A Missouri federal district court has ruled, in I.S. v. Washington University, that a HIPAA-covered entity’s disclosure of protected information can form the basis for a state-law negligence claim.  The Court reached this holding despite the well-accepted principle there is no private cause of action under HIPAA. 

The plaintiff, I.S., was undergoing medical treatment for colon cancer at Washington University.  I.S. gave Washington University a limited authorization to disclose only the dates of her treatments in order to satisfy her employer’s medical leave requirements.  Notwithstanding this limited authorization, plaintiff asserts that Washington University also sent her employer additional medical records and information that far exceeded her authorization. These included I.S.’s HIV status, mental health issues, and insomnia treatments.  Based on that disclosure, I.S. sued Washington University for negligence per se based on a violation of HIPAA. 

Procedurally, Washington University removed the state court action to federal court and sought dismissal of the negligence per se claim, arguing that HIPAA does not create a private cause of action. 

The district court, disagreeing with Washington University, held the plaintiff’s claim could stand despite its exclusive reliance on HIPAA.   The court held that a federal statute that does not provide for a private right of action nevertheless may be a legitimate element of a state law negligence per se claim. 

Under Missouri law, among other things, the plaintiff must show:

·         a violation of a statute or ordinance occurred,

·         the plaintiff was a member of the class of people intended to be protected,

·         the injury complained of was of the type intended to protect against, and

·         the violation was the proximate cause of the plaintiff’s injury.  

The Court found that I.S. had met all of the required elements of her claim and remanded the case back to state court. It held that I.S.’s claim, although premised on HIPAA, did not raise a federal question as it did not raise any compelling federal interests or present a substantial federal question.  

This case illustrates the need for HIPAA covered entities to provide training and institute policies and procedures regarding HIPAA compliance.  Here, a process for responding to requests for information would have highlighted the importance of carefully adhering to the limits of the authorization and prevented this alleged unauthorized disclosure, thus precluding I.S.’s claims.  Additionally, employers, and their counsel, must be aware that common law claims may support litigation based on HIPAA, despite the fact HIPAA itself does not provide for a private cause of action. 

NLRB Acting General Counsel Lafe E. Solomon offered some insight into the NLRB’s interest in Social Media earlier this month when he spoke at the Annual Conference on Labor at New York University. During his presentation, Solomon revealed that every one of the 52 NLRB regional offices across the country has at least one pending case presenting issues about employee use of Social Media or an employee’s policy concerning the use of Social Media.

Solomon noted that his work had reached a higher profile than his predecessor, and he credited it in large part to the NLRB’s attention to social media. Solomon said that the “good part” about the intense publicity the NLRB has received over the past year has been that he has had the “rare privilege” of using media appearances and interviews to explain the rights of employees under the National Labor Relations Act (“NLRA”), which had been unfamiliar or unknown to many Americans.

Solomon’s comments make it apparent he enjoys having the NLRB in the spotlight. His comments also explain what may be the motivation behind the NLRB focus on Social Media – the topic of Social Media provides the Board with an always-available platform from which to reach a public which may not otherwise be interested in hearing what the Board has to say about the NLRA.

Due to the pervasiveness of Social Media cases at all 52 regional offices, it appears certain that the summer months will heat-up with discussion of Social Media issues at the workplace.

The pervasiveness of social media in professional and everyday communication is a hot button issue (discussed at length here), particularly for private and public employers and organizations.  In fact, many organizations have adopted, or are considering adopting, social media policies for employees and providing training for how employees should interact in cyberspace.  But what should those policies say and what should the training focus on?

To answer those questions, organizations should, among other things, develop and shape their policies, training and discipline concerning social media with an eye toward their particular businesses, regulatory environments, and whether they are in the public or private sectors. A number of recent developments show why this is critical:

·         Two recent Third Circuit opinions handed down on June 13, 2011– J.S. v. Blue Mountain School District and Layshock v. Hermitage School District (discussed below)– illustrate the importance of educating employees (teachers and administrators) about student’s First Amendment rights concerning social media and when discipline is appropriate,

·         FTC’s guidelines for endorsement of products or services are important for businesses whose employees are likely to be commenting online about the company’s products and services,

·         The NLRB’s recent actions regarding social media use and the National Labor Relations Act are important for all employers, particularly those in traditionally union-dominated industries,

·         The use of social media in the health care setting is presenting a range of challenges under HIPAA and patient privacy generally.

In addressing the extent to which school officials can regulate student speech, the Third Circuit Court of Appeals has held that school officials violated students’ First Amendment free speech rights by disciplining students for creating, outside of school, “fake” social networking profiles ridiculing their school principals. 

In Blue Mountain School District, 8th grader J.S., using her home computer, created a MySpace profile in the name of her principal.  The profile was presented as a self-portrayal of a bisexual Alabama middle-school principal named “M-Hoe,” and contained crude and vulgar content. Upon learning of the content, the School District suspended J.S. for 10 days.  The Court held that because J.S. was suspended for speech that caused no substantial disruption in school and that could not reasonably have led school officials to forecast substantial disruption in school, the School District’s actions violated J.S.’s First Amendment free speech rights.

In Layshock, Justin Layshock, a high school senior, using his grandmother’s computer, also created a MySpace profile in the name of his principal.  The profile included “degrading” content regarding the principal.  Upon learning of the profile, the School District suspended Justin for 10 days.  In analyzing whether a school district may punish a student for expressive conduct that originated outside of the schoolhouse, did not disturb the school environment, and was not related to any school-sponsored event, the Court found the School District was prohibited from reaching beyond the school yard.

These decisions were based on the Supreme Court’s landmark case on the First Amendment’s application to public schools is Tinker v. Des Moines Indep. Cmty. Sch. Dist., 393 U.S. 503 (1969).  In Tinker, a group of high school students decided to wear black armbands to school to protest the war in Vietnam.  When school officials learned of the plan, they preemptively prohibited students from wearing armbands.  Several students who ignored the prohibition and wore armbands to school were suspended.  Eventually, the students brought suit alleging their First Amendment rights had been violated.  The Supreme Court overruled the district and circuit courts, holding that student expression may not be suppressed unless school officials reasonably conclude that such expression will “materially and substantially” disrupt the work and discipline of the school.

These cases demonstrate the court’s struggle in addressing social media content, especially where there are additional constitutional concerns when a party is a public entity.  For many organizations, First Amendment issues will not be at issue, but there likely will be other considerations.  As each and every industry is impacted by social media, attempting to address it in a one-size-fits-all manner without taking appropriate considerations into account is not only impractical, but in some cases unlawful.  As these developments have shown, efforts to address social media must include an effective industry specific social media policy coupled with training programs to educate employees on the use of social media in all facets of employment and conducting the entity’s business.

Reuters and other news outlets are reporting that Representative Mary Bono Mack has circulated draft legislation in response to the steady stream of data breaches that have occurred this year. According to the report, Senate Majority leader Harry Reid also has asked four Senate committees to pull together a comprehensive cybersecurity bill, hoping it will be brought to the floor by late summer. After years of failed attempts at data breach legislation, the federal government could be poised to enact broadly applicable requirements for safeguarding data and responding to data breaches. 

Some key provisions of the draft legislation would require covered entities (basically, any person engaged in interstate commerce) to:

  • establish and implement policies and procedures to protect personal information (defined in a manner similar to most current state breach notification laws) to include, without limitation, designating a point person to manage information security, and having a process for identifying and assessing foreseeable vulnerabilities;
  • erase personal data that is no longer needed and otherwise take steps to minimize the amount of personal information maintained;
  • notify law enforcement within 48 hours of a data breach, and if data could be used to steal a customer’s identity, notify the Federal Trade Commission within 48 hours and begin contacting the affected persons; and
  • provide 2 years of credit reporting services or credit monitoring services to individuals affected by a covered data breach.

The law would be enforceable by state attorneys general and the Federal Trade Commission with maximum penalties running into the millions of dollars. The law would generally preempt similar state laws, but would not permit private lawsuits. 

Of course, companies should not be waiting to see if any action is taken at the federal level. There are a number of states with similar laws already on the books. In addition, exposure from a data breach, particularly when there were no safeguards in place to prevent the breach, should be sufficient motivation to take steps to safeguard personal data.

An article in Bloomberg tells a harrowing story of computers that have secretly come under the control of hackers. This can happen to company and personal computers alike that download certain embedded malware – such as when downloading an email attachment. These computers become known as "bots," and part of a "botnet." The consequences can be crippling.

Accordingly to the article:

The enslaved “bots,” as the infected computers are known, have become so pervasive they now threaten the security of the Internet, said Gunter Ollmann, head of research at Atlanta-based Damballa Inc., which tracks botnet activity. At least 18 percent of home computers are now under remote command of cyber-thieves without their owners’ knowledge, according to Damballa’s research. 

