Internet Calendar Postings at the Center of Alleged HIPAA Privacy Violation Settlement

By George F. Indest III, J.D., M.P.A., LL.M., Board Certified by The Florida Bar in Health Law

A physician group has reached a settlement with the United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) over alleged Health Insurance Portability and Accountability Act of 1996 (HIPAA) violations. The settlement was reached on April 17, 2012. It requires Phoenix Cardiac Surgery (PCS) to pay OCR $100,000. PCS is also required enter into a one-year corrective action plan (CAP). The Resolution Agreement and Corrective Action Plan can be viewed here.

HIPAA Complaint Resulted from Internet Calendar Postings.
OCR's investigation of PCS was launched after a complaint was received in 2009. Click here to view a HIPAA complaint that you can file online. The complaint alleged that PSC disclosed protected health information (PHI) on patients on the Internet. After investigating the complaint, the OCR alleged that PCS violated the HIPAA privacy and security rules.

According to the OCR, PCS posted clinical and surgical appointments on a publicly accessible, Internet calendar. The OCR also alleged that PCS employees e-mailed protected health information to their personal e-mail accounts. Furthermore, PCS allegedly did not have adequate administrative, physical and technical safeguards in place to protect patient data. The OCR alleged that PCS did not appoint a security officer as required by HIPAA or perform an accurate and thorough risk assessment, also required by HIPAA. The CAP required by the settlement will require PCS to implement policies to ensure full compliance with HIPAA's privacy and security rules.

Are You In Compliance with HIPAA?

The Health Insurance Portability and Accountability Act of 1996, sometimes referred to as the Kennedy-Kassenbaum Act, was enacted into law as Public Law (P.L.) 104-191, 110 Stat. 1936. Among its many different provisions, it included basic minimums to ensure the privacy of personal medical information. Its main privacy provisions are codified in federal law in different sections of the U.S. Code.

Health Providers Must be Cautious When Working With Electronic Health Information.
This case provides a good example of the downside of information technology (IT). While electronic health information assists in increasing accessibility and efficiency, it can also increase a practice's risk of violating HIPAA's Privacy Rule and Security Rule. All medical practices that utilize electronic health information need to ensure that they have effective IT security, education, policies and procedures in place to protect themselves from HIPAA's violations.

Contact a Health Law Attorney Experienced in Defending HIPAA Complaints and Violations.

The attorneys of The Health Law Firm represent physicians, medical groups, nursing homes, home health agencies, pharmacies, hospitals and other healthcare providers and institutions in investigating and defending alleged HIPAA complaints and violations and in preparing Corrective Action Plans (CAPs).

For more information about HIPAA violations, electronic health records or corrective action plans (CAPs) please visit our website at http://www.thehealthlawfirm.com/ or call (407) 331-6620 or (850) 439-1001.

Sources Include:

HHS Press Office. "HHS Settles Case with Phoenix Cardiac Surgery for Lack of HIPAA Safeguards." U.S. Department of Health and Human Services. (Apr. 17, 2012). Press Release. From http://www.hhs.gov/news/press/2012pres/04/20120417a.html

Lewis, Nicole. "Online Calendar Mistakes Cost Doctors Group $100,000." Information Week. (Apr. 23, 2012). From http://www.informationweek.com/news/healthcare/security-privacy/232900727

Sterling, Robyn. "HHS Settlement for Lack of HIPAA Safeguards." Proskauer Privacy Law Blog. (Apr. 25, 2012). From http://www.jdsupra.com/post/documentViewer.aspx?fid=e548966a-d7eb-4f47-a0af-de15db487dbb/

About the Author: George F. Indest III, J.D., M.P.A., LL.M., is Board Certified by The Florida Bar in Health Law. He is the President and Managing Partner of The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. http://www.thehealthlawfirm.com/ The Health Law Firm, 1101 Douglas Ave., Altamonte Springs, FL 32714, Phone: (407) 331-6620.

Impact of a Criminal Charge on Florida Health Professional

Criminal charges against a health care professional can have serious consequences. This post will discuss the impact of a criminal charge on a Florida licensed health professional. 

What is the Effect of a Plea of Nolo Contendere for a Florida Licensed Health Professional?

