Search the News Archive

$2.4M HIPAA Settlement Warns Health Plans and Providers Against Sharing Medical Info with Media, Others

"Healthcare providers, health plans, healthcare clearinghouses and their business associates (Covered Entities) can't disclose the name or other protected health care information about a patient in press releases or other announcements without prior authorization from the patient. That's the clear lesson Covered Entities should learn from the $2.4 million ... that the largest not-for-profit health system in Southeast Texas ... is paying to settle charges it violated the [HIPAA] Privacy Rule by issuing a press release with the name and other protected health information (PHI) about a patient without the patient's prior HIPAA-compliant authorization[.]"

Year End Reminder: Verify ERISA Bonding Compliance

"Health, retirement and other employee benefit plan fiduciaries, sponsors and service providers should confirm and document that all plan fiduciaries, service providers and other plan workforce members are properly bonded to protect the plan against fraud and dishonesty, as well as avoid incurring liability for breaching the fiduciary responsibility requirements of [ERISA]."

HIPAA Sanctions Triggered by Covered Entity's Statements to Media, Workforce

"Health plans, health care providers, health care clearinghouses ('covered entities') and their business associates should confirm their existing policies, practices and training for communicating with the media and others comply with the Privacy Rule requirements of [the HIPAA Privacy Rule] in light of a Resolution Agreement with Shasta Regional Medical Center (SRMC) announced [on June 14, 2013].... [E]fforts to respond to press or media reports, patient or other complaints, physician or employee disputes, high profile accidents, or other events that may involve communications not typically run by privacy officers can create big exposures. While the Resolution Agreement targets a health care provider, the lessons are equally applicable to health plans and health care clearinghouses[.]"

Executive Order Calls for PBM ERISA Fee Disclosure Rules and Other Prescription Drug Reforms

"The Executive Order’s directive to the DOL contemplates that DOL will revise its existing regulations under Section 408(b)(2) to prohibit group health plan fiduciaries from allowing PBMs to directly or indirectly receive compensation for their PBM services unless the PBM discloses its compensation from the arrangement in accordance with the fee disclosure requirements that the Executive Order contemplates DOL will add to ERISA section 408(b)(2)."

OCR Settlement and Other Actions Warn Health Plans and Other HIPAA-Regulated Entities to Tighten Risk Analysis

"The sixth Risk Analysis Initiative enforcement action announced by OCR in recent months, the NERAD settlement resolves an OCR Risk Analysis Initiative enforcement action arising from OCR's investigation of a breach of ePHI stored on NERAD's Picture Archiving and Communication System server for storing, retrieving, managing, and accessing radiology images."

$200,000 OCR Penalty Warns Health Plans and Other HIPAA Entities to Timely Provide Records

"Along with showing the importance of overall timely compliance with the right of access rule, the OHSU civil monetary penalty also shows covered entities the importance of promptly and completely correcting any violation and their causes that results in a failure by the covered entity (including an employee or business associate responsible for responding to requests) has violated the right of access rule."

Express Scripts Lawsuit Against FTC Signals Growing Battle to Rein in PBMs

"Express Scripts characterizes the FTC Report as 'unfair, biased, erroneous, and defamatory.' ... Due to these alleged false conclusions, the Complaint charges that the FTC Report violates federal and state law several times over[.]" [Express Scripts v. FTC, No. 24-1263 (E.D. Mo. complaint filed Sep. 17, 2024)]

Prepare for Health Plan Impacts from FDA Approval of Second COVID Booster

"While Federal law currently mandates that all group health plans and group and individual health insurance covered by the [ACA] cover FDA-approved initial vaccination and first booster vaccinations administered in accordance with recommendations of the Advisory Committee on Immunization Practices (ACIP), the ACIP as of now has not amended its COVID-19 vaccination recommendations to include the FDA second boosters approved by the FDA."

Road Contractor to Pay $20.7 Million for Stealing Prevailing Wage Fringe Benefit Contributions

"Beyond the prevailing wage violations, withholding but failing to timely deposit pension, health or other fringe benefit contributions also can trigger substantial criminal and civil liability for an employing business and its owners and management under [ERISA].... Risks of these and other workforce liabilities are rising as the current Administration makes investigation and enforcement of wage and other employment, labor and benefit laws a priority."

2019 OCR Enforcement Shows Getting Defensibly HIPAA Compliant Necessary in 2020

"[V]iolations of HIPAA can have implications well beyond HIPAA.... Health plans and their fiduciaries also may face [DOL] and other fiduciary claims ... The [DOL] followed up on previous warnings that health plan fiduciaries duties include a fiduciary duty to protect health plan data by adding HIPAA compliance to certain health plan audits. Insurers, third [party] administrators and others also can face duties and liabilities under state insurance and data privacy laws from regulator or private litigant actions."