Header graphic for print


Legal Issues, Developments and Other Pertinent Information Relating To The Creation, Use and Exchange of Electronic Health Records

Four Tips for Reducing HIPAA Security Risks When Using Mobile Devices

Posted in Privacy & Security

Our partner Elizabeth Litten and I were once again quoted by our good friend Marla Durben Hirsch in her recent articles in Medical Practice Compliance Alert entitled “Improve Usability but Mind HIPAA if Using Personal Mobile Devices for Work.” The full text can be found in the September 28, 2015, issue of Medical Practice Compliance Alert, but a synopsis reflecting our comments is included below.

Medical practice communications are increasingly mobile, with a reported 83% of physicians using mobile technology to provide patient care and 71% of nurses doing the same, according to a mobile technology survey from the Healthcare Information and Management Systems Society (HIMSS). Mobile devices, however, must be managed carefully to avoid creating an undue HIPAA security risk.

Some steps to protect patient data when using mobile devises include the following:

  1. Health care providers should use encryption to make mobile devices more secure. Email programs should be able to assure that the message cannot be read until it has been transmitted to the provider’s device. Kline warns, “A password on a phone is not encryption.”
  2. Providers should get informal messages and conversations from mobile devices, such as text messages, into the patient’s medical record. Kline says, “Have you made an entry [of the informal message or conversation] in the record? If not, the medical record is not accurate.”
  3. Providers should be sure to obtain patient consent to communicate by mobile device as well,” says Litten. This is especially important if the communication may be unsecured.
  4. Avoiding the lack of discipline that mobile devices often encourage, such as non-medical shorthand, is crucial. Kline says, “Communications over mobile devices are more likely to contain misspellings and other errors, which can create malpractice liability and are not best practice when communicating treatment.”

The ever-increasing utilization of mobile devices in the delivery of healthcare services to patients is placing greater demands on those providers who are subject to, and those who are drafting, implementing and enforcing, HIPAA policies and procedures.

Did Practice Violate HIPAA By Tipping Off Immigration Authorities?

Posted in Articles, Uncategorized

A Houston-area woman was arrested at her gynecologist’s office by Sheriff’s deputies because she presented a false ID and now may face deportation, according to a September 11, 2015 report in the Houston Press.  The woman, Blanca Borrego, was reportedly visiting Northeast Women’s Healthcare for an annual check-up and to follow up on a painful abdominal cyst that had been identified a year earlier.   The Houston Press goes on to say that after filling out paperwork and waiting two hours, she was called into an exam room and met by law enforcement officers, who led her out in handcuffs in front of her young daughters.

“We’re going to take her downtown, she presented a form of false identification,” Borrego’s daughter recalled the deputy saying. He said their mother’s bond would probably be around $20,000, and added, “She’s going to get deported.”

Ms. Borrego had reportedly remained in the U.S. for 12 years on an expired visa.  It was her first visit to this clinic, although she had been treated previously by the same physician.  However, one commentator suggests she may have been eligible for protection from deportation under current law:

In fact, Borrego would have qualified for President Obama’s Deferred Action for Parents of Americans and Lawful Permanent Residents (DAPA) administrative reform program, which was announced last year. For the estimated 4.1 million undocumented individuals like Borrego—who have been in the United States since January 1, 2001 and have a son or daughter who is a U.S. citizen or lawful permanent resident—DAPA allows work permit applications and protection from deportation.  – Ana DeFrates, Texas Latina Advocacy Network, National Latina Institute for Reproductive Health

When can a physician practice, clinic, hospital or other healthcare provider reveal protected health information to law enforcement?  Section 164.512(j) of the HIPAA rule permits such disclosures to avert a serious threat to health or safety, and only in limited situations:

(j) A covered entity may,consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:

(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and

(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or

(ii) Is necessary for law enforcement authorities to identify or apprehend an individual:

(A) Because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim; or

(B) Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody, as those terms are defined in §164.501.

Covered entities may also disclose to law enforcement officials protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.  It is not clear whether at this time if Northeast will rely on that provision to justify their call to the police.  There are no allegations of identity theft and in fact Ms. Borrego reportedly was covered by her husband’s health insurance policy.

