OCR sent out a Friday happy-hour email blast proudly announcing dissemination of a new “Crosswalk” tool, which correlates NIST cyber security standards with HIPAA security regulations. Click here for the “Crosswalk”.
A cautionary tale is found in a memorandum decision issued by the Arizona Court of Appeals, Division One. The plaintiff commenced a medical malpractice – wrongful death action against the hospital. After the statute of limitations expired, the plaintiff amended the complaint to add individual physicians and an emergency medicine group a defendants.
When the doctors sought dismissal based on the statute of limitations, the plaintiff argued that, although the doctors’ names appeared in the hospital record, the plaintiff had no reason to suspect that they were not hospital employees.
The Court of Appeals affirmed the Superior Court’s dismissal as to the new defendants. The court held that the mistake that triggers Rule 15(c) relation back must be as to the identity, not the status, of the new defendant. The court also noted that the suit against the hospital did not put the doctors on notice that, but for a mistake, they would have been sued too.
Howard v. Scottsdale Emergency Associates (Feb. 18, 2016)
A proposed class action was brought against the county by misdemeanor detainees who were unconstitutionally strip searched. The carrier defended the county and settled the case. The named plaintiff got $5K, the remaining 800 class members got $1K each, and counsel for the class got $400K+.
To the county’s chagrin, the high court affirmed that each class member represented a separate occurrence. This meant that deductibles, which ranged from $10K to $15K, where separately applied to each class member. This was mitigated by allocating the attorney fees to the claim of the first-named class plaintiff, leaving the carrier to shoulder the bulk of the fees.
The county also argued that the insurer acted in bad faith. The court found no indication in the record that the insurer acted in a “gross disregard” of the county’s interests.
Selective Insurance v County of Rensselaer (Feb. 11, 2016)
The salon patron claimed that the pedicurist cut her foot with a “razor blade, a razor-like implement, an illegal instrument or an unauthorized pedicure tool, in violation of a regulation of the Division of Licensing Services . . . (22 NYCRR 168.18)”. Unfortunately for her, the salon’s liability policy excluded coverage of bodily injury arising from violation of a statute, rule or regulation. When she later said that the implement in question did not actually violate the regulation, the Appellate Division, First Department said
this argument directly contradicts the sworn statements in plaintiff’s verified pleadings and deposition testimony, and therefore fails to raise an issue of fact.
Summary judgment in favor of the insurer affirmed.
Zakheim v Leading Ins. Servs., Inc. (Feb. 9, 2016)
A manager for a home respiratory therapy and infusion company moved out of the marital residence. The husband told OCR that she left documents behind that contained Protected Health Information. OCR hit the company with a CMP of $239,800. The company asked for a hearing, but the Administrative Law Judge granted summary judgment in favor of the government.
The company argued that hubby stole the paperwork, making the company an innocent crime victim. The ALJ scoffed at this, noting that HIPAA was clearly violated when the manager
“took documents out of the office, left them in places (car or home) accessible to this purportedly untrustworthy and possibly unbalanced individual, and then, apparently without giving a thought to the security of those documents, abandoned them entirely”.
When asked about policy changes in response to the event, the company’s Chief Compliance Officer said staff had
“considered putting a policy together that said thou shalt not let anybody steal your protected health information.”
I take it they were not interested in settling the charges.
So as Spring makes a somewhat early return to the Valley of the Sun, and heart shaped wreaths start to adorn romantic residences, OCR put out its press release noting that
“This is only the second time in its history that OCR has sought CMPs for HIPAA violations, and each time the CMPs have been upheld by the ALJ.”
The defendant physician failed to sedate the patient before administering a sacrococcygeal ligament injection, although the consent form specifically required it. The parties disagreed about the appropriate jury charge. The trial court gave the standard battery charge, as urged by the defense, which required the jury to find that the defendants “intended to cause harm or offensive contact”. The jury returned a verdict in favor of the defendants. The Court of Appeals, Division 1, reversed, finding that the instruction requested by the plaintiff was more appropriate: “[plaintiff] must prove . . . [defendants] performed . . . in willful disregard of the conditional consent”.