Monthly Archives: October 2016

October 31, 2016

Settlement Expands Developmental Disabilities Benefits in Idaho

By Rob Low, Holland & Hart LLP

On October 24, 2016 a federal judge approved a preliminary settlement between the Idaho Department of Health and Welfare and developmentally disabled Idaho residents. The settlement, if finalized, will end a class action lawsuit brought against the Department in 2012 by the Idaho American Civil Liberties Union (ACLU) of Idaho on behalf of 12 Idaho residents with severe disabilities.

The lawsuit alleged that the Department cut the residents’ benefits provided through Idaho’s developmentally disabled Medicaid waiver program by as much as 40 percent, and refused to disclose how it calculated such reduction in benefits (claiming the calculation formula was a state “trade secret”), which made it nearly impossible for the residents to appeal the benefit cuts. Judge B. Lynn Winmill, enjoined the cuts, which resulted in the restoration of approximately $30 million in Medicaid assistance annually. The Department appealed, but the injunction was upheld by the federal Ninth Circuit Court of Appeals. According to the ACLU of Idaho website, the settlement will impact about 4,000 people across Idaho, plus all future program participants. Continue reading

October 26, 2016

Conduct a Thorough HIPAA Risk Analysis or Pay Big Fines

by Kim Stanger, Romaine Marshall, and C. Matt Sorensen, Holland & Hart LLP

St. Joseph Health recently agreed to pay $2.14 million to settle allegations by the Department of Health and Human Services Office for Civil Rights Office (“OCR”) that its data security was inadequate.

In its investigation of St. Joseph’s handling of a 2012 data breach that exposed 31,800 patient medical records, OCR claimed St. Joseph did not change the default settings on a new server, which allowed members of the public to access via search engines the personal health information of 31,800 patients for a full year. By failing to switch off its servers’ default setting, St. Joseph potentially violated the HIPAA Security Rule’s requirement to conduct a technical and nontechnical evaluation of any operational changes that might affect the security of ePHI.

In addition to paying $2.14 million, St. Joseph Health agreed to implement a corrective action plan that requires it to conduct an enterprise-wide risk analysis, develop and implement a risk management plan, revise its policies and procedures, and train its staff on these policies and procedures. St. Joseph had conducted an enterprise-wide risk analysis in 2010, but the OCR deemed that to be inadequate because the analysis did not include an evaluation of the technical specifications of St. Joseph’s servers. Continue reading

October 10, 2016

Office of the National Coordinator for Health Information Technology Issues Formal Guidance for Selecting and Negotiating Contracts with Electronic Health Record Vendors

by Teresa Locke, Holland & Hart LLP

On September 26, 2016, the U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health Information Technology (ONC) released a practical and straightforward tool to assist health care providers as they select and negotiate the acquisition of an electronic health record system (EHR). The document’s title accurately encapsulates the content of the 53-page guide: “EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print.” The guide can be found at The new contract guide explains important concepts in EHR contracts and includes example contract language to help providers and health administrators in planning to acquire an EHR system and negotiating contract terms with vendors. Continue reading

October 4, 2016

Check Your Business Associate Agreements: OCR Tags Health System for Outdated BAA

By Kim Stanger, Holland & Hart LLP

The Office for Civil Rights (“OCR”) continues to emphasize the need for covered entities and business associates to have compliant business associate agreements (“BAAs”). Last week, the OCR announced a $400,000 settlement with a hospital system for failing to update its BAAs to include terms required by the 2013 HIPAA Omnibus Rule. In a press release, OCR Director Jocelyn Samuels stated,

This case illustrates the vital importance of reviewing and updating, as necessary, business associate agreements, especially in light of required revisions under the Omnibus Final Rule …. The Omnibus Final Rule outlined necessary changes to established business associate agreements and new requirements which include provisions for reporting.”

See Press Release here. Earlier this year, the OCR entered settlement agreements of $1,550,000 and $750,000 based on the covered entity’s failure to execute BAAs where the business associate had experienced a data breach. See reported settlements at The lesson is clear: covered entities must have BAAs, and those BAAs must contain the required terms; failure to do so may subject the covered entity to liability for the business associate’s breach. Continue reading