For corporate computers, which are usually protected by expensive security measures, around seven percent are controlled by such malware, which is hidden from the user and controlled via the Internet, Ollmann said.

When this happens, companies can find themselves in uncomfortable and potentially dangerous circumstances . . . consider the following exchange described in the Bloomberg article:

“I’m sure we can settle on control of bots,” a LulzSec hacker called Ninetales told Hijazi, according to a computer log of their interaction provided to Bloomberg News by Hijazi.

When Hijazi said he didn’t want to face extortion, another hacker named hamster_nipples replied: “Unfortunately, you have little choice at this point.”

Hijazi, who declined to identify his corporate clients, refused to comply with LulzSec’s demands and rejected a separate request for money. The hackers posted the company’s e-mails on the Internet June 3.

The harm that can result is significant. The Bloomberg article cites to one example of hackers controlling a botnet who sought to transfer nearly $1 million from one company. In other cases, hackers were successful in removing tens of thousands of dollars from bank accounts of affected companies.

Companies need to be more aware of these developments and take appropriate steps to protect their systems. While there are federal and state laws that require steps be taken to safeguard against these kinds of risks, the extent of damage that a botnet can cause to an entity’s business can be far more damaging. 

Prior to the Health Information Technology for Economic and Clinical Health (HITECH) Act becoming law, the HIPAA Privacy Rule required covered entities to provide individuals with an accounting of certain disclosures of their protected health information (PHI). HITECH enhances these accounting rules and requires that individuals be able to know who has accessed their electronic PHI. The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) is proposing changes to the Privacy Rule to implement these new requirements and is seeking comments from the public to help shape the law so as to provide the greatest transparency for individuals with respect to access to and disclosures of their PHI, while minimizing the burden on covered entities and business associates. Remember, under HITECH, business associate are subject to nearly all of the requirements under the HIPAA Privacy and Security Rules as covered entities. The discussion below touches on some of the key proposals.

HHS’ Notice of Proposed Rulemaking would enhance the rules concerning the obligation to provide an accounting of certain disclosures of PHI and fleshes out the right of individuals to get a report on who has electronically accessed their PHI. These two rights, to an accounting of disclosures and to an access report, would be distinct but complementary. The right to an access report would provide information on who has accessed electronic PHI in a designated record set (including access for purposes of treatment, payment, and health care operations), while the right to an accounting would provide additional information about the disclosure of designated record set information (whether hard-copy or electronic) to persons outside the covered entity and its business associates for certain purposes (e.g., law enforcement, judicial hearings, public health investigations). The intent of the access report is to allow individuals to learn if specific persons have accessed their electronic designated record set information.  In contrast, the intent of the accounting of disclosures is to provide more detailed information (a “full accounting”) for certain disclosures that are most likely to impact the individual.

In general, designated record sets include the medical and health care payment records maintained by or for a covered entity, and other records used by or for the covered entity to make decisions about individuals. See the definition of “designated record set” at 45 CFR § 164.501. An example of PHI that is outside the designated record set are transcripts of customer calls that are used only for purposes of customer service review, rather than to make decisions about the individual.

HHS believes the access report requirement will not present an unreasonable burden on covered entities and business associates because by limiting the access report to information maintained in an electronic designated record set, the report will include information that a covered entity is already required to collect under the HIPAA Security Rule. That is, under §§ 164.308(a)(1)(ii)(D) and 164.312(b) of the HIPAA Security Rule, a covered entity is required to record and examine activity in information systems and to regularly review records of such activity. Access reports would cover a three-year period, and would provide the individual with information about who has accessed the individual’s electronic PHI held by a covered entity or business associate. They would not distinguish between “uses” and “disclosures,” and thus, would apply when any person accesses an electronic designated record set, whether that person is a member of the workforce or a person outside the covered entity. The report would be required to identify the date, time, and name of the person (or name of the entity if the person’s name is unavailable) who accessed the information, and potentially a description of the protected health information that was accessed and the user’s action, if that information is available.