Ironically, when asked by the Houston Press about its policies regarding informing authorities about suspected undocumented aliens, the Houston Press reports that Memorial Hermann spokeswoman Alex Loessin replied  “As you know, because of patient privacy, I am unable to provide comment.”

The HIPAA implications of this emerging story have yet to fully play out.  Covered entities and their business associates should use caution before voluntarily disclosing PHI to law enforcement agencies, particularly when there is no indication of violent crime or serious threats to health or safety.

FTC on Privacy: Beware of Offering Choices to Consumers beyond the Legal Minimum Requirements

Posted in Articles, Privacy & Security

A recent post on this blog by our partner Elizabeth Litten was quoted in the Dissenting Statement (the “Dissent”) of FTC Commissioner Maureen K. Ohlhausen in the Matter of Nomi Technologies, Inc., Matter No. 1323251. Ms. Ohlhausen disagreed with the views of the majority of the Commissioners in the Matter because she believed that

. . . by applying a de facto strict liability deception standard absent any evidence of consumer harm, the proposed complaint and order inappropriately punishes a company that acted consistently with the FTC’s privacy goals by offering more transparency and choice than legally required.

To buttress her viewpoint, Ms. Ohlhausen quoted as follows from Elizabeth’s post, which was referenced at footnote 9:

In response to the case’s release, one legal analyst [Elizabeth Litten] advised readers that ‘giving individuals more information is not better’ and that where notice is not legally required, companies should ‘be sure the benefits of notice outweigh potential risks.’

The takeaway from the FTC decision in Nomi and the Dissent appears to be that, in setting and publishing privacy policies, an organization should carefully consider whether adopting standards in excess of legal requirements is advisable if there is a reasonable possibility that the organization may find such standards difficult or costly to attain and maintain, thereby increasing the risk of regulatory scrutiny and sanctions.

How the NIST Cybersecurity Framework Can Help With HIPAA Compliance: 3 Tips

Posted in Privacy & Security

As our partner Mark McCreary writes in his post describing the “Framework for Improving Critical Infrastructure Cybersecurity” published by the National Institute of Standards and Technology (NIST):

The Framework is designed to work with businesses to reach a sufficient level of cybersecurity protection regardless of size, sector, or level of security.  The Framework consists of three parts (1) The Framework Core, (2) The Framework Implementation Tiers, and (3) The Framework Profiles.  The Framework Core is a grouping of cybersecurity activities based on industry indicators, desired outcomes, and practices.  It assists businesses in developing Framework Profiles, which are used to create cybersecurity plans.

So how can a health care covered entity (such as a health care provider or health plan) or business associate use the Framework to help with HIPAA compliance?

1.  Review health industry-specific guidance available on NIST’s Framework website, such as that issued by the Health Information Trust Alliance (HITRUST).

2.  Review the Framework and Framework’s FAQs to build a Framework Core that applies in the context of your business activities — for example, include Framework outcome language such as “physical devices and systems within the organization are inventoried” and a Framework category for “Electronic Health Record Access Control”.

3.  Realize that the Framework can be used to improve or strengthen your PHI security by layering it over or weaving it into your HIPAA Privacy and Security Policies and Procedures.


Oncology Group Fined $750,000 Over Stolen Backup Media, Lax Compliance Efforts

Posted in Articles, HIPAA Enforcement, Privacy & Security, Uncategorized

Cancer Care Group, P.C., a 13-physician radiation oncology practice in Indiana (group), has agreed to pay $750,000 and implement a comprehensive corrective action plan in a settlement resulting from the theft of a laptop and backup media containing unencrypted patient information.  As is often the case, the breach incident triggered an investigation that revealed deeper deficiencies in the physician group’s HIPAA compliance efforts.  The Office of Civil Rights of the Department of Health and Human Services (OCR) announced the settlement in a September 2, 2015 press release entitled “$750,000 HIPAA settlement emphasizes the importance of risk analysis and device and media control policies.”  That heading alone strongly suggests that OCR chose this case to send a clear and powerful message to smaller covered entities and business associates that neglecting basic compliance efforts can and will result in heavy fines, especially if meaningful corrective action is not undertaken after a breach occurs.

The practice first notified OCR of the theft of an employee’s laptop bag in 2012 from the employee’s car. The bag contained a laptop, which did not contain ePHI, and unencrypted computer server backup media with names, addresses, dates of birth, Social Security numbers, insurance information and clinical information of approximately 55,000 current and former patients.   OCR learned upon further investigation that the group had taken its HIPAA obligations less than seriously for years preceding the breach.

It had not conducted an enterprise-wide risk analysis when the breach occurred in July 2012. Further, Cancer Care did not have in place a written policy specific to the removal of hardware and electronic media containing ePHI into and out of its facilities, even though this was common practice within the organization. OCR found that these two issues, in particular, contributed to the breach, as an enterprise-wide risk analysis could have identified the removal of unencrypted backup media as an area of significant risk to Cancer Care’s ePHI, and a comprehensive device and media control policy could have provided employees with direction in regard to their responsibilities when removing devices containing ePHI from the facility.

In addition to the fine, the group adopted a Corrective Action Plan as part of its Resolution Agreement with OCR, which can be read here.

Much like the Phoenix Cardiac Surgery settlement that we discussed on this blog in 2012, this case involved  not just a one-time negligent breach, but a systematic, ongoing failure to adopt and implement appropriate HIPAA safeguards, policies and compliance efforts.  The Resolution Agreement indicates that such failures continued for a significant time after the theft of the devices.

The Resolution Agreement states that the payment of the $750,000 “Resolution Amount” does not preclude the government from imposing civil monetary penalties in the future if the deficiencies are not cured, and the group agreed to extend the statute of limitations on such penalties during the three-year term of the Resolution Agreement and Corrective Action Plan and for one year afterwards.  During the term of the Agreement, the group is required to complete a comprehensive Risk Analysis of all security risks and vulnerabilities posed by its electronic equipment, data systems, and applications that contain, store, transmit, or receive electronic protected health information (“ePHI”) and report the results to OCR; develop and implement an organization-wide Risk Management Plan to address and mitigate any security risks and vulnerabilities found in the Risk Analysis; revised and update its policies and procedures to OCR’s satisfaction; revise its current Security Rule Training Program; investigate any workforce member’s violation of such policies and report the results to OCR (even if such violation did not result in a breach); and file detailed annual reports with OCR.

There are plenty of lessons to learn from this settlement, but one of the most critical lessons may be the easiest to implement: encrypt your data, particularly any data that is stored in portable devices which have a disturbing tendency to disappear.  Had the backup device been encrypted, it is likely that the outcome of this incident would have been very different. Another lesson is that, if a breach of HIPAA is discovered, be proactive and act immediately to assess and address the risk and mediate the potential damage, update your policies and procedures, implement changes designed to avoid another breach, etc.  Do not wait for OCR to tell you how to respond to the breach.

Six Tips for Physicians to Protect Patient Data on the Internet

Posted in HIPAA Enforcement, Privacy & Security

Our partner Elizabeth Litten and I were once again quoted by our good friend Marla Durben Hirsch in her recent articles in Medical Practice Compliance Alert entitled “Misapplication of Internet Application Triggers $218,400 Settlement” and “Protect Patient Data on the Internet with These 6 Steps.”  The three of us together were able to come up with a number of ideas to assist physicians in improving the likelihood that protected health information (“PHI”) will be more secure. The full text can be found in the August 17, 2015 issue of Medical Practice Compliance Alert, but a synopsis of our input is included below.

Internet applications and files should be included in a physician practice’s HIPAA compliance plan, or a violation may result.  As an example, St. Elizabeth’s Medical Center (“SEMC”) in Brighton, MA recently settled several potential HIPAA violations for $218,400 with the Office of Civil Rights (“OCR”) of the Department of Health and Human Services (“HHS”).  One of the incidents involved SEMC’s use of an unauthorized internet-based document. The size of this settlement highlights the concerns of OCR about misuse by healthcare providers of internet-based document sharing or other applications.

