Goldman, Gruder & Woods

Law Firm

203-899-8900

Court Allows HIPAA Negligence Claim

November 6, 2014

Legal experts are analyzing the potential national impact of a Connecticut Supreme Court ruling that plaintiffs can sue for negligence if a healthcare provider violates HIPAA regulations for protecting patient privacy.

The Connecticut case of Emily Byrne vs. Avery Center for Obstetrics and Gynecology involved a patient who sued a healthcare clinic that released her medical records to a third party without her authorization. But legal experts say the ruling could potentially have relevance in certain data breach cases.
“HIPAA does not provide for the ‘private right of action,’ or [the right of] private folks to sue under the statute,” says privacy attorney Brad Rostolsky of the law firm Reed Smith. “Enforcement actions and fines for HIPAA violations are levied by federal regulators. But in a handful of cases, like this Connecticut ruling, courts have allowed HIPAA as the ‘standard of care’ for negligence claims.”

Privacy Issues
Byrne’s attorney, Bruce Elstein of the Connecticut law firm Goldman, Gruder & Woods, tells Information Security Media Group: “Before this ruling, individuals could not file a lawsuit claiming violation of their privacy under the HIPAA regulations. It was for that reason that we filed a negligence claim, claiming the medical office was negligent when it released confidential medical records contrary to the requirements set forth in the HIPAA regulations.

Bruce Elstein
“The state Supreme Court agreed that a violation of HIPAA regulations may constitute a violation of generally accepted ‘standards of care,’ and remanded the case back to the lower court for trial.” That trial likely will take place next year, he says.

Privacy attorney Elizabeth Hodge of the law firm Akerman LLP explains that in this Connecticut case, HIPAA is the “standard of care” for protecting patient confidentiality that was used to show that a patient’s privacy rights were violated. “In data breach cases, plaintiffs could argue that a healthcare provider, insurer or other covered entity did not meet the ‘standard of care’ with the HIPAA security or privacy rule in protecting records, and that the failure to meet that standard of care was negligent.”

Rostolsky says the ruling in Connecticut not only potentially impacts covered entities in other cases, but also business associates, who are also directly liable for HIPAA compliance under the HIPAA Omnibus Rule.

Nonetheless, in negligence lawsuits, plaintiffs need to show damages, Rostolsky points out. Many class action lawsuits involving data breaches been dismissed by courts because they’ve lacked evidence showing that individuals impacted by a breach subsequently have been victims of fraud or have suffered other damages.

Attorneys say that because this Connecticut lawsuit has been kicked back to a lower court for trial, it’s not yet clear how the case will play out.

Case Details
The suit against Avery Center for Obstetrics and Gynecology in Westport, Conn., was filed by Byrne, a former patient who now resides in Vermont.

Elstein says that in the early fall of 2004, Byrne learned that she was pregnant. “Shortly afterward, she called the Avery Center to instruct them not to release any of her medical information to the father of the child, with whom she was no longer in a relationship,” Elstein says. “This request was well within her rights as protected under the HIPAA Act.”

The information contained in Byrne’s medical file “was highly sensitive, deeply personal and confidential,” Elstein says. “But despite Byrne’s clear instructions, and in violation of its own stated privacy policy, the Avery Center released her medical file [to her ex] upon subpoena. It failed to make any attempt to notify Byrne of the subpoena or to seek guidance from a court on the disclosure to be made.”

The father of Byrne’s child used her personal health information “for a campaign of harm, ridicule, embarrassment and extortion,” Elstein alleges. “If HIPAA had been followed, Byrne would have been able to keep her sensitive and private information confidential.”

Attorney Bruce Elstein

Conn. Supreme Court HIPAA Decision Likely to Spawn More Litigation

November 6, 2014

In a first-of-its-kind decision in the state, the state, the Connecticut Supreme Court has ruled that patients can bring negligence lawsuits against health care providers that violate federal privacy regulations.
It took the state’s highest court nearly two years to rule on the issue, which will allow a Vermont woman’s lawsuit against a Westport gynecologist’s office to go to trial. The decision could also have national implications, according to legal experts with knowledge of the Health Care Portability and Accountability Act and also those involved with data breach cases.