The right to an accounting of disclosures would encompass disclosures of both hard copy and electronic PHI that is maintained in a designated record set. It would cover a three-year period (down from the current six year period), and would require a covered entity and its business associates to account for the disclosures of PHI believed to be of most interest to individuals. That is, the proposed rule explicitly lists the types of disclosures that are subject to the accounting requirement, rather than the previous approach of listing the types of disclosures for which an accounting was not required. In general, the proposed rule would continue to include in the accounting requirement, without limitation, disclosures for public health activities (except those involving reports of child abuse or neglect), for judicial and administrative proceedings, for law enforcement activities, to avert a serious threat to health or safety, for military and veterans activities, for the Department of State’s medical suitability determinations, to government programs providing public benefits, and for workers’ compensation.  Also, covered entities will continue to be required to account for disclosures that are impermissible under the Privacy Rule, even if those disclosures did not amount to a "breach" under the Breach Notification Rule at § 164.404.

While the proposed rules referenced above may vary when made final, they will require covered entities to re-examine their current practices to comply with the new rules. In addition, covered entities and business associates may need to make modifications to business associate agreements (as well as agreements with subcontractors and other vendors).  The Notice of Privacy Practices also will require modification to explain to individuals these new and modified rights concerning their PHI.

In regard to when action is needed, the rules propose that covered entities (including small health plans) and business associates comply with the modifications to the accounting of disclosures requirement beginning 180 days after the effective date of the final regulation (240 days after publication). As for the right to an access report, the rules propose that covered entities and business associates be prepared to make this available beginning January 1, 2013, for electronic designated record set systems acquired after January 1, 2009, and beginning January 1, 2014, for electronic designated record set systems acquired as of January 1, 2009.

It’s hard to miss the National Labor Relations Board’s recent activity targeting employer decisions based on workers’ use of social media – as it attempts to establish parameters in the work-life balance between social media and rights protected by the National Labor Relations Act. Just when employers understandably may feel compelled to stop basing employment decisions on social media use, a recent Advice Memorandum is giving employers hope.

The Arizona Daily Star had encouraged its reporter to use social media to reach people who might not read the paper and to drive readers to the newspaper’s website. The employee tweeted using his work computer, his company-provided cellphone and his home computer and linked his Twitter account to his Facebook and MySpace pages. Therefore, whenever he tweeted, the same message would be posted on Facebook and MySpace.

In one tweet, the employee criticized the Daily Star’s television staff. The employer warned the employee that his comments were inappropriate, but he continued to post inappropriate tweets, while commenting as a public safety reporter. The tweets included, “What?/?/?/? No overnight homicide? WTF? You’re slacking Tuscon.”

His employer suspended him then terminated his employment. He filed a charge with the NLRB Regional Office claiming he was terminated for engaging in NLRA-protected concerted activity. The Regional Office, as instructed by Office of the General Counsel’s Memorandum dated April 12, 2011, referred the charge to the Division of Advice (“Division”) because the charge involved discipline for engaging in alleged protected concerted activity using social media.
The Division did not find a violation of the NLRA. It instructed the NLRB Regional Office to dismiss the unfair labor practice charge. It determined that after opening a Twitter account and linking it to the Daily Star’s website, the employee engaged in “inappropriate and offensive Twitter postings that did not involve protected concerted activity” and was terminated for engaging in misconduct. This is an important development for employers, perhaps signaling the NLRB’s seemingly aggressive social media stance may not be one-sided.

The victory, however, has been tempered by the NLRB General Counsel’s May 9, 2011, complaint against Hispanics United of Buffalo, a nonprofit organization that provides social services to low-income clients. The complaint alleges the firing of five employees for Facebook postings that criticized working conditions was improper interference with protected concerted activity. It alleged that an employee posted a co-worker’s allegations that employees did not help the company’s clients enough and other employees responded to the post by defending their work and blaming working conditions, including staffing workload issues. The employer fired the five employees after learning of the posts because it found the comments were harassing to the employee who made the original post. A hearing has been scheduled for June 22, 2011.

These latest developments seem to show the NLRB searching for balance between the workplace and social media. The Wall Street Journal reports the Board said it had more than two dozen cases involving worker complaints aired on the social media site Facebook. Stay tuned . . . but in the mean time, employers need to think carefully before acting.

The Maryland Senate recently referred Senate Bill 971 which prohibits Maryland employers from demanding that workers and job applicants turn over their passwords to specific websites or web-based accounts. 

Under the bill, employers would be prohibited from refusing to hire applicants and disciplining, terminating, or taking other adverse employment action against employees who refuse to provide their passwords. The bill also bans employers’ threats of such action.  

The bill was introduced in response to employers’ asking applicants and employees for their passwords as part of background checks to see the content posted by the individuals on social networking sites (e.g., Facebook ). S.B. 971 would, however, permit employers to require workers to disclose their passwords only to the employers’ internal computer systems.  

