Workplace Privacy Counsel : San Francisco Employment Privacy Law Lawyer & Attorney : Littler Mendelson Law Firm : Employment Related Privacy Issues

While the employee may bear the brunt of the criminal prosecution, the employee’s unauthorized conduct exposes the employer on at least three different levels. First, the U.S. Department of Health & Human Services (HHS) could pursue civil penalties against the employer. Since the Health Information Technology for Economic and Clinical Health (HITECH) Act supplemented HIPAA, effective February 17, 2010, civil penalties for HIPAA violations have been substantially enhanced. While HHS has yet to promulgate regulations construing the statutory penalty provisions, the minimum penalty for an employee’s unauthorized access to patient plan participant records apparently would be $1,000 per record reviewed if the employer had implemented measures to prevent the unauthorized access and $10,000 per record reviewed where the employer had failed to implement adequate protections. Second, although the federal courts unanimously agree that HIPAA provides no private right of action, the patient or plan participant whose records were viewed without authorization could assert common law, privacy-based claims, alleging vicarious liability on the employer’s part for the employee’s unauthorized access. Finally, the unauthorized access likely would constitute a security breach under HIPAA’s new security breach notification requirements. Were the snooping employee to access the records of 500 or more patients or plan participants, the employer would be required to notify not only the voyeur’s victims but also HHS and prominent media outlets in the state where the victims are located.

The jailing of the Chinese researcher highlights the fact that providers and employers no longer can be complacent about HIPAA compliance. Both health care providers and employers offering HIPAA-covered health benefits should revisit and, if necessary, update the policies they adopted when HIPAA first went into effect more than six years ago. Compliance efforts should focus, in particular, on preventing the types of conduct most likely to trigger security breach notification obligations, such as unauthorized access to and disclosures of health information and the loss or theft of equipment containing health information in unencrypted form. While technologies such as encryption and data loss prevention software can go a long way towards to reducing risk, providers should consider robust and frequent training programs that convey the message there is no such thing as “a littler harmless snooping” when it comes to patients’ and plan participants’ medical records.

This entry was written by Philip L. Gordon.

The duty of disclosure applies even when the employee’s endorsement appears on a site that is not maintained by the employer or employee (such as a popular “bulletin board”) and the statement itself is not misleading. See 16 C.F.R. Part 255.5 (entitled “Disclosure of material connections”), Example 8. Failure to make such disclosure may expose the employer to liability under the Act.

If employees make misleading statements about the employer’s products and services that result in injury to consumers, the FTC may bring an enforcement action against the employer. The FTC reports that it has brought enforcement actions against employers “whose failure to establish or maintain appropriate internal procedures” had resulted in consumer injury, but the FTC suggested in comments on the guidelines that it would be unlikely to take action against an employer for the conduct of a single “rogue” employee whose conduct violated an adequate company policy.

Additionally, because postings on blogs and Facebook pages can reach wide audiences, employers may be vulnerable to large-scale liability like class-action lawsuits by consumers and/or legal action by state attorneys general.

In view of this latest possible exposure to employers from employees’ use of blogs and social websites, employers should consider reviewing their electronic communications or social media policies to ensure: (1) that they have policies addressing the use of the company’s name, trademarks, and other proprietary information in blogs and other social media; and (2) that these policies include either prohibitions or appropriate guidance regarding references to company products or services. Such prohibitions and/or guidance should no longer be limited to criticisms of the employer and its products and/or services. Endorsements, if permitted at all, should be limited to truthful and verifiable statements, or should be subject to prior approval by management. And in either event, such statements must be accompanied by an employee’s written disclosure of the employment relationship so that consumers can fairly weigh the testimonial.

This entry was written by Lisa Brauner.

Q: Do the HIPAA security breach requirements that you discussed during the webinar apply to employers who have fully insured plans or only to employers who have self-insured plans?

A: Most employers with fully insured plans receive only summary health information and enrollment and disenrollment information from the health insurer. This information is considered protected health information (PHI); however, given the very small amount of PHI that an employer with a fully insured plan receives, the likelihood of a breach involving that information is low. Also, because the insurance company that provides the health insurance is not acting as the employer’s agent, the insurance company, not the employer, would be required to provide the notice for a breach of PHI maintained by the insurer. Fully insured employers should keep in mind that if they do offer a health care reimbursement flexible spending account, they are likely to have a significant amount of PHI on-site, and if a third-party administrator suffers a breach, the employer would be ultimately responsible for ensuring that the plan participants are notified.

Q: How do the HIPAA regulations define the term “business associate,” and what are the requirements for the employer or health care provider if a business associate experiences a security breach?