Pursuant to the general chapter of Florida Statutes applicable to all licensed health professionals (Chapter 456), a plea of nolo contendere is treated the same as a plea of guilty for all purposes. Additionally the chapter of Florida Statutes that governs each type of health professional usually contains similar provisions; sometimes this will be in the Florida Administrative Code (F.A.C.) Rules that have been adopted by the separate professional licensing board for that profession.

What Is the Effect of an Adjudication or Finding of Adjudication Withheld?

Pursuant to the general chapter of Florida Statutes applicable to all licensed health professionals (Chapter 456), an adjudication or finding of adjudication withheld (or "adjudication deferred" in some jurisdictions) is treated the same as a finding of guilty for all purposes. Additionally the chapter of Florida Statutes that governs each type of health professional usually contains similar provisions; sometimes this will be in the Florida Administrative Code (F.A.C.) Rules that have been adopted by the separate professional licensing board for that profession.

When must a Licensed Health Professional Report Guilty Pleas (Nolo Plea or Guilty Plea) and Convictions (Adjudication Withheld or Finding of Guilty) to the Florida Department of Health?

Any guilty plea (as defined above as a nolo plea or guilty plea) or any adjudication of guilt (as defined above as adjudication withheld or finding of guilty) of any crime must be reported by the health professional to his or her professional licensing board (or the Department of Health when there is no board) within thirty (30) days of the conviction or finding. Section 456.072(1)(x), Florida Statutes.

In Florida, all health professionals licensed or regulated under Chapter 456 of Florida Statutes, are required to report to their professional board (or the Florida Department of Health if there is no professional board in their profession) any convictions or findings of guilty of criminal offenses, in any jurisdiction.

Unfortunately, pursuant to Florida Statutes, a plea of nolo contendere must be reported just as a plea of guilty to an offense (a plea of not guilty does not need to be reported). A finding of guilty or a finding of adjudication withheld (also called a "withhold" or "deferred adjudication" in some jurisdictions) must also be reported (a finding of not guilty, a dismissal, a nolle prosequi, pretrial diversion or pretrial intervention program in almost all cases dose not have to be reported).

Licensed practitioners who also are required to have a profile with the Department of Health (e.g., physicians licensed under Chapters 458, 459, 460 or 461), must submit an update to their profile, including criminal convictions, within fifteen (15) days of the "final activity that renders such information a fact." Section 456.042, Florida Statutes. For example, a doctor of medicine (M.D.), licensed pursuant to chapter 458, Florida Statutes, must submit an update to the physician's profile within fifteen (15) days. A registered respiratory therapist, on the other hand, doesn't have a profile. The registered respiratory therapist would have to report a matter qualifying with the above within thirty (30) days to his or her board, the Board of Respiratory Care. (A finding of not guilty, a dismissal, a nolle prosequi, pretrial diversion or pretrial intervention program in almost all cases dose not have to be reported).

As with any such important legal matter, we recommend reporting in a typed, professional letter, via a reliable method of delivery which provides tracking and delivers you a receipt. We do not consider e-mail to be reliable or susceptible of verification or tracking. We usually recommend reporting such matters via U.S. Express Mail, with a return receipt requested. Be sure to keep copies of the correspondence, the receipt of mailing and the return receipt, to document reporting and delivery dates, and to prove receipt.

Always consult the latest versions of the Florida Statutes and the Rules of the Department of Health and your professional board to make sure you have the correct information. We recommend retaining a health attorney familiar with the Department of Health and its regulatory processes, as such a report will usually require the Department of Health to commence an investigation of the health professional, even if the health professional is located in another state.

Which Crimes May Result in an Automatic Bar to Licensure?

Senate Bill 1984, effective July 1, 2009, amended various section of Florida Statutes, including sections of Chapter 456. These amendments prohibit the Department of Health from granting a new license to or granting the renewal of a license to a health professional because of a guilty plea or conviction of certain offenses. This is also grounds for revocation of the health professional's license. Generally, as set forth in Section 456.0635(2)(a), Florida Statutes these are: Being convicted of, or entering a plea of guilty or nolo contendere to, regardless of adjudication, a felony under:

• Chapter 409 (the Medicaid Program)
• Chapter 817 (Fraud)
• Chapter 893 (Drugs)
• 21 U.S.C. Sects. 801-970 (Food and Drugs); or
• 42 U.S.C. Sects. 1395-1396 (Medicare, Medicaid, and Social Security)

unless the sentence and any subsequent period of probation for such conviction or pleas ended more than 15 years prior to the date of the application. (Sect. 456.0635(2)(a), Fla. Stat.) Additionally, grounds for discipline against the existing license of health professional includes:

• Any misdemeanor or felony relating to Medicaid fraud: "Being convicted of, or entering a plea of guilty or nolo contendere to, any misdemeanor or felony, regardless of adjudication, under 18 U.S.C. Sect. 669, Sects. 285-287, Sect. 371, Sect. 1001, Sect. 1035, Sect. 1341, Sect. 1343, Sect. 1347, Sect. 1349, or Sect. 1518, or 42 U.S.C. Sects. 1320a-7b, relating to the Medicaid program." (Sect. 456.072(1)(ii), Fla. Stat.
• Being convicted of, or entering a plea of guilty or nolo contendere to, any misdemeanor or felony, regardless of adjudication, a crime in any jurisdiction which relates to health care fraud. (Sect. 456.072(1)(ll), Fla. Stat.

Defense Strategies and Avoidances

• Plead to some offense or offenses other than the ones listed above.
• Avoid a felony conviction; misdemeanors do not prohibit licensure or renewal, but may result in disciplinary action.
• Avoid any offenses that sound like "health fraud," "Medicaid fraud" or "Medicare fraud."
• Violations of other states' laws don't count; just Florida's and federal listed above (caveat).
• Attempt to obtain pre-trial diversion, pre-trial intervention or drug court.
• Attempt to avoid having to enter a guilty plea or nolo plea.
• Attempt to include in settlement agreement/plea bargain agreement/stipulation that client may apply to have record sealed immediately upon completion of requirements and State will not object.
• Advise client to immediately apply for sealing of record when all requirements of probation are met.
• Obtain input from a board certified health lawyer or other "expert" as to the disproportionate effect (all of the collateral consequences) that a "conviction" may have on the licensed health professional.

What Are the Collateral Effects of "Conviction" of above Offenses?

1. A case involving an arrest or a conviction involving alcohol abuse (DUI/public Intoxication) or drugs (possession, diversion, theft, trafficking) will probably result in an emergency suspension order (ESO) until entire licensure case is complete.
2. Client may be required to be evaluated and probably enrolled in the Impaired Nurses Program (IPN) (for nurses only) or the Professionals Resource Network (PRN) (for all other licensed health professionals), which is usually at least a five year contract.
3. Action to revoke, suspend or take other action against the clinical privileges and medical staff membership of those licensed health professionals who may have such in a hospital, ambulatory surgical center, skilled nursing facility, or staff model HMO or clinic. This will usually be physicians, physician assistants (PAs), advance registered nurse practitioners (ARNPs), certified registered nurse anesthetists (CRNAs), podiatrists, clinical psychologists and clinical pharmacists.
4. Mandatory report to the National Practitioner Data Base (NPDB) (Note: Healthcare Integrity and Protection Data Bank or HIPDB recently folded into NPDB) which remains there for 50 years.
5. Must be reported to and included in the DOH profile that is available to the public online (for those having one), and remains for at least ten years.
6. Any other states or jurisdictions in which the client has a license will also initiate action against him or her in that jurisdiction. (Note: I have had two clients who had licenses in seven other states).
7. The OIG of HHS will take action to exclude the provider from the Medicare Program. If this occurs (and most of these offense require mandatory exclusion) the provider will be placed on the List of Excluded Individuals and Entities (LEIE) maintained by the HHS OIG.
8. If the above occurs, the provider is also automatically "debarred" or prohibited from participating in any capacity in any federal contracting and is placed on the U.S. General Services Administration's (GSA's) debarment list.
9. The U.S. Drug Enforcement Administration (DEA) will act to revoke the professional's DEA registration if he or she has one.
10. The certified health professional's certify organization will act to revoke his or her certification.
11. Third party payors (health insurance companies, HMOs, etc.) will terminate the professional's contract or panel membership with that organization.
12. Any profile maintained by a national organization or federation (e.g., American Medical Association physician profile or Federation of State Boards of Physical Therapy profile) will include the conviction.
13. Regardless of any of the above, any facility licensed by AHCA (hospitals, skilled nursing facilities (SNFs), public health clinics, public health clinics, group homes for the developmentally disabled, etc.) that are required to perform background screenings on their employees will result in AHCA notifying the facility and the professional that he or she is disqualified from employment.

 For further information, visit our website at http://www.thehealthlawfirm.com/.