Some steps to protect patient data on the internet include the following:

  1. Review the internet applications your practice uses. Litten says, “Take steps such as encryption to protect the data when it’s shared, transmitted and stored.”
  2. Ask the application’s manufacturer about its security safeguards. “If a manufacturer claims that (its application) is HIPAA protected, ask what that means,” Litten urges.
  3. Investigate all internal and external complaints and concerns. Kline says, “Expect the government to find out about PHI exposed on the Internet from a third party.”
  4. Keep track of the steps you take to identify and fix the problem. “You do better if you have a history that you endeavored to comply with HIPAA,” says Kline.
  5. Provide a mechanism by which employees can report concerns anonymously. Kline suggests, “You need a private place where people feel they’re not being watched.”
  6. Don’t allow staff to use unauthorized public networks. “Don’t open documents in, say, a Starbucks,” warns Litten.

In summary, in order for physicians to protect their practices, they must be certain that they understand HIPAA obligations with respect to privacy and security in the context of internet application usage.

Hackers: Take My Health Information, But Please Don’t Take My Health

Posted in Privacy & Security, Sensitive Health Information

We know by now that protected health information (PHI) and other personal information is vulnerable to hackers.  Last week, the Washington Times reported that the Department of Health and Human Services (HHS), the agency responsible for HIPAA enforcement, had suffered security breaches at the hands of hackers in at least five separate divisions over the past three years.  The article focused on a House Committee on Energy and Commerce report that described the breaches as having been relatively unsophisticated and the responsible security officials as having been unable to provide clear information regarding the security incidents.

We know it’s not a question of “if” sensitive information maintained electronically will be compromised by a hacking or other type of cyber security incident, but “when” — regardless of who maintains it — and how destructive an incident it will be. Even HHS and its operating divisions, which include both the Office of Civil Rights (OCR), charged with protecting PHI privacy and security, and the Food and Drug Administration (FDA), the country’s principal consumer protection and health agency, are vulnerable.

Just one day before its coverage of the House Committee report on the cyber security vulnerabilities that exist within the very government agencies charged with protecting us, the Washington Times reported on an even more alarming cyber security risk: the vulnerability of common medical devices, such as x-ray machines and infusion pumps, to hacks that could compromise not just the privacy and security of our health information, but our actual physical health.

This report brought to mind a recent report on the ability of hackers to remotely access the control systems of automobiles.  While the thought of losing control of my car while driving is terrifying, the realization that medical devices are vulnerable to hackers while being used to diagnose or treat patients is particularly creepy.  The two situations may present equally dangerous scenarios, but hacking into a medical device is like hacking into one’s physical being.

So while it’s one thing to have PHI or other sensitive information compromised by a hacking incident, it’s much more alarming to think that one’s health status, itself, could be compromised by a hacker.

HIPAA-Type Protections Are Not Just For Humans – When It Comes To Medical Records, Animals Have Privacy Rights, Too (Part 2)

Posted in Sensitive Health Information, Uncategorized

Co-authored by Nancy E. Halpern, DVM, Esq. and Elizabeth G. Litten.  Also posted on Animal Law Update.

As reported in expressnews.com:

Joseph Larsen, a Houston­-based open records lawyer, said if Texas A&M owns the animals, the chapter cited in the attorney general’s opinion that grants veterinarian-­client confidentiality should not apply because the veterinarians are working for the university. He said the law applies only to veterinarians who see animals that are owned by someone else.

However, nothing in the Texas Veterinary Practice Act provides such an exception.

A client is defined as the “owner or other caretaker of the animal.”  § 801.351(a)(1).

Furthermore, veterinary practice requires the existence of a veterinarian-client-patient relationship which exists between laboratory animal veterinarians, Texas A&M and the animals in their care. The law sets forth requirements of the Veterinarian-Client-Patient Relationship as follows:

a) A person may not practice veterinary medicine unless a veterinarian-client patient relationship exists. A veterinarian-client-patient relationship exists if the veterinarian:

(1) assumes responsibility for medical judgments regarding the health of an animal and a client, who is the owner or other caretaker of the animal, agrees to follow the veterinarian’s instructions;

(2) possesses sufficient knowledge of the animal to initiate at least a general or preliminary diagnosis of the animal’s medical condition; and

(3) is readily available to provide, or has provided, follow-up medical care in the event of an adverse reaction to, or a failure of, the regimen of therapy provided by the veterinarian.

(b) A veterinarian possesses sufficient knowledge of the animal for purposes of Subsection (a)(2) if the veterinarian has recently seen, or is personally acquainted with, the keeping and care of the animal by:

(1) examining the animal; or

(2) making medically appropriate and timely visits to the premises on which the animal is kept.

c) A veterinarian-client-patient relationship may not be established solely by telephone or electronic means.  (Section 801.351)

There are no laws or regulations exempting laboratory animal veterinarians from licensure in Texas. However, the “board may issue a special license to practice veterinary medicine to an applicant who is: (1) a member of the faculty or staff of a board-approved veterinary program at an institution of higher education …  . ” Section 801.256.

Special licenses may also be granted to veterinarians working for the Texas Animal Health Condition or the Texas Veterinary Medical Diagnostic Laboratory, but a special license is not available for a laboratory animal veterinarian serving in that capacity for a university.

In other jurisdictions, like New Jersey, the “practice of veterinary medicine, surgery, and dentistry” does not include:

(6) Any properly trained animal health technician or other properly trained assistant, who is under the responsible supervision and direction of a licensed veterinarian in his practice of veterinary medicine, if the technician or assistant does not represent himself as a veterinarian or use any title or degree pertaining to the practice thereof and does not diagnose, prescribe, or perform surgery.  (N.J.S.A  45:16-8.1.)

However, a laboratory animal veterinarian providing for the clinical care of the animals may still have to be licensed and governed by veterinary practice state laws.

The Beagle Freedom Project, concerned that Texas may set a new precedent for universities in other states, is reportedly considering filing a lawsuit.

Notably, Florida, known for its expansively permissive open public records act, has recently adopted a law which provides for an exemption to the State’s open public records act for animal medical records held by any state college of veterinary medicine that is accredited by the American Veterinary Medical Association Council on education.

In support of this law, the

Legislature finds that the release of such animal medical records compromises the confidentiality protections otherwise afforded the owners of such animals treated by licensed veterinarians in this state . . . [and] that the privacy concerns that result from the release of animal medical records outweigh any public benefit that may be derived from the disclosure of the information.

These concerns arguably also apply to animals owned by research facilities.

Dumpster Diving for PHI Exposes Business Associate (and Physician Practice) to Liability

Posted in Lawsuits, Privacy & Security, Uncategorized

A Chicago record storage and disposal company has been named in a complaint filed by the Illinois Attorney General as a result of the negligent disposal of a medical practice’s patient records in an unlocked dumpster.   The complaint alleges that FileFax, Inc. violated the Illinois Consumer Fraud and Deceptive Business Practices Act by failing to handle the records entrusted to it for secure disposal by the practice, Suburban Lung Associates, as required by the Illinois Personal Information Protection Act as well as HIPAA.

Not only did FileFax allegedly discard the records in its unlocked dumpster adjacent to its place of business, but more incredibly, a FileFax employee permitted another individual to remove 1,100 pounds of records and take them to another facility for recycling.  The recycler, Shred Spot, recognized the documents as protected health records and refused to recycle them.  After consulting his trade association, the National Association for Information Destruction, Shred Spot owner Paul Kaufmann contacted the office of Attorney General Lisa Madigan, according to the Chicago Tribune.

Adding to the perfect storm, shortly after the records were delivered to Shred Spot, Dave Savini, an investigative reporter for CBS Chicago, took a film crew to the dumpster outside of the FileFax facility which remained full of Suburban Lung’s records and remained unlocked, accessible by the general public.  He noted:

“It is an identity thief’s dream, and a nightmare for patients. Medical files, tossed in the trash, contain personal information including drivers’ licenses, Social Security numbers and even medical histories.”

Watch his report here:savini-medical-files[1]
Illinois Attorney General agents and representatives of the Department of Health and Human Services then conducted a site visit of the Shred Spot facility, and documented the return of the records to the practice.

