Blog

• posted: Oct. 19, 2017
• Todd McMurtry
• Uncategorized

Written By: Todd V. McMurtry

I recently spoke at the Kentucky Bar Association’s Kentucky Law Update on behalf of the Alternative Dispute Resolution Section. One of the topics I addressed related to whether mediators should be credentialed. In general, the concept of requiring a mediator to be credentialed is similar to a lawyer being licensed to practice law or a doctor being licensed to practice medicine. Today, mediators are not credentialed. They may be trained, but they are not required to pass a test.

As I discussed at the seminar, two major institutions recently have considered the issue of credentialing. They are the ABA Task Force on Mediator Credentialing and the International Mediation Institute. The ABA Task Force issued its final report on credentialing to which the International Mediation Institute responded. Both organizations concluded that requiring mediators to become credentialed would not necessarily improve the quality of mediations. Their findings focused on the idea that parties choose mediators whom they know get results. These two bodies did not want to artificially limit the available mediators by requiring them to pass a test. In essence, they concluded that there may be an advantage to provide minimum qualifications through credentialing, but a mediator’s ability to be effective is governed as much by that person’s personality and knowledge of the law as by their training.

I had the opportunity to offer my opinion to the attorneys gathered for the seminar. I agreed with the ABA Task Force’s opinion. But, I did endorse the idea that mediators are well served to attend formal mediation training. I attended the Harvard Mediation Institute, and found it to be extremely helpful. The advantage of obtaining an education in mediation, as opposed to simply doing what works, is that formal instruction does provide additional tools that one may not know. (There is more than one way to obtain a successful result in mediation). As well, to attend a program like Harvard’s exposes the participant to many other successful mediators and mediation strategies.

So, while I do not think that mediators should have to obtain credentials to serve as a mediator, I do think it is a good idea to make the effort to undergo the more formal training provided by schools like Harvard and Pepperdine, both of which are recognized as the best programs in the United States.

Todd V. McMurtry is a Member at Hemmer DeFrank Wessels, PLLC.  He is a commercial trial attorney and Harvard trained mediator.  Todd has been married to his wife, Maria C. Garriga, for 32 years.  They have three adult children.

 

• posted: Oct. 19, 2017
• Janie Ratliff
• Uncategorized

Written By: Janie Ratliff-Sweeney

True Story:  I recently met with a client who had a disgruntled ex-employee file a complaint with the Office of Civil Rights (the enforcement arm of the HIPAA Privacy and Security Rules) alleging violations of the HIPAA Privacy Rules by the client.  The client had experienced an inadvertent disclosure of protected health information (PHI) more than a year prior to the ex-employee’s filing of the OCR complaint.  The specific facts about the inadvertent disclosure of the PHI are not particularly unusual or sexy – an email containing the PHI of several patients was sent in error to the wrong email address.  These types of inadvertent disclosures are bound to happen.  Once the client learned of the email incident, it took what it considered appropriate action at the time and then filed away the incident to gather dust.  Unfortunately, the ex-employee too had filed away the incident – only to blow off the dust and resurrect it in a complaint filed with the OCR.  According to the OCR inquiry letter received by the client, the ex-employee alleged the client had not acted in compliance with HIPAA in its response to the email incident.  The OCR inquiry letter also contained the usual “data request” portion which required the client to submit to the OCR copies of its written policies and procedures related to safeguarding PHI, breaches, notifications of breaches, and the like.  So, the client not only faced defending its actions arising out of an incident from more than a year prior; the client had to also provide copies of its written policies and procedures.  After filing its response to the OCR, the client now sits and waits for its actions and documents to be judged by the OCR.  If the OCR judges the actions and/or documents of the client are not adequate or violated HIPAA, on to the next step:  the levying of fines.  But, regardless as to whether the client’s actions were HIPAA compliant, the client expended valuable resources (time and money) in drafting a response to the OCR and in gathering its documents.

Fines: “Fines schmines!” you say.  “Cost of doing business!” you say.  Right?  Wrong.

Have you paid attention to the fines the OCR has doled out recently?  Ranging from hundreds of thousands of dollars to millions of dollars.  During March of 2016, the OCR levied more than $5 million dollars in one week!  Levied for things ranging from lost laptops to IT system hacks.  Depending on the facts and circumstances of the violation, fines can climb upwards of nearly $56,000 per violation.  Do you want to be the physician or practice/facility administrator trying to split hairs with the OCR as to what constitutes “one” violation when an email is inadvertently sent to the wrong addressee and the email contains the PHI of 100 patients?  If that’s “one” violation (and depending on the facts and circumstances), that may be a check for $56,000.  Phew!  If it’s 100 violations… well… you do the math.

That check to the OCR contains hard earned dollars that will not otherwise be available for distribution to the owners or employees of your practice or facility, or to pay any of your practice’s or facility’s anticipated expenses.  Of course, that amount does not include the cost of hiring a health care attorney conversant in the HIPAA Privacy Rules.  Such expertise is vital in any dealings with the OCR or when viewing your practice’s or facility’s compliance with HIPAA.

Let’s Test your HIPAA IQ – Query me the following:  Would you know what steps are required to be taken upon the discovery of an inadvertent disclosure of PHI?  Do you know what is involved with a HIPAA-complaint “risk assessment”?  Do you know whether notices must be sent to patients following an inadvertent disclosure of PHI?  If so, do you know what the requirements are as to the form and substance of such notices?  Do you know the time frame in which a practice must investigate and take action following its knowledge of an inadvertent disclosure of PHI?  When was the last time your employees received HIPAA initial training or re-fresher training?

If your answer to any of the above is “no” or “I don’t know”, you are subjecting your practice or facility to large fines – sticking your head in the sand will not solve the problem.  Taking on the “it won’t happen to me” attitude will also not solve the problem.  The reality is that OCR is ramping up enforcement actions and it is levying fines at will.

STUFF Happens – Humans are Human:  Human error.  It is rampant.  No matter how much training you conduct and no matter how many policies and procedures you have in place – stuff happens.  People make mistakes.

As such, it is prudent to understand what you need to do when a staff member in your practice or facility makes a mistake and sends that email to the wrong person.  It is prudent to have in place appropriate safeguards to prevent human error – but the fact of the matter is that it is impossible to wave a wand and suddenly make every single employee perfect and without error.

Stuff happens.

Be prepared.

Educate yourself.

Know what you are obligated to do when the PHI is inadvertently disclosed.  Know whether a breach has occurred.  Know what you have to do if a breach has occurred.  Know what a patient notification letter is required to contain.  Know the time frame within which a patient notice must be sent.  Know whether you have to notify the OCR immediately or at the end of the year.  Know whether you must notify the media.

As the FRAM man once said – “you can pay me now or pay me later”.  When it comes to HIPAA compliance, a little prevention on the front end will certainly minimize or eliminate fines on the back end.

Janie M. Ratliff-Sweeney is a health care lawyer.  You can reach Ms. Ratliff-Sweeney at (859) 344-1188 or jratliff@hemmerlaw.com.

 

• posted: Oct. 05, 2017
• Todd McMurtry
• Uncategorized

Written By: Todd V. McMurtry

It is common in the ebb and flow of business for corporate directors to move in and out of corporations for a variety reasons. Therefore, it is critical for directors to understand the duties and obligations they have to the companies they serve. This article will focus on a director’s duty not to compete with a company for which he is a director.

Kentucky courts have long recognized that corporate directors owe a corporation they serve fiduciary duties that arise from the common law.  Baptist Physicians Lexington, Inc. v. New Lexington Clinic, P.S.C., 436 S.W.3d 189 (Ky. 2013). These fiduciary duties are generally limited to that of care and loyalty.  Stone v. Ritter, 911 A.2d 362, 370 (Del. 2006). The duty of loyalty essentially requires directors to always put the corporation’s interests above their own interests.  This duty is the one implicated when a director decides to compete. In Kentucky, part of that duty is that the director must not acquire an interest in a competing business. Id. 

Kentucky case law has many examples where a director of one company set up a competing business at the same time he was still a director of the company he was about to leave. In Aero Drapery of Kentucky, Inc. v. Engdahl, 507 S.W.2d 166 (Ky. 1974), Engdahl, an officer, director and shareholder of Aero Drapery, recruited key employees to start a competing business, shared confidential information with them, and loaned them money to purchase stock in the new competitor. All of this occurred in an eight-week period prior to Engdahl’s resignation. Needless to say, the Court determined that he violated his duty of loyalty to Aero Drapery. In its holding, the Kentucky Court of Appeals (then the state’s highest court) indicated that Engdahl could not have an antagonistic interest without full disclosure, and that he should have terminated his relationship when he first began his preparations to compete. Id.

Although this seems like a common-sense legal principle, in some circumstances, a person is a director of a number of companies that may compete in some manner. For example, business associates may own multiple companies that own commercial or residential real estate. Certainly circumstances arise where two people own Company A and one of those two is also an owner with a third person of Company B. It is possible that Company A and B might want to bid on the same property at a foreclosure auction. What should the director of both Company A and B do? This circumstance would put the director involved in both companies at risk to violate his duty of loyalty to one or both companies.

The best solution may be found in the Baptist Physicians Lexington case. There, a group of physicians resigned from New Lexington Clinic to join the nearby Baptist Physicians Lexington. The Kentucky Supreme Court analyzed the facts and looked favorably on physicians who left to compete because they had agreements that permitted them to leave and compete under certain circumstances.

This review of the law provides two good recommendations for those who serve as directors of a corporation. The first is to have a written agreement that protects both the company and the director should the director choose to leave to compete. Such an agreement can provide reasonable guidance to both parties. The second is, absent an agreement, to resign before starting a plan to compete; or at a minimum, fully disclose the plan to compete and obtain the consent of the corporation. These recommendations seem like common sense, but it is nevertheless smart to understand these duties and incorporate that understanding into the decision-making process.

Todd V. McMurtry is a Member at Hemmer DeFrank Wessels, PLLC.  He is a commercial trial attorney and Harvard trained mediator.  Todd has been married to his wife, Maria C. Garriga, for 32 years.  They have three adult children.