A: A business associate is a vendor who provides services for a health plan or health care provider using PHI. Some examples of business associates include billing services, debt collection agencies, third-party administrators, insurance brokers, pharmacy benefits managers, accountants, attorneys, and auditors. An employer or health care provider can disclose PHI to a business associate without the subject’s prior authorization but only if there is a written agreement (known as a “business associate agreement”) in place with the business associate. The business associate agreement is required to include at a minimum certain provisions listed in the HIPAA regulations that are intended to protect the confidentiality of PHI and ensure that individuals can exercise their HIPAA-mandated rights with respect to their PHI.

If a business associate experiences a breach, the business associate is required to notify the employer/health plan or the health care provider and identify the plan participants or patients whose PHI has been compromised. Employers and health care providers should consider supplementing this statutory notice requirement through contractual provisions in the business associate agreement that require the business associate to provide additional information about the breach, such as the date it occurred, the date it was discovered, what happened, what steps the business associate took to end the breach, and what steps the business associate will take to prevent a recurrence.

Q: Should we have a business associate agreement with the company that we use to shred protected health information (PHI)? Also, our payroll provider houses information on contributions for our healthcare reimbursement flexible spending account. Should we have a business associate agreement with them?

A: Your organization should have a business associate agreement with that shredding company. Information on contributions to a health care reimbursement flexible spending account is PHI, so your organization also should have a business associate agreement with the payroll provider.

Q: Is de-identified protected health information (PHI) subject to the breach notification requirements?

A: No. Once PHI has been de-identified, the information no longer is protected by HIPAA. As a result, a security breach involving de-identified PHI does not trigger a breach notification obligation. You should note, however, that HIPAA establishes a very high standard for de-identification. The regulations require the removal of all identifiers — including, for example, residential address, telephone number, e-mail address, Social Security number, driver’s license number, health insurance number, and medical records number — not only of the employee or patient but also of the employer and family members.

Q: Does the Genetic Information Non-Discrimination Act of 2009 (GINA) to permit the collection of family medical history for a health risk assessment that is part of an employee wellness program?
 

A: As we discussed during the webinar, family medical history is “genetic information” subject to GINA. Under GINA, an employer generally is prohibited from deliberately acquiring genetic information, including family medical history. However, GINA does have an exception that permits the collection of genetic information for an employer-provided wellness program. The following requirements must be met for this exception to apply: (a) the employee provides prior, knowing, voluntary, written authorization; (b) only the employee and the license health care professional or certified genetic counselor receives the results of the health risk assessment; (c) the results of the health risk assessment are used only for purposes of the wellness program; and (d) the results are not provided to the employer.

This entry was written by Philip L. Gordon.
 

Required Notices To Third Parties

If an entity is required to notify 1,000 or more Alaska residents, it also must provide the three national credit bureaus (such as TransUnion®, Experian®, and Equifax®) with the timing, distribution, and content of the notices to state residents.

If a business is required to notify 1,000 or more South Carolina residents of a security breach, that entity must notify the Consumer Protection Division of the South Carolina Department of Consumer Affairs as well as the national credit bureaus.

Penalties

Both statutes provide stiff penalties for businesses that fail to provide the required notice to affected individuals. In Alaska, offending business are subject to a civil penalty of up to $500 per resident not notified, with the total penalty capped at $50,000. Moreover, the offending business may be held liable for any actual economic damages suffered by affected individuals as a result of the failure to provide notice.

In South Carolina, businesses that fail to provide notice to affected individuals are subject to civil lawsuits by residents who are injured. Injured individuals may also recover attorneys’ fees and court costs, if successful. Moreover, the law permits the Department of Consumer Affairs to administratively fine knowing and willful violators $1,000 for each resident whose information was accessible by reason of the breach.

Scope Of Alaska’s New Law

In addition to the notice of security breach law, Alaska enacted a comprehensive statute involving protection of social security numbers, care of records, disposal of records and security freezes.

This entry was written by Katherine Dix.

As a result of the new law, employers should amend their business associates agreements to include the following terms:

• The business associate’s representation that it is in compliance with the HIPAA Security Rule’s principal requirements (required under the new law);
• A requirement that the business associate promptly notify the employer of any breach;
• A requirement that the business associate’s notice include detailed information about the breach, such as contact information for all affected individuals, a description of the breach, and the steps that have been taken to mitigate the harm and prevent a recurrence;
• A requirement that the business associate indemnify the employer for all expenses incurred by the employer when responding to any security breach caused by the business associate’s actions or inaction;
• A requirement limiting the business associate’s use and disclosure of, and requests for PHI, to a “limited data set,” unless a greater amount of PHI is the minimum necessary to accomplish the purposes of the use, disclosure or request (required under the new law). 

For a more detailed discussion of these developments, please see “Recent Enforcement Actions and Significant Amendments to the HIPAA Privacy Rule Compel Employers to Revisit Their HIPAA Compliance Efforts” by Philip L Gordon.