ADVERTISEMENT



Google       

Home -> Law Blog Directory -> Health Law Blogs -> HealthBlawg

OR PHONE (866) 635-1838 for Bankruptcy Help, (866) 635-6190 for Divorce,
(866) 635-2689 for Personal Injury or (866) 635-9402 for Criminal Defense

Find a Local Lawyer

Bankruptcy (866) 635-1838
Divorce (866) 635-6190
Personal Injury (866) 635-2689
Criminal Defense (866) 635-9402

Bookmark

Health Law

: HealthBlawg

First lawsuit filed against a Business Associate under HIPAA / HITECH

By David Harlow

ADVERTISEMENTS

The first HIPAA enforcement action against a business associate has been filed by the Minnesota Attorney General's office.

In part, it's the same old sloppy story: unencrypted laptop loaded with PHI stolen out of a rental car ... sheesh, when will they ever learn? (See: Privacy and Security: Joke or No Joke?) Cleaner policies and procedures, and internal enforcement, would have made this a non-event, not reportable, off the front pages, and out of court. Instead, the buisiness associate and the covered entity have gotten plenty of negative publicity, which will include a trip to the Wall of Shame. Perhaps the advent of the HIPAA audits by government contractor KPMG, together with unpredictable actions of state attorneys general will motivate business associates and covered entites to get with the program.

Here are the twists in this case:

1. The federales have said that they'renot going to go after business associates until they finally finalize their regs(they've missed the HIPAA / HITECH deadline), but State AGs have been given enforcement authority under HIPAA / HITECH, and they've jumped the gun. (For more on state AG enforcement, see:HIPAA enforcement by state attorneys general: The shape of things to come.)

2. The Minnesota AG is also going after the business associate on the unfair and deceptive business practices front -- for failing to disclose to patients the way in which they use their data (they make one set of disclosures to patients, another to Wall Street). Seefull complaint against Accretive Health(PDF).

As I've been saying for a while, we're going to see more aggressive HIPAA enforcement from beyond the Beltway; this case is an exemplar of just one manifestation of the phenomenon. Another is the growth of private lawsuits bootstrapped on violations of HIPAA or related state laws (this, despite HIPAA's clear statement that it does not provide for third-party lawsuits).

In addition to the HIPAA issues, there's the predictive modeling and consumer transparency side of the case: Accretive, a management consultant to a hospital system, was being paid based on a percentage of cost savings, and was using PHI in its predictive model of patient-specific health care costs. The complaint alleges that this use was not made clear to the patients, though I don't beleive the allegation was made that such use would be improper if appropriate disclosures were made.

Should more explicit disclosures about the uses of health data be made even if not required by federal or state law? I sometimes counsel clients to be more proactive than may be strictly necessary in this department, in order to be sensisitve to the "man on the street" perception of privacy rights -- even in situations where the law does not require that certain data be handled as protected health information subject to HIPAA. The benefit is broader than compliance and risk mitigation; it signals a sensitivity to a hot-button issue that may improve customer relations and improve risk management.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Full post as published by HealthBlawg on February 13, 2012 (boomark / email).

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.
Related Law Blog Posts
Search Blog Directory:

Search Blog Directory:

Related Law Articles

Lawsuits and Settlements

Related Searches

























































































































US Law
#1 Online Legal Resource













Your Blog Subscriptions
Subscribe to blogs

10,000+ Law Job Listings
Lawyer . Police . Paralegal . Etc
Earn a law-related degree
Are you the author of this blog? Adding USLaw.com to your Blogroll increases relevance. You qualify to display a USLaw Network badge.
Suggest changes to this blog's description or nominate another for inclusion. Register for updates.


Practice Area
Zip Code:

Contact a Lawyer Now!






0.9445 secs (new cache)