First Lawsuit Filed Against a Business Associate Under HIPAA / HITECH

February 14, 2012
49 Views

The first HIPAA enforcement action against a business associate has been filed by the Minnesota Attorney General’s office.

The first HIPAA enforcement action against a business associate has been filed by the Minnesota Attorney General’s office.

In part, it’s the same old sloppy story: unencrypted laptop loaded with PHI stolen out of a rental car … sheesh, when will they ever learn?  (See: Privacy and Security: Joke or No Joke?)  Cleaner policies and procedures, and internal enforcement, would have made this a non-event, not reportable, off the front pages, and out of court.  Instead, the buisiness associate and the covered entity have gotten plenty of negative publicity, which will include a trip to the Wall of Shame.  Perhaps the advent of the HIPAA audits by government contractor KPMG, together with unpredictable actions of state attorneys general will motivate business associates and covered entites to get with the program.

Here are the twists in this case:

1. The federales have said that they’re not going to go after business associates until they finally finalize their regs (they’ve missed the HIPAA / HITECH deadline), but State AGs have been given enforcement authority under HIPAA / HITECH, and they’ve jumped the gun.  (For more on state AG enforcement, see: HIPAA enforcement by state attorneys general: The shape of things to come.)

2. The Minnesota AG is also going after the business associate on the unfair and deceptive business practices front — for failing to disclose to patients the way in which they use their data (they make one set of disclosures to patients, another to Wall Street). See full complaint against Accretive Health (PDF).

As I’ve been saying for a while, we’re going to see more aggressive HIPAA enforcement from beyond the Beltway; this case is an exemplar of just one manifestation of the phenomenon.  Another is the growth of private lawsuits bootstrapped on violations of HIPAA or related state laws (this, despite HIPAA’s clear statement that it does not provide for third-party lawsuits).

In addition to the HIPAA issues, there’s the predictive modeling and consumer transparency side of the case: Accretive, a management consultant to a hospital system, was being paid based on a percentage of cost savings, and was using PHI in its predictive model of patient-specific health care costs.  The complaint alleges that this use was not made clear to the patients, though I don’t beleive the allegation was made that such use would be improper if appropriate disclosures were made.  

Should more explicit disclosures about the uses of health data be made even if not required by federal or state law?  I sometimes counsel clients to be more proactive than may be strictly necessary in this department, in order to be sensisitve to the “man on the street” perception of privacy rights — even in situations where the law does not require that certain data be handled as protected health information subject to HIPAA.  The benefit is broader than compliance and risk mitigation; it signals a sensitivity to a hot-button issue that may improve customer relations and improve risk management.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting
 
 

You may be interested

Healthcare Tech Advances That All Clinics Should Use
Medical Devices
461 views
Medical Devices
461 views

Healthcare Tech Advances That All Clinics Should Use

Dennis Hung - August 12, 2017

Healthcare will always be important to employees and the government since the issues surrounding healthcare are inherently ethical and moral…

Balancing Smart Data With Cybersecurity for Hospitals
Hospital Administration
453 views
Hospital Administration
453 views

Balancing Smart Data With Cybersecurity for Hospitals

Kayla Matthews - August 11, 2017

It should come as no surprise that your discussions and interactions with physicians and health professionals influence diagnoses, prescriptions, visit…

4 Ways to Halt Testosterone Problems After 40
Wellness
469 views
Wellness
469 views

4 Ways to Halt Testosterone Problems After 40

JohnHenning - August 10, 2017

Among men of all ages, testosterone is an important hormone for regulating health. Men over the age of 65 tend…