The Connecticut case of Emily Byrne vs. Avery Center for Obstetrics and Gynecology involved a patient who sued a health care clinic that released her medical records to a third party without her authorization. The plaintiff, Emily Byrne, claims that the Avery Center for Obstetrics and Gynecology in Westport released private information about her pregnancy to the father of the child Byrne delivered in 2005, against her instructions.
The center moved to block the lawsuit on the grounds that the language in HIPPA precludes individual liability claims. The center’s lawyer, James Rosenblum of Stamford, also argued that no negligence lawsuit could be brought because the administrative remedies had not been exhausted. The center won a decision in Superior Court, which led to an appeal to the Supreme Court by Byrne’s lawyers.
In its unanimous Nov. 4 decision authored by Justice Flemming Norcott Jr., the court determine that “neither HIPPA nor its implementing regulations were intended to preempt tort actions under state law arising out of the unauthorized release of the plaintiffs medical records.”
The ruling said such claims can be pursued in civil lawsuits if the plaintiffs can show the “generally accepted standard of care” under was not followed. In the ruling, which follows similar decisions in other states, including Missouri, West Virginia and North Carolina, the court found there is evidence that the standard of care was not followed in Byrne’s case. Specifically, the decision said, Byrne was never informed of the request for her records made by Andro Mendoza, her former boyfriend. And the records he was provided were beyond what he requested.
“Before this ruling, individuals could not file a lawsuit claiming violation of their privacy under the HIPPA regulations,” said Byrne’s lawyer, Bruce Elstein, of Goldman, Gruder & Woods. The lawsuit will now be placed on a trial docket in Bridgeport Superior Court, and the plaintiff will be permitted to pursue her claim that the medical office was negligent for releasing her records.

Attorney Bruce Elstein

Attorney Bruce Elstein: Connecticut court rules medical privacy case can go to trial

November 6, 2014

A case involving a Westport medical office’s alleged violation of HIPAA regulations has set a legal precedent in Connecticut, according to the attorney for the plaintiff, and the case will now be heard.

In the first case of its kind in Connecticut, the state Supreme Court ruled that patients can sue for negligence if a medical office violates HIPAA regulations, which dictate how medical offices must maintain patient confidentiality, said attorney Bruce Elstein, who argued the case, in a statement.

The HIPAA law — the Health Insurance Portability and Accountability Act of 1996 —was passed to protect the privacy of patients’ health information.

Connecticut now joins at least three other states with courts ruling similarly: Missouri, West Virginia and North Carolina, according to a spokesperson for Trumbull-based law firm Goldman, Gruder & Woods, where Elstein works.

Elstein, according to a statement, used state and federal privacy laws as the basis of a case he is trying on behalf of a woman who alleges a Westport medical office violated her right to privacy.

“Before this ruling, individuals could not file a lawsuit claiming violation of their privacy under the HIPAA regulations,” Elstein said. “It was for that reason that we filed a negligence claim, claiming the medical office was negligent when it released confidential medical records contrary to the requirements set forth in the HIPAA regulations. The state Supreme Court agreed that a violation of HIPAA regulations may constitute a violation of generally accepted standards of care, and remanded the case back to the lower court for trial.”

It took the state Supreme Court nearly two years to decide the case could proceed to trial.

The plaintiff was allegedly a patient of the Avery Center for Obstetrics and Gynecology in Westport. Elstein said she was pregnant and had asked the center not to release her records. Under a subpoena from the alleged father, however, Elstein said the center released the data.

Elstein said, “Shortly afterward she called the Avery Center to instruct them not to release any of her medical information to the father of the child, with whom she was no longer in a relationship. This request was well within her rights as protected under the HIPAA Act.”

The information contained in the medical file was highly sensitive, deeply personal and confidential, Elstein said. Elstein maintained the center “failed to make any attempt to notify his client of the subpoena or to seek guidance from a court on the disclosure to be made.” Had HIPAA been followed, Elstein alleged, his client “would have been able to keep her sensitive and private information confidential.”

The woman in the case has moved out of state, as separately has the man.

The case will go back to trial as a negligence case, likely in 2015, Elstein said.

