I am asked that question almost weekly. While the answer has traditionally been “no,” the legal landscape is shifting and the risk of being sued continues to increase.

Let’s first start with some background. As some of you may know, HIPAA does not include a “private right of action.” This means that an individual may not file a claim against a covered entity or a business associate in order to enforce HIPAA or seek damages in response to a HIPAA violation. For example, a patient is not able to sue a dentist if the dentist fails to distribute a Notice of Privacy Practices or enter into a business associate agreement. The sole remedy of an aggrieved individual is to file a complaint with the United States Department of Health and Human Services Office for Civil Rights (“OCR”) or, more recently, with a state Attorney General. In addition, in some states, individuals have been able to file complaints regarding generalized privacy concerns with various state regulatory agencies, such as a state health or consumer protection department. With respect to OCR, notification of the right to file a complaint and the process for doing so is generally set forth in a covered entity’s Notice of Privacy Practices.

Since HIPAA was enacted, the lack of a private right of action has provided solace to covered entities and business associates, particularly since complaints tend to be few in number. Moreover, OCR investigations of complaints have often resulted in compliance agreements and consent orders, rather than court actions or civil damages, both of which would require the covered entity or business associate to expend considerable sums on attorney fees, court costs and payment of damages.

While there is no hint at this time that Congress is contemplating including a private right of action in HIPAA (i.e. allowing individuals to sue to enforce HIPAA), aggrieved patients and their counsel have been finding other ways to file claims for HIPAA violations and use HIPAA violations as the basis for seeking monetary damages. For example, in some states, patients have filed suit against health care providers on the grounds of negligence - claiming that the provider was negligent when violating HIPAA and thus must be held liable for damages. A recent example from Connecticut illustrates the way these lawsuits operate:

A physician received a subpoena for medical records. The physician supplied the medical records as requested by the subpoena; however, the subpoena did not comply with HIPAA. The subject of the medical records sued, alleging that HIPAA creates a “standard of care” for all health care providers and that the failure of the physician to adhere to that standard of care was “negligent.” The physician sought to block the suit but the Connecticut Supreme Court allowed it to continue. As of this date, the lawsuit is making its way through the Connecticut state courts. In addition, lawsuits are currently being prepared and filed in response to the recent Anthem breach and many will be claiming negligence or violation of various state privacy or insurance regulations.

These types of lawsuits would have been unheard of even just a few years ago. However, while still not widespread or common, the emergence of these suits poses significant risk management and liability concerns for any health care provider, health insurance company or vendor subject to HIPAA. The risk of a lawsuit is most pertinent to HIPAA violations which may cause financial, reputational or other harm to a party. Hypothetical examples, based upon real life incidents, include:

• Inappropriate disclosure of medical records in response to a subpoena, which causes a former patient to lose custody of her children.
• Inappropriate disclosure of a child’s medical record to an estranged parent after the health care provider failed to verify the estranged parent’s authority to access records, which leads to the estranged parent to discover where the child now resides.
• Inappropriate use of medical records by hospital staff as part of a “hot or not” game which causes severe embarrassment and distress to certain patients. A negligent attorney and an angry patient could potentially make a claim based upon any of the above and may seek a significant financial settlement or payout.

In light of the potential for such lawsuits and the significant damages that may be awarded, covered entities and business associates should consider reviewing their HIPAA compliance programs to identify weaknesses and institute safeguards and protocols to reduce the likelihood of inappropriate disclosures that may lead to a patient filing suit. Such safeguards may include, based upon the above examples, a subpoena review checklist, verification procedures, a reliable reporting protocol or other procedures to allow the entity or its staff to verify that information is being used and disclosed appropriately.

[showhide type="contact_form" more_text="Click here to contact William privately" less_text="Hide contact form"][/showhide]

A party’s responsibilities under HIPAA generally come from two sources - the law itself and the business associate agreement entered into between the covered entity (the health care provider or health plan) and the business associate (its vendor). While all parts of a business associate agreement are important, there are certain terms that are most likely to affect the parties’ liability and obligations.

One of these key terms is [glossary]indemnification[/glossary], and it is often the section of the business associate agreement that lawyers most often fight over. Folks often wonder why lawyers tend to focus so much on this section, and the short answer is that when things go wrong--such as a data breach or HIPAA violation--indemnification is the clause which that determines who pays, when they must pay, and how much they owe. In other words, it’s the money clause.

Indemnification is the concept through which the party at fault makes the other party whole; in other words, the party at fault will pay the costs, expenses, fines, and losses that the other party incurs.

While many underlying agreements will address indemnification (such as a service agreement or consulting agreement), it is often best to address indemnification in the business associate agreement and how it specifically applies to the use and disclosure of protected health information (PHI). Your goal is to not incur costs or damages due to the act or omission of the other party, or to at least limit your exposure to such costs. The costs and damages a party is typically most worried about are those incurred due to a data breach or HIPAA violation by the other party, such as attorney fees, notification costs, credit monitoring, or fines.

Let’s take an example of a typical data breach to demonstrate the importance of indemnification:

City Hospital hires a consulting firm to provide it guidance with improving patient outcomes. As part of the engagement, a consultant downloads a list of patient records to a laptop. Unbeknownst to the consultant, IT mistakenly failed to encrypt the laptop. While in an airport, the laptop is stolen. The consultant reports the breach to her employer and the hospital is notified.

When notice of the stolen laptop reaches a hospital executive or executive director of the consulting firm, one of the first questions asked will be: "what is this going to cost us?" When faced with a data breach that can easily cost a health care facility six figures, the first place the facility and its attorneys will look is to the indemnification clause. This paragraph will tell them who is responsible to pay the costs of the data breach (does the hospital pay or the consultant?), how much the obligated party must pay (if the consultant must pay, is there a cap?), and which costs the obligated must pay (if the consultant must pay, does the consultant need to pay the hospital’s attorney fees?)

Moreover, what if the business associate lacks an indemnification clause? In that case, someone will need to inform the hospital’s CEO that the hospital may be unable to recover its costs, or may attempt to do so only at considerable expense. No one wants to be in the position of breaking such news to the CEO.

In a future post, we will look at the most important issues to keep in mind when drafting indemnification clauses in order to appropriately protect your organization.

[showhide type="contact_form" more_text="Click here to contact William privately" less_text="Hide contact form"][/showhide]

March 22, 2013.  Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

We begin a two-day examination of the modifications pertaining to 45 CFR 164.520:  Notice of Privacy Practices for Protected Health Information.  Today, we focus on modifications to 164.520(b): Implementation specifications:  Content of Notice, and Monday, March 25, on modifications to 164.520(c):  Implementation specifications: Provision of notice.

Modifications to 164.520(b):  Implementation specifications:  Content of notice

“(1) Required elements.

.  The notice must contain:

“(E) A description of the types of uses and disclosures that require an authorization under 45 CFR 164.508(a)(2)–(a)(4), a statement that other uses and disclosures not described in the notice will be made only with the individual’s written authorization, and a statement that the individual may revoke an authorization as provided by 164.508(b)(5).”

78 Federal Register 5701

Here are the provisions for 45 CFR 164.508 referenced in 164.520(b)(1)(ii)(E), with modifications shown in bold:

“(a)(2) Authorization required:  Psychotherapy notes.

“(a)(3) Authorization required:  Marketing.  (ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.

“(a)(4) Authorization required:  Sale of protected health information. (i) Notwithstanding any provision of [the HIPAA Privacy Rule], other than the transition provisions in 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in 
164.501 of [the HIPAA Privacy Rule]. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.

“(b)(5) Revocation of authorizations.”

