Search the News Archive

District Court Addresses HIPAA Privacy Implications of Kentucky Abortion Law

"As this case illustrates, certain abortion-related disclosures under state laws enacted in anticipation of the Dobbs ruling or thereafter may place HIPAA covered entities in the difficult position of having to choose between complying with HIPAA or state law. Although this court avoided having to hold that the state law at issue was HIPAA-preempted, this may not always be the outcome." [Planned Parenthood Great Nw., Haw., Ak., In., & Ky., Inc. v. Cameron, No. 22-0198 (W.D. Ky. Aug. 30, 2022)]

Seventh Circuit: ERISA Does Not Preempt State-Law Fiduciary Claims Against Dual-Hat Corporate Directors and Officers

"[T]he Seventh Circuit held that ERISA did not preempt the creditors' state-law claims because ERISA contemplates that directors and officers such as the defendants may have parallel and independent duties to a corporation -- in addition to their ERISA fiduciary duties. Focusing on ERISA's conflict preemption rules, the court considered whether (and how much) the creditors' state-law fiduciary duty claims interfered with ERISA's fiduciary duties." [Halperin v. Richards, No. 20-2793 (7th Cir. Jul. 28, 2021)]

ERISA Does Not Preempt Montana's Mental Health Parity Law

"A federal district court in Montana has ruled that ERISA did not preempt Montana's mental health parity law, as applied to an ERISA group disability income plan, and that the Montana law required the plan to provide a participant the same benefits for a mental health illness that it would apply if the disability had been physical." [Sand-Smith v. Liberty Life Assurance Co. of Boston, No. 17-0004 (D. Mont. Sept. 20, 2017)]

District Court Dismisses Section 510 Benefits Interference Claim Made by Law Firm Associate

"A federal district court rejected a law firm associate's claim for interference with benefits under Section 510 of [ERISA]. According to the court, the associate did not provide sufficient evidence that his firm's stated reasons for terminating the associate's employment were pretextual." [Joffe v. King & Spalding LLP, No. 17-3392 (S.D.N.Y. May 26, 2022)]

Eighth Circuit Decides ERISA Preempts North Dakota PBM Law

"[T]he Eighth Circuit agreed with the PBM trade association that the legislation was ERISA-preempted because its references to plan sponsors and third-party payers were impermissibly related to ERISA benefit plans. The challenged legislation, the court reasoned, regulated [pharmacy benefit managers] and defined that term as a person that performed pharmacy benefit management for a third-party payer -- which necessarily included ERISA plans." [Pharmaceutical Care Mgt. Assoc. v. Tufte, No. 18-2926 (8th Cir. Aug. 7, 2020; vacated Apr. 1, 2021; S. Ct. vacated and remanded Mar. 26, 2021)]

Arkansas PBM Law Preempted by ERISA and Medicare Part D

"Act 900 attempted to set a floor to offset an industry trend in which pharmacies accepted reduced reimbursement rates for dispensed prescriptions ... as a result of participating in a PBM's preferred pharmacy network.... Act 900 also included a "decline-to-dispense" option if a pharmacy would lose money on a particular transaction.... The court relied on a recent Eighth Circuit decision in which the court held that an Iowa statute similar in purpose to Act 900 was ERISA-preempted ... The court observed that the law implicitly referenced ERISA by regulating PBMs in administering benefits for "covered entities," which necessarily included health plans." [Pharmaceutical Care Mgmt. Ass'n v. Rutledge, Nos. 17-1609, 17-1629 (8th Cir. June 8, 2018)]

HHS Begins Implementing 2021 Legislation on Cybersecurity Practices and HIPAA Enforcement

"HHS's Office for Civil Rights (OCR) has begun implementing 2021 legislation that requires the agency, in enforcing HIPAA, to consider whether HIPAA covered entities (CEs) and business associates (BAs) have implemented and applied certain recognized security practices -- including with regard to cybersecurity ... As an initial step in this process, HHS has issued a request for information (RFI) concerning CEs' and BAs' voluntary implementation of recognized security practices[.]"

District Court Turns Back Challenge to Payroll Practices Exemption Under ERISA

"In litigation involving whether an employer's short-term disability (STD) plan was exempt from ERISA, a district court has rejected an employer's challenges to the DOL's regulatory payroll practices exemption under ERISA based on the Supreme Court's recent Loper ruling." [Hansen v. Laboratory Corp. of Am., No. 24-0807 (E.D. Wis. Oct. 24, 2024)]

In Its Second-Ever HIPAA Settlement on Ransomware, HHS Offers Best Practices for Avoiding Cyber-Attacks

"The CAP also requires the provider to develop (or update) its HIPAA policies and procedures. As revised, the policies and procedures must address -- at a minimum -- a lengthy set of issues under HIPAA's Privacy and Security Rules[.]"

Best Practices for ERISA Fiduciary Responsibilities and Cybersecurity for Retirement Plans (PDF)

12 pages. "[P]rudent selection and monitoring of plan service providers that may handle PII requires critical due diligence of the third-party service provider's systems, data storage, and encryption security.... When employees work from home, companies may face additional risk from employees who take shortcuts to ease working on personal devices or outside of the organization's regular environment.... The main components of a business resiliency program are a business continuity plan, disaster recovery plan, and incident response plan."