Goldman, Gruder & Woods LLC represents individuals, employers and employees in matters related to business, real estate, employment, education, criminal, litigation and health care laws. The firm, with a focus on smaller or closely held businesses, has offices in Norwalk, Greenwich and Trumbull.

Attorney Bruce Elstein

Baby Boomers are Starting a Home Business – Part 2

July 16, 2014

BY MICHAEL GOLDMAN

Baby boomers working from home have a number of issues to consider during the course of launching their business.

Here are more of the issues Baby Boomers must consider when launching a home business.

Part 2 – Insurance, Zoning, Obtaining Permits, Building a Team of Professionals and Knowing When to Pull the Plug.

Other equally important concerns will be covered in Part 1 of this article.
Baby Boomers are Starting a Home Business – Part 1
Baby boomers working from home have a number of issues to consider during the course of launching their business.

In Part 1 of this article, we looked at topics such as entity formation, protecting confidential information, employees vs. independent contractors, and contracts with third parties.

Here are more key steps toward making a home business a success:

Insurance:
When Daisy became tired of her commute to the high-end salon in the city, many of her long-time customers followed her as she set up shop in her house in the suburbs. Now she continues to cut and style hair from home.
You need to check with your homeowners’ insurance agent to see whether operating your business from your home affects your policy, or whether you are not covered for liabilities that arise from the business’ activities at the premises. Depending upon the activities at your home, you may need to buy additional coverage (generally very inexpensive) to make sure that your premises’ liability will extend to acts arising in the course of your business.

Your auto insurance policy also may need to be updated if your amount of business-related driving is beyond what you had reported on your insurance application. In addition, many small business owners are surprised to find out that there is relatively inexpensive liability insurance (which can include defective product or errors and omissions coverage) for their type of business. Such policies usually cover your legal fees if you are sued by a client or customer for a product defect or negligent consulting advice.

Zoning:
Coach Mark retired from his job as gym teacher at the local high school and launched a home business as a personal fitness instructor. Word spread that the popular teacher was offering kickboxing classes and weight training sessions, and before long the street in front of his house was lined with clients’ cars.
If you are using your home office merely for phone calls, file storage, and a place for you, alone, to work, your home business is unlikely to raise any zoning concerns. However, if your home business involves visits from others (customers, colleagues, employees, contractors, etc.) or entails more than the occasional shipment of materials or products, you may actually have a zoning problem. Local zoning ordinances govern the use of property and are designed to protect the health, safety and general welfare of the greater community.

For the same reason that zoning normally does not permit industrial buildings in single family zones, zoning also may limit what non-residential activities a person can do in his or her home. Therefore, you should not spend a lot of money fixing up your basement or home office to accommodate employees, a satellite tower, and an expanded parking area (installed on what used to be a part of your grassy lawn) without knowing whether you first need a zoning permit. Between nosy neighbors, the building department (for permits), the tax assessor and competitors, the local zoning officials generally know everything that is going on in town.

If you are having frequent visitors or the FedEx truck knows its way to your house without a driver, you should not expect to be able to keep your business use secret from the zoning authorities for long. If you are in violation, the municipality can have the right to impose a cease and desist order. It can be expensive to challenge or comply with cease and desist orders. If you are unable to challenge or comply, the monetary fines, demolition costs, etc. can be expensive and time-consuming. And, such cease and desist orders can be embarrassing as they are frequently reported in the newspaper and the local online news.

Therefore, if your business involves having regular visitations at your house or lots of deliveries and shipments, consult with your attorney before plunging forward.

Obtaining Permits:
Evelyn was shocked to learn that she would need a building permit to change an electrical fixture in the attic room she used for jewelry making. “Inspectors will come out to make sure you have not tried to hang a heavy rotating ceiling fan from a box meant for a lighter, stationary fixture,” she was told.
You might not anticipate that permits are needed for projects such as sign installation, sheds or accessory structures, fences and walls over 4-6 feet in height and demolition work. Changing windows to doors, moving plumbing fixtures to different locations, moving an interior wall, altering a driveway, or replacing roof shingles (even shingling over an existing roof) all require permits.

If you are just hanging wallpaper or painting the walls, of course, you don’t need a permit. Nor do you always need one for changing a toilet or sink and replacing it with the same item in the same space. One rule of thumb: anything requiring a dumpster requires a permit.
Your business is an investment. If your project does not comply with the codes and standards adopted by your community, the value of your investment could be reduced.

Building a Team of Professionals:
After a long career in retail sales, energetic Bonita returned to her first love, children, and opened a daycare center in her home. While she was delighted with her little charges, the legal considerations, insurance intricacies and bookkeeping demands quickly overwhelmed her.
Every self-employed person should assemble a team of professionals to assist in their respective areas of business. These professionals would normally be a lawyer, accountant, commercial insurance broker, and IT consultant. With liability protection, tax advice, insurance and technology covered, you can then focus your energies on what’s really important: sales, increasing your expertise, and networking.

Knowing When to Pull the Plug:
At first Jonathan seemed to be turning a healthy profit by selling antiques from home, online. Soon, however, it became apparent that he had far overspent on his inventory and marketing campaign and was incurring more debt each month. An unexpected hospital stay sent him into a financial tailspin.

Declaring bankruptcy is a wrenching resolution for most people, necessitating uncomfortable and typically unpopular decisions such as abandoning the dream of a home business.
Most cases filed by individuals fall under Chapter 7 of the bankruptcy code and involve people experiencing a crisis that prevents them from meeting their financial obligations.

Fear of their financial affairs becoming public is common, but bankruptcy proceedings are not published and rarely involve a court appearance. Many individuals fear, also, that they will lose everything they possess in a bankruptcy, but that is not the case; many assets (such as the debtor’s home, most household goods, engagement and wedding rings) are exempt and can be kept by the filer.

Those filing under Chapter 7 also may retain their retirement accounts, social security payments and other government-subsidized benefits. Properly funded college accounts for the debtor’s children are also beyond the reach of creditors in Chapter 7. Personal injury claims and payments also can be protected with proper planning.

While there are many protections for filers, some discrimination against those who have filed Chapter 7 does exist: Private employers can refuse to hire a person who filed for bankruptcy. Landlords can refuse to lease to a Chapter 7 debtor. Private colleges can deny transcripts. There are other issues that may arise and it would be a wise move to determine all the benefits and drawbacks before deciding to file.

A home business can be a wonderfully rewarding pursuit, both financially and emotionally. It can provide a baby boomer with years of fulfilment and can fund a comfortable retirement. Once the myriad legal issues are considered and appropriate safeties are put into place, baby boomers are free to turn their home business into a booming business.

Michael Goldman is an attorney with the Connecticut-based law firm Goldman, Gruder & Woods, LLC.
He can be reached at 203-899-8900 or
[email protected].

Goldman, Gruder & Woods represents individuals, employers and employees in matters related to business, real estate, employment, education, criminal, litigation and health care laws. Its attorneys believe that the best and most economical client service is achieved within a smaller firm with few barriers between client and principal. The firm, with a focus on smaller or closely-held businesses, has offices in Norwalk, Trumbull and Greenwich.

Baby Boomers are Starting a Home Business – Part 1

July 16, 2014

BY MICHAEL GOLDMAN

Baby boomers working from home have a number of issues to consider during the course of launching their business.

Here are issues for Baby Boomers to consider for a home business.

Part 1 – Entity Formation, Protecting Confidential Information, Employees vs. Independent Contractors and Contracts with Third Parties.

Other equally important concerns will be covered in Part 2 of this article:
Baby Boomers are Starting a Home Business – Part 2

These days, many baby boomers are leaving the mother ship of corporate life to become self-employed. Our nation boasts a surplus of high-skilled workers that, combined with continued trends in downsizing and outsourcing, is creating a plethora of baby boomers that has no choice but to be self-employed.
Many baby boomers working for themselves become consultants who can work anywhere, and, therefore, work out of their homes to save on expenses and enjoy convenience.

Here are some of the key topics that a baby boomer working from a home office, as well as any typically self-employed person, needs to consider at the outset:
Entity Formation:
Mario runs a successful landscaping business from home, storing equipment in his garage and employing three younger workers. In the course of a tree removal, a massive branch fell on the customer’s house, damaging the roof and the master bedroom. Compensