility to protect personal information, particularly health records, seriously. New Yorkers can trust that when companies fail at their duty, my office will step in to hold them accountable.

The post NY AG Fines Medical Management Company $550,000 for Patch Management Failures appeared first on HIPAA Journal.

Updated Pennsylvania Breach of Personal Information Notification Act Now in Effect

Posted by HIPAA Journal

the 2022 update to the Pennsylvania Breach of Personal Information Notification Act (BPINA) is now in effect. The update broadened the definition of personal information to include medical information, health insurance information, and usernames in combination with a password or security question/answer that allows an account to be accessed. The update to BPINA was signed into law on November 3, 2022, and took effect on May 2, 2023.

Medical information is defined as any individually identifiable information contained in an individual’s current or historical record of medical history or medical treatment or diagnosis created by a health care professional. Health insurance information is defined as a health insurance policy number or subscriber identification number in combination with an access code or other medical information that permits misuse of an individual’s health insurance benefits.

The updated BPINA applies to state agencies, political subdivisions of the Commonwealth, and individuals or businesses that do business in the Commonwealth of Pennsylvania. A state agency includes any agency, board, commission, authority, or department of the Commonwealth and the General Assembly. The update also applies to state agency contractors, which are persons, businesses, subcontractors, or third-party subcontractors that have a contract with a state agency for goods or services, which requires access to personal information.

The updated BPINA requires notification to be issued when unencrypted and unredacted personal information is reasonably believed to have been accessed and acquired by an unauthorized individual, and if encrypted data is breached and the key to decrypt the data is also reasonably believed to have been obtained. No time frame is stipulated for issuing notifications, other than requiring them to be issued “without unreasonable delay”. When a breach occurs at a vendor, the vendor is required to notify the entity that provided the data, and that entity is responsible for making determinations and discharging any remaining notification duties.

Notifications must be issued by mail to the last known address, by telephone if the individuals concerned can be reasonably expected to be contacted by phone and are not required to provide personal information for verification, or via email, if a previous business relationship exists and a valid email address is known for that individual.  Electronic notifications are permitted if the notice directs the user to promptly change their password and security question or answer or to take other steps appropriate to protect that individual’s online account, provided sufficient contact information is held to allow the electronic notice to be served.

Any entity that is required by law to comply with HIPAA or the HITECH Act will be determined to be compliant with the updated BPINA provided they are compliant with the privacy and security standards of HIPAA and the HITECH Act, as will any state agency or state agency contractor that is compliant with the breach notification requirements or procedures established by the entity’s, state agency’s or state agency’s contractor’s primary state or functional federal regulator.

The post Updated Pennsylvania Breach of Personal Information Notification Act Now in Effect appeared first on HIPAA Journal.

FTC Proposes Changes to Modernize the Health Breach Notification Rule

Posted by HIPAA Journal

The Federal Trade Commission (FTC) has proposed changes to the Health Breach Notification Rule to strengthen the applicability of the Rule to health apps and other emerging direct-to-consumer technologies that collect, store, and transmit identifiable health data.

There has been an explosion of health apps and connected devices that collect health data, and those apps and devices are collecting vast amounts of health data. There are also incentives for companies that collect health data to disclose that information to third parties for advertising and other purposes. The Health Insurance Portability and Accountability Act (HIPAA) requires health data to be safeguarded, places restrictions on uses and disclosures of health data, and if a data breach occurs, the HIPAA Breach Notification Rule requires notifications to be issued. While health apps and connected devices may collect health data that would be classed as Protected Health Information under HIPAA if collected by a HIPAA-regulated entity, most health apps and connected devices are not covered under HIPAA.

The FTC Health Breach Notification Rule applies to vendors of personal health records (PHR) and related entities that are not covered by HIPAA and requires those companies to issue notifications to consumers, the FTC, and the media in the event of a breach of identifiable health data. When a data breach occurs at a third-party service provider to vendors of PHRs and PHR-related entities, the Health Breach Notification Rule requires those entities to issue notifications to vendors and PHR-related entities. The Health Breach Notification Rule has been in effect for a decade, but the FTC has only just started enforcing compliance. Since December 2022, the has taken two enforcement actions against entities alleged to have violated the Health Breach Notification Rule – GoodRx and Easy Healthcare (Premom) –  both of which were found to have failed to issue timely notifications about breaches of identifiable health data.

In September 2021, the FTC issued a policy statement confirming the Health Breach Notification Rule applies to health apps and connected devices that collect, use, or transmit consumer health information. The FTC has reviewed the comments received about the policy statement and has determined that the Health Breach Notification Rule needs to be modernized to clarify its applicability to health apps, connected devices, and other direct-to-consumer technologies.

The proposed updates include a change to the definition of “PHR identifiable health information,” and new definitions have been added for “health care provider” and “health care services or supplies.” The definition of “PHR related entity” has been revised to make it clear that only entities that access or send unsecured PHR identifiable health information to a personal health record — rather than entities that access or send any information to a personal health record — qualify as PHR related entities. The FTC has also clarified what it means for a personal health record to draw PHR identifiable health information from multiple sources. The proposed update makes it clear that a “breach of security” includes the unauthorized acquisition of identifiable health information that occurs as a result of a data security breach or unauthorized disclosure.

The FTC has also authorized the expanded use of email and other electronic means as a way of providing clear and effective notice of a breach to consumers, and the required content of notifications has also been expanded. Notifications will need to include information about the potential harm that can be caused by the breach, and notifications must include the names of any third parties who might have acquired unsecured personally identifiable health information.

The comment period on the proposed changes is 60 days from the date of publication of the Notice of Proposed Rulemaking in the Federal Register.

The post FTC Proposes Changes to Modernize the Health Breach Notification Rule appeared first on HIPAA Journal.

NextGen Healthcare Facing Multiple Class Action Data Breach Lawsuits

Posted by HIPAA Journal

A healthcare data breach of 1 million+ records is certain to result in multiple lawsuits, and the data breach experienced by NextGen Healthcare is no exception. The data breach was only disclosed by NextGen on May 5, but at least a dozen lawsuits have already been filed in federal court in Georgia over the breach.

The data breach was the result of a hacking incident involving stolen credentials, which allowed unauthorized individuals to access a database that contained sensitive patient data such as names, addresses, dates of birth, and Social Security numbers. The investigation determined that the credentials stolen by the hackers came from other sources and did not appear to have been stolen from NextGen. The breach was detected by NextGen on March 30, 2023, and the forensic investigation confirmed hackers had access to its network between March 29, 2023, and April 14, 2023.  This was the second data breach to be reported by NextGen this year, with the earlier incident being a BlackCat ransomware attack. NextGen told the Maine Attorney General that 1,049,375 individuals had been affected and complimentary credit monitoring services have been offered to affected individuals.

The lawsuits were all filed in the United States District Court for the Northern District of Georgia, Atlanta Division, and make similar allegations – That NextGen was negligent for failing to safeguard the sensitive data of patients. The lawsuits claim NextGen was or should have been aware of the high risk of data breaches as multiple warnings have been issued by federal agencies about cybersecurity threats targeting the healthcare sector and extensive media reports about healthcare data breaches. Further, NextGen had suffered a ransomware attack just a few weeks previously and should have known that security needed to be improved.

The lawsuits also take issue with the length of time it took to contain the breach – two weeks after the intrusion was detected, the length of time it took to issue notification letters to affected individuals, and the failure to disclose sufficient facts about the data breach in those notification letters to allow the victims to determine the level of risk they face. The lawsuits allege the victims of the breach have already suffered harm and will continue to do so, and face a continuing risk of identity theft and fraud for years to come. The lawsuits seek class action status, a jury trial, damages, legal costs, and injunctive relief, including an order from the court to prohibit NextGen from engaging in unlawful practices and for improvements to be made to its data security practices.

The post NextGen Healthcare Facing Multiple Class Action Data Breach Lawsuits appeared first on HIPAA Journal.

EyeMed Vision Care Settles Multistate Data Breach Investigation for $2.5 Million

Posted by HIPAA Journal

In June 2020, the Luxottica Group PIVA-owned vision insurance company, EyeMed Vision Care, experienced a data breach involving the protected health information (PHI) of 2.1 million patients. An unauthorized individual gained access to an employee email account that contained approximately 6 years of personal and medical information including names, contact information, dates of birth, Social Security numbers, vision insurance account/identification numbers, medical diagnoses and conditions, and treatment information. The unauthorized third party then used the email account to distribute around 2,000 phishing emails.

State attorneys general have the authority to investigate data breaches and can fine organizations for HIPAA violations. A multi-state investigation was launched by state attorneys general in Oregon, New Jersey, and Florida into the EyeMed data breach, and Pennsylvania later joined the multistate action. The state attorneys general sought to establish whether the data breach was preventable and if it was the result of a failure to comply with the HIPAA Security Rule and state data protection laws.

The investigation identified data security failures that violated HIPAA and state laws. Under HIPAA and state data protection laws, entities that collect, maintain, or handle sensitive personal and medical information are required to implement administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and availability of that information, yet those safeguards were found to be lacking at EyeMed. The investigation revealed a failure to ensure all individuals with access to protected health information had a unique login and password. Several EyeMed employees were found to be sharing a single password for an email account that was used to communicate sensitive information, including PHI related to vision benefits enrollment and coverage.

Under the terms of the settlement, EyeMed agreed to pay a financial penalty of $2.5 million which will be shared between Oregon, New Jersey, Florida, and Pennsylvania. The settlement also requires EyeMed to ensure compliance with state consumer protection acts, state personal information protection acts, and HIPAA law, and ensure EyeMed does not misrepresent the extent to which it maintains and protects the privacy, security, or confidentiality of consumer information.

The data security requirements of the settlement include the development, implementation, and maintenance of a written information security program; maintenance of reasonable policies and procedures governing the collection, use, and retention of patient information; and maintenance of appropriate controls to manage access to all accounts that receive and transmit sensitive information. ”New Jerseyans trusted EyeMed with their vision care and their personal information only to have that trust broken by the company’s poor security measures,” said Attorney General Platkin, who co-led the investigation. “This is more than just a monetary settlement, it’s about changing companies’ behavior to better protect crucial patient data.”

The Office of the New York Attorney General also investigated EyeMed over the data breach and entered into a separate settlement agreement last year, which required EyeMed to pay a $600,000 penalty. In October 2022, a $4.5 million settlement was agreed between EyeMed and the New York Department of Financial Services (NYDFS) to resolve alleged violations of the NYDFS (Part 500) cybersecurity regulations. The security failures included not limiting employee access privileges to email accounts for 9 employees, a partial rollout of multifactor authentication, risk assessment failures, the lack of a sufficient data minimization strategy, and inaccurate submissions of compliance with Part 500 for four years. The settlements with NYDFS and the New York Attorney General also had data security requirements, including the implementation and maintenance of a comprehensive information security program, encryption of data, multi-factor authentication for all administrative and remote access accounts, and penetration testing.

HIPAA compliance investigations by state attorneys general are independent of the HHS’ Office for Civil Rights (OCR), which may also choose to impose civil monetary penalties for HIPAA violations. No penalty has been announced by OCR as of May 2023 and the incident is marked as closed on the OCR breach portal.

The post EyeMed Vision Care Settles Multistate Data Breach Investigation for $2.5 Million appeared first on HIPAA Journal.

Maxim HealthCare Services Proposes Settlement to Resolve Email Breach Lawsuit

Posted by HIPAA Journal

A settlement has been proposed by Maxim HealthCare Services to resolve all claims related to a 2020 cyberattack and data breach involving unauthorized access to multiple employee email accounts. The email accounts were compromised between October 1, 2020, and December 4, 2020, but the unauthorized access was not discovered until November 2021.

The review of the email accounts confirmed they contained protected health information such as names, addresses, dates of birth, phone numbers, provider names, medical histories, medical conditions, treatment information, medical record numbers, diagnosis codes, patient account numbers, Medicare/Medicaid numbers, usernames/passwords, and some Social Security numbers. The breach was reported to the HHS’ Office for Civil Rights as affecting 65,267 patients.

A lawsuit – Wilson, et al. v. Maxim Healthcare Services Inc. – was filed in response to the data breach in the Superior Court of the State of California County of San Diego that alleged Maxim HealthCare Services failed to implement appropriate security measures to prevent unauthorized access to patient data. Maxim HealthCare Services chose to settle the lawsuit to avoid further legal costs and the uncertainty of trial. Maxim HealthCare Services denies all claims made in the lawsuit and maintains there was no wrongdoing. The proposed settlement applies to all individuals who were notified that they had been affected by the breach and had their protected health information exposed.

Under the terms of the settlement, claims will be accepted up to a maximum of $5,000 for each class member for reimbursement of extraordinary expenses incurred as a result of the data breach, including up to three hours of lost time at $20 per hour. Individuals who were California Residents between October 1, 2020, and December 4, 2020, are entitled to receive a flat monetary benefit of approximately $100 which can be combined with claims for reimbursement of extraordinary expenses. All class members will be entitled to receive 12 months of free identity theft protection services, regardless of whether they submit a claim.

The deadline for exclusion from and objection to the proposed settlement is June 23, 2023. The deadline for submitting claims is July 24, 2023. The final approval hearing has been scheduled for July 28, 2023. Maxim HealthCare Services has implemented or will implement additional security measures to prevent similar incidents in the future.

The post Maxim HealthCare Services Proposes Settlement to Resolve Email Breach Lawsuit appeared first on HIPAA Journal.

SuperCare Proposes $2.25 Million Settlement to Resolve Data Breach Lawsuit

Posted by HIPAA Journal

The Californian home care service provider, SuperCare, has proposed a $2.25 million settlement to resolve a class action lawsuit filed in response to a 2021 hacking incident in which the protected health information of 318,379 patients was compromised.

SuperCare detected a network intrusion on July 27, 2021, and the subsequent forensic investigation determined hackers had access to its network from July 23, 2021, to July 27, 2021; however, it took until February 4, 2022, to determine that patient information had been compromised. Files on the compromised parts of the network contained names, addresses, dates of birth, hospital or medical group, patient account numbers, medical record numbers, health insurance information, test results, diagnoses, treatment information, other health-related information, and claims information, and, for some individuals, Social Security numbers and driver’s license numbers. Affected individuals were notified on March 25, 2022, 8 months after the breach was detected.

A lawsuit was filed against SuperCare shortly after the data breach was announced that accused SuperCare of violations of California’s Confidentiality of Medical Information Act, the Federal Trade Commission (FTC) Act, and the Health Insurance Portability and Accountability Act (HIPAA) due to the failure to implement reasonable and appropriate cybersecurity measures to protect against a known risk of cyberattacks and data breaches, and the failure to issue timely notifications about the data breach. Further, when notifications were finally sent, the content of those notifications was lacking key information about the data breach, and no explanation was provided as to why it took so long for the notifications to be issued. The lawsuit also claimed affected individuals were not provided with adequate credit monitoring services or other remedies to reduce the risk of misuse of their sensitive data.

Under the terms of the proposed settlement, two tiers of benefits are being offered. Claims can be submitted for tier 1 benefits which include a cash payment of $100. The second tier allows claims up to a maximum of $2,500 to cover out-of-pocket expenses incurred as a result of the data breach, along with up to 4 hours of lost time at $25 per hour. All class members are entitled to claim one year of three-bureau credit monitoring services, which includes a $1 million identity theft insurance policy.

The deadline for exclusion from or objection to the settlement is June 5, 2023. Claims must be submitted by July 5, 2023, and the final approval hearing for the settlement has been scheduled for August 28, 2023.

The post SuperCare Proposes $2.25 Million Settlement to Resolve Data Breach Lawsuit appeared first on HIPAA Journal.

University of Iowa Hospitals and Clinics Sued for Unlawful Disclosures of PHI to Facebook

Posted by HIPAA Journal

A lawsuit has been filed in the U.S. District Court for the Southern District of Iowa that alleges University of Iowa Hospitals and Clinics (UIHC) unlawfully, negligently, and recklessly disclosed patients’ private information to Facebook, without obtaining patient consent.

HIPAA_regulated entities are facing increased scrutiny of their website practices following the discovery of widespread use of website tracking code, often referred to as pixels, for monitoring website visitor activity. The snippets of code record information about website and app activity that is tied to individual users. The information gathered can be used to improve the user experience, but the information collected is often transferred to the providers of the code. A study that was recently published in Health Affairs found 98.6% of nonfederal acute care hospital websites in the United States had tracking pixels on their websites, which collected and transferred sensitive data to Meta (Facebook), Google, and other third parties. The information transmitted could be used for a variety of purposes, such as serving targeted advertisements based on specific medical conditions researched or disclosed on healthcare providers’ websites.

The extent to which patient privacy was being violated prompted the HHS’ Office for Civil Rights to issue guidance in 2022 on the use of website tracking code, and this year OCR Director Melanie Fontes Rainer confirmed that these unauthorized disclosures of PHI are now an enforcement priority for OCR. Lawyers have also been quick to take action, with more than 50 lawsuits already filed against healthcare entities over the use of these tracking tools.

The UIHC lawsuit – Yeisley v. University of Iowa Hospitals & Clinics – was filed on behalf of plaintiff Eileen Yeisley and similarly situated individuals. The lawsuit claims UIHC manages or controls two websites that are used for booking appointments, locating treatment facilities and physicians, and registering patients for events and classes. The lawsuit alleges UIHC intentionally included a Facebook pixel on both of those websites that shared visitor activity with Facebook and linked that information to individuals’ personal Facebook accounts. The lawsuit also alleges UIHC installed a Facebook conversion application programming interface (API) on the websites, which works independently of the pixel and allows additional disclosures of protected health information (PHI) to Facebook.

The use of these code snippets results in the sensitive data of patients and prospective patients being sent to Facebook without their consent or knowledge and that information can then be sold by Facebook to third parties to allow individuals to be targeted with advertisements specific to medical conditions disclosed or researched on the websites. The lawsuit claims that the code was added by UIHC to boost profits and includes evidence – screenshots – that shows the source code of UIHC websites includes the Facebook code snippets.

OCR confirmed in its guidance that these disclosures of PHI are generally not permitted by the HIPAA Privacy Rule, and warrant notifications under the HIPAA Breach Notification Rule. Several healthcare providers have reported breaches of PHI due to tracking code to OCR, but UIHC has yet to issue breach notifications. University of Iowa Health has issued a statement in response to the allegations, “University of Iowa Health Care is committed to protecting patient privacy. We do not share protected health information of our patients with Meta or Facebook. We will review the lawsuit once received.”

The lawsuit alleges negligence, invasion of privacy, unjust enrichment breach of confidence, and violations of the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act and seeks class action status, equitable and injunctive relief, and an order from the court to prevent UIHC from engaging in this activity in the future. The lawsuit also seeks an award of damages, including actual, consequential, punitive, and nominal damages.

The post University of Iowa Hospitals and Clinics Sued for Unlawful Disclosures of PHI to Facebook appeared first on HIPAA Journal.