This proposed Maryland law, and case law from New Jersey, should alert employers that utilizing social media in their hiring, discipline, or termination decisions is under scrutiny.

One might think that bankruptcy is a private matter, with little to no bearing on whether one can meet the qualifications for a particular job. As my colleagues report today, the U.S. Court of Appeals for the Eleventh Circuit (with jurisdiction over Alabama, Florida and Georgia) joins its sister Circuits (the Third and Fifth Circuits) in holding that it is not impermissible under the Bankruptcy Code for an employer to refuse to hire an applicant due to a prior bankruptcy. Myers v. Toojay’s Mgmt. Corp., No. 10-10774 (11th Cir. May 17, 2011). However, as discussed in their report, the Code does state that a private employer may not “terminate the employment of, or discriminate with respect to employment against” an employee due to a bankruptcy. 11 U.S.C. § 525(b).

Of course, what is permissible under the Bankruptcy Code may not be under state law. As the report notes, and as reported here, a handful of states (e.g., Hawaii, Illinois, Maryland, Oregon, and Washington) have enacted limitations on an employer’s ability to acquire or use credit information in making hiring decisions. Further, any bankruptcy information acquired with respect to an applicant may include personal information that may need to be safeguarded, and as my colleagues advise, the use of that information should be based on job-related considerations to avoid Equal Employment Opportunity Commission claims based on adverse impact theories. 

In a report issued earlier this week, the Office of Inspector General found that the Center for Medicare and Medicaid Services’ (CMS) oversight and enforcement actions were not sufficient to ensure that covered entities, such as hospitals, effectively implemented the HIPAA Security Rule.

OIG’s recommendation: Continue the compliance review process (audits) that began in 2009 and implement procedures for conducting compliance reviews to ensure that HIPAA Security Rule controls are in place and operating as intended to protect ePHI at covered entities.

To reach this conclusion, OIG audited 7 hospitals throughout the country (locations in California, Georgia, Illinois, Massachusetts, Missouri, New York, and Texas).  These audits focused primarily on:

  1. wireless electronic communications network or security measures the security management staff implemented in its computerized information systems (technical safeguards);
  2. the physical access to electronic information systems and the facilities in which they are housed (physical safeguards); and
  3. the policies and procedures developed and implemented for the security measures to protect the confidentiality, integrity, and availability of ePHI (administrative safeguards).

Significant vulnerabilities identified. The audits identified 151 vulnerabilities in the systems and controls intended to protect ePHI, of which 124 were categorized as high impact. A high vulnerability refers to one that

may result in the highly costly loss of major tangible assets or resources; may significantly violate, harm, or impede an organization’s mission, reputation, or interest; or may result in human death or serious injury.

The report noted that outsiders or employees at some hospitals could have accessed, and at one hospital did access, systems and beneficiaries’ personal data and performed unauthorized acts without the hospitals’ knowledge. Although each of the seven hospitals had implemented some controls, policies, and procedures to protect ePHI from improper alteration or destruction, none had sufficiently implemented the administrative, technical, and physical safeguard provisions of the Security Rule. Clearly, mediocre compliance is not sufficient.  

Some of the more significant vulnerabilities found related to (i) wireless access; (ii) access controls, and (iii) integrity controls. In the case of wireless access problems, the report identified vulnerabilities including ineffective encryption, rogue wireless access points, no firewall separating wireless from internal wired networks, the inability to detect rogue devices intruding on the wireless network, and no procedures for continuously monitoring the wireless networks. Access control problems included inadequate password settings, computers that did not log users off after periods of inactivity, unencrypted laptops containing ePHI, and excessive access to root folders. According to the OIG, these conditions could have led to unauthorized individuals viewing or altering ePHI data on nonclinical workstations that were not automatically logged off after a period of inactivity; ePHI being compromised on lost or stolen unencrypted laptops; and unauthorized users circumventing system controls and harming system files.

The list goes on and on.

The Office of Civil Rights (OCR), the arm of HHS now charged with enforcing the HIPAA security regulations, may be listening. As reported here earlier, OCR appears to be taking steps to improve its enforcement efforts, which likely will include increasing the number of compliance reviews/audits at hospitals and health care providers around the country. These efforts include a request by the agency to increase its budget for 2012 by $5.6 million, or 13.6%, to be aimed at enforcement. 

Because HIPAA now applies to business associates, it would not be surprising to see business associates on an audit list. Accordingly, covered entities and business associates should be taking steps now to ensure compliance.