78 Federal Register 5699

Continuing with the modifications to 45 CFR 164.520(b)(1):  Content of Notice:  Required elements:

.  If the covered entity intends to engage in any of the following activities, the description required by paragraph (b)(1)(ii)(A) of this section must include a separate statement informing the individual of such activities, as applicable:

“(A) In accordance with 164.514(f)(1) [Fundraising communications: Standard:  Uses and disclosures for fundraising, as modified at 78 Federal Register 5700], the covered entity may contact the individual to raise funds for the covered entity and the individual has a right to opt out of receiving such communications;

“(B) In accordance with 164.504(f) [Standard:  Requirements for group health plans, as modified at 78 Federal Register 5698], the group health plan, or a health insurance issuer or HMO with respect to a group health plan, may disclose protected health information to the sponsor of the plan; or

“(C) If a covered entity that is a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, intends to use or disclose protected health information for underwriting purposes, a statement that the covered entity is prohibited from using or disclosing protected health information that is genetic information of an individual for such purposes.”

78 Federal Register 5701

Here are two references mentioned in the provisions immediately above:

In (iii), “(b)(1)(ii)(A)” is:  “ A description, including at least one example, of the types of uses and disclosures that the covered entity is permitted by [the HIPAA Privacy Rule] to make for each of the following purposes:  treatment, payment, and health care operations.”

In (C), “(1)(viii) of the definition of health plan” is:  “An issuer of a long-term care policy, excluding a nursing home fixed indemnity policy.”  78 Federal Register 5689

.

“(A) The right to request restrictions on certain uses and disclosures or protected health information as provided by 45 CFR 164.522(a), including a statement that the covered entity is not required to agree to a requested restriction, except in case of a disclosure restricted under 164.522(a)(1)(vi); “

78 Federal Register 5701

Here is the content, as modified (in bold), for 164.522(a)(1)(vi), as referenced immediately above:

“A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:

(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and

(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.”

78 Federal Register 5701

.

“(A) A statement that the covered entity is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information;”

78 Federal Register 5701

We provide here the content of the Final Rule preamble that underpins the Notice of privacy practices for protected health information:  Implementation specifications—Content of Notice, with reference to the modified provisions above:

“First, the final rule adopts the modification to 45 CFR 164.520(b)(1)(ii)(E), which requires certain statements in the NPP regarding uses and disclosures that require authorization. We note that, contrary to some commenter concerns, the final rule does not require the NPP to include a list of all situations requiring authorization. Instead, the NPP must contain a statement indicating that most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures of protected health information for marketing purposes, and disclosures that constitute a sale of protected health information require authorization, as well as a statement that other uses and disclosures not described in the NPP will be made only with authorization from the individual.

“The final rule does not require the NPP to include a description of a covered entity’s recordkeeping practices with respect to psychotherapy notes; however, covered entities are free to include such additional information in their NPP if they choose. Additionally, in response to requests by some commenters, we clarify that covered entities that do not record or maintain psychotherapy notes are not required to include a statement in their NPPs about the authorization requirement for uses and disclosures of psychotherapy notes.

“Second, because the final rule treats all subsidized treatment communications as marketing communications, we have not adopted the proposal to require a statement in the NPP about such communications and the ability of an individual to opt out….

“The final rule, however, adopts the proposed requirement for a statement in the NPP regarding fundraising communications and an individual’s right to opt out of receiving such communications, if a covered entity intends to contact an individual to raise funds for the covered entity. Because individuals will be provided the opportunity to opt out of fundraising communications with each solicitation, the final rule does not require the NPP to include the mechanism for individuals to opt out of receiving fundraising communications, although covered entities are free to include such information if they choose to do so.

“The final rule also adopts the proposal that the NPP inform individuals of their new right to restrict certain disclosures of protected health information to a health plan where the individual pays out of pocket in full for the health care item or service. Only health care providers are required to include such a statement in the NPP; other covered entities may retain the existing language indicating that a covered entity is not required to agree to a requested restriction.”

78 Federal Register 5624

On Monday, March 25, we present 45 CFR 164.520(c): Implementation specifications:  Provision of Notice.