Articles Posted in HIPAA

The Office for Civil Rights (“OCR”), a division of the Department of Health and Human Services (“HHS”), is responsible for investigating complaints and reports that covered entities (i.e., health plans, health care clearinghouses, or health care providers that conduct certain electronic transactions) or business associates have violated either the HIPAA Privacy or Security Rule. The HIPAA Privacy and Security Rules exist to safeguard Protected Health Information (“PHI”) that is held, used, or disclosed by covered entities and their business associates. Generally, any individually identifiable health information held by or that is within a covered entity’s or its business associates’ control is considered PHI, and any non-permitted release of PHI is considered a HIPAA violation.

Historically, the OCR has investigated and sanctioned larger covered entities and business associates in connection with HIPAA violations that affect the PHI of 500 or more individuals. OCR’s recent settlement agreement with Anthem, which corresponded to the much-publicized 2015 cyber-attack on Anthem’s information systems compromising the PHI of over 79 million individuals, is a good example of OCR’s normal enforcement activity (with the exception of the $16 million fine, the largest to date for a HIPAA violation). However, since 2015, the OCR has placed emphasis on investigating and at times fining smaller covered entities for breaches affecting less than 500 individuals (after a report issued by the HHS Office of Inspector General found that the OCR had typically not investigated the same). Two recent fines issued by the OCR illustrate this emphasis.

The first was issued against Allergy Associates of Hartford, P.C. (“Allergy Associates”), which is comprised of four physicians and two mid-level providers. The settlement agreement, announced on November 26, 2018, requires Allergy Associates to pay a $125,000 fine and enter into a two-year corrective action plan (“CAP”) with the OCR. The incident leading to the alleged violation involved a patient who tried to enter Allergy Associates for treatment while accompanied by her service dog. Upon seeing the dog, an Allergy Associate’s physician turned the patient away, advising the patient that he and many of his patients were allergic to dogs. The patient thereafter contacted a local media outlet about what happened, and also filed a complaint to the Department of Justice alleging that Allergy Associates violated her civil rights under the Americans with Disabilities Act. A physician from Allergy Associates later spoke with a reporter from the media outlet (off-the-record) regarding the incident and disclosed the patient’s PHI. Despite the fact that the reporter was already familiar with the incident, the physician’s statements to the reporter concerning the patient violated HIPAA, as he did not have her prior written authorization to disclose the information. Moreover, and despite an obligation under HIPAA to do so, Allergy Associates made no attempt to sanction the doctor internally.

In January, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) published a final rule, which modifies HIPAA privacy rules to allow for easier sharing between certain HIPAA covered entities and the National Instant Criminal Background Check System (NICS). Specifically, the final rule allows certain HIPAA covered entities to share with NICS the identities of individuals prohibited under federal law from legally owning a firearm.

The Gun Control Act of 1968 prohibits categories of individuals from engaging in the shipment, transport, receipt or possession of firearms. The Department of Justice (DOJ) issued regulations applying the prohibition to those that have been involuntarily committed to a mental institution, those found to be incompetent to stand trial or found not guilty by reason of insanity are prohibited from owning a firearm, or otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or unable to manage their own affairs as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease. This prohibition is referred to as the “mental health prohibitor.” The January final rule provides that only covered entities which already have lawful authority to render adjudication decisions which subject individuals to the mental health prohibitor may disclose those individuals’ identities to the NICS. The final rule does not allow for clinical or medical information to be disclosed; only demographic information about individuals subject to the prohibitor may be disclosed.

In the text and analysis of the Final Rule, the OCR explains the very limited and narrow exception to HIPAA privacy rules as a balance between patient privacy and public safety goals. The Final Rule cited the American Medical Association’s (AMA’s) support for the Final Rule stating that the AMA “…Code of Ethics supports strong protections for patient privacy and, in most cases, requires physicians to keep patient medical records strictly confidential. If there must be a breach in confidentiality, such as for public health or safety reasons, the disclosures must be as narrow in scope as possible.” In addition, OCR cited uniformity as a justification for the Final Rule. OCR explained that some states have not established reporting rules for this type of disclosure to the NICS. Thus, this rule will allow for more uniform reporting standards throughout all fifty states.