FileFax faces civil penalties and injunctive relief under the AG’s suit including a $50,000 fine for violation of the Consumer Fraud Act and an additional $10,000 for each violation that involved a senior citizen, plus costs of investigation and prosecution, along with another civil penalty of $50,000  for improperly disposing of sensitive personal information and protected health information under the state’s Personal Information Protection Act.  At this point it is not clear what additional sanctions may be sought by HHS under HIPAA.  Further, Suburban Lung Associates may face vicarious liability for the negligence of its business associate, FileFax.

My partners Elizabeth Litten and Michael Kline were quoted by Marla Durben Hirsch in the July 27, 2015 issue of Part B News in an article entitled “Faulty record disposal by business associate exposes physician practice” (subscription required).

“Reporters love to dumpster dive. It’s more sexy [than some other HIPAA violations],” says Kline. “It’s a horror show for the covered entity. And if there’s no business associate agreement, it’s even worse,” he adds.

In the interview, they emphasized the need to treat record storage and disposal companies as seriously as other third-party contractors handling patient-related items, to verify a vendor’s HIPAA compliance efforts before engaging them and to continue monitoring their compliance.

“Consider medical information as other waste, as if it’s toxic. If it’s not disposed of properly, there could be liability,” says Litten.

Further, a covered entity’s business associate agreement is its best defense when a business associate drops the ball.  “You need to know that the business associate knows and complies with HIPAA and state law,” says Litten.

In addition, business associates should be required to report to covered entities within a few days of discovering a breach, and should be required to pay for any costs incurred by the covered entity they have caused, including credit monitoring.

HIPAA-Type Protections Are Not Just For Humans – When It Comes To Medical Records, Animals Have Privacy Rights, Too (Part 1)

Posted in Privacy & Security, Sensitive Health Information

Co-authored by Nancy Halpern, DVM, Esq.; also posted on Animal Law Update

HIPAA does not protect animals’ health information – it applies to the protected health information (or PHI) of an “individual”, defined as “the person who is the subject of” the PHI. However, state laws governing the confidentiality of health information also come into play and, in some cases, expand upon HIPAA’s privacy protections.

Leo Litten

Leo Litten

Physicians, for example, must abide by state law and licensing board requirements specific to medical record maintenance and confidentiality. In most states, veterinarians, like physicians, are required by law to keep the medical records of their patients confidential, unless their client — the patient’s owner — authorizes the release of the medical records, or the records are requested by the State Board of Veterinary Medical Examiners or as ordered by a court.

This requirement was affirmed in several legal opinions recently issued by the Texas Attorney General in response to letters sent from the Office of General Counsel of The Texas A&M University asking “whether certain information is subject to required public disclosure under the Public Information Act (the “Act”), chapter 552 of the [Texas] Government Code.”  Texas A&M had received at least 48 requests “for information pertaining to specified dogs and any specified protocols pertaining to the dogs at issue during a specified time period.”

The requests for information came from individuals claiming to have “virtually adopted” the dogs in question, as reported by expressnews.com.

The Beagle Freedom Project, whose mission is to “rescue beagles used in animal experimentation in research laboratories,” encourages people to adopt research animals virtually, even though those animals are actually already owned by various research institutions and universities across the country.

The “adopters” then demand the medical records of their “adopted” animals in letters citing the state’s open public records act which sets forth requirements of various state agencies to provide requested information within a prescribed period of time.

Texas A&M has refused to provide that information, based on the opinion of the state Attorney General citing the restrictions in the Texas Veterinary Practice Act, which requires a veterinarian to maintain medical records confidentially and provides that the veterinarian can only release those records upon receipt of:

(1) a written authorization or other form of waiver executed by the client; or

(2) an appropriate court order or subpoena.

Occ. Code § 801.353 (b).

As further reported in expressnews.com:

Joseph Larsen, a Houston­-based open records lawyer, said if Texas A&M owns the animals, the chapter cited in the attorney general’s opinion that grants veterinarian­-client confidentiality should not apply because the veterinarians are working for the university. He said the law applies only to veterinarians who see animals that are owned by someone else.

However, nothing in the Texas Veterinary Practice Act provides such an exception.

To Be Continued…