Filefax, Inc., a defunct Illinois medical records storage and management company, has been fined $100,000 for improperly handling medical data under an agreement with the court-appointed receiver managing the company’s assets on behalf of its creditors. This settlement has implications for both service providers and their covered entity clients. Fox Rothschild partners Elizabeth Litten and Michael Kline were quoted in an article by Marla Durben Hirsch entitled “Be prepared for HIPAA Issues if a business associate shuts down” in the August issue of Medical Practice Compliance Alert.
As the HHS press release stated, the consequences for HIPAA violations don’t stop when a business closes. In this case, Filefax had been under investigation by state and federal authorities since 2015 for careless handling of medical records which had been abandoned at a shredding facility. Medical Practice Compliance Alert notes:
This settlement shows that a provider or business associate that has violated HIPAA can’t avoid the consequences by shutting down. “OCR is saying that you’re still responsible if you close your doors.” Says attorney Elizabeth Litten with Fox Rothschild in Princeton, NJ.
But it also provides a cautionary tale for providers who work with business associates that go under because providers are ultimately responsible for their patients’ records.
The article suggests the following tips for a covered entity to reduce its risks when a business associate may be in shaky financial shape:
- Keep an inventory of your business associate relationships.
- Choose business associates carefully.
- Monitor your business associates’ compliance with HIPAA.
- Expect increased scrutiny if a business associate is already on the government’s radar.
- Watch for signs that the business associate may be running into financial trouble.
- Don’t sit idly if the business associate files for bankruptcy.
What should a covered entity do when it learns that a business associate may have violated its HIPAA responsibilities? For starters, see our previous post entitled Ten Tips for Actions by a Covered Entity after a HIPAA Breach by a Business Associate. And if that BA has ceased operations, be prepared to take control of the situation even if the BA may not have enough resources left to reimburse you for its mistakes. Remember, the buck always stops with the Covered Entity.
