Back to Top

Health Law Pointers - Volume V, No. 3

WHAT TO EXPECT IN THE EVENT OF A

HIPAA PRIVACY RULE VIOLATION

 

1.         The Responsible Enforcement Agency.

            The United States Department of Health and Human Services, Office for Civil Rights, is responsible for enforcing the privacy rule in the event of an alleged violation of HIPAA’s national standards by a “covered entity,” including a medical office.  As such, the Office for Civil Rights may conduct investigations of any registered complaints and/or initiate a “compliance review”.

            HIPAA privacy rule violations occurring in Western New York will be investigated by New York City regional branch (Region II) of the Office for Civil Rights.  The Regional Manager for Region II currently is Michael Carter.

 

2.         Initiation of a HIPAA Investigation

            At this time, investigations usually are triggered by the receipt of a complaint by the Office for Civil Rights (OCR) alleging that your medical office is not in compliance with the federal standards for privacy of individually identifiable health information.  The OCR Investigator is likely to make initial contract by telephone.  The patient has the option to remain anonymous.  Complaints can be filed either on paper or electronically and must be filed within 180 days of the alleged act of noncompliance.  This 180 day period may be extended for “good cause,” a term undefined by OCR.  OCR recommends using their complaint form.  All complaints are given a transaction number.

 

3.         The Facts

            We have found that the Investigator initially will not make available to you specific facts regarding the alleged violation but will only hint of the problem (ex. in the delivery of medical records, copies of a second patient’s records were attached).  The absence of specific dates and patient names makes it difficult for the medical practice to effectively conduct its own investigation on the source of the problem and take prompt corrective action.  OCR justifies its odd position by citing the absence of any HIPAA authorization or release from the affected patients.  However, if you call the Investigator, the specific facts should be discussed with you.

 

4.         OCR Expectations

            The OCR Investigator expects that the medical practice will cooperate in the investigation and, where required, allow access to its facilities and records.  Cooperation is recommended if the medical practice wishes to attempt to informally resolve the investigation.  Involvement of legal counsel may be recommended at this stage, particularly if disclosure of facts relating to the alleged HIPAA violation is limited.  OCR will request documentation from your office showing your compliance with HIPAA.  A covered entity will be required to submit its Privacy Notice, at a minimum, and any documents related to the alleged HIPAA violation.  For example, if there was an unauthorized disclosure of Protected Health Information (PHI) as a result of a request for medical records, the covered entity will be asked to provide its Privacy Notice, its procedures for filling requests for records and safeguards implemented to protect PHI.

 

5.         Your Choice

            Your medical office may respond to any allegation of a HIPAA violation, submit evidence that the event did not take place as described, dispute the existence of a violation, contest the applicability of HIPAA, describe proposed corrective actions, or indicate that prompt and effective action has already been taken to correct the noncompliance.  A successful resolution of the matter at this early stage will avoid formal enforcement action and the possible imposition of civil money penalties.

            In addition, if OCR determines that the violation was willful, the case can be referred to the Department of Justice (DOJ) for a criminal investigation.  This can result in a fine and/or imprisonment.  However, OCR does not have a procedure in place at this time for the referral of cases to the DOJ.

 

EMPLOYEE OR INDEPENDENT CONTRACTOR?

Some medical practices choose to retain physicians as independent contractors rather than employees.  The decision to retain a physician as an independent contractor poses some risks, including the risk that the Internal Revenue Service will re-characterize the arrangement as an employer-employee relationship, thus subjecting the medical practice to potential employment tax liability.  

            The Internal Revenue Service has developed a list of twenty factors that are considered in determining whether an individual qualifies as an independent contractor or an employee.  While none of the factors are alone determinative, a combination of factors may be sufficient to characterize the relationship as employer-employee as opposed to an independent contractor relationship. 

 

Independent Contractor Factors

            Factors that tend to indicate the existence of an independent contractor relationship include the following:

1.         The absence of instructions from the medical practice regarding how and when the physician is required to perform his or her duties.

            2.         The physician is responsible for hiring and paying his own employees.

            3.         The medical practice does not provide any training to the physician.

4.         The arrangement between the physician and the medical practice is non-exclusive (i.e., the physician may provide services to other medical practices or health care providers).

5.         The physician may not terminate its working relationship with the medical practice without incurring contractual liability to the medical practice.

 

Employer-Employee Factors

Factors that tend to indicate the existence of an employer-employee relationship include the following:

1.         The medical practice is responsible for hiring, supervising and paying personnel (such as nurses and physician assistants) to help the physician perform his or her work.

2.         The physician is required to work full-time and exclusively for the medical practice.

3.         The medical practice sets the physician’s hours of work and exercises direction or control over the physician’s work.

4.        The physician is paid by the hour, week, or month (rather than a per-job payment).

5.         The physician is required to personally render the services (as opposed to having an employee or contractor of the physician performing the services). This factor may be less significant in the physician/medical practice context because of the unique nature of the services provided.

6.         There is a continuous working relationship between the physician and the medical practice.

7.         The physician is required to submit reports to the medical practice.

The question of whether a physician qualifies as an independent contractor continues to be an area subject to IRS scrutiny.  As such, medical practices and physicians should consider seeking the advice of legal counsel to review arrangements that propose to classify physicians as independent contractors.

Newsletter Sign-up

Fill in the form to register to receive any of our free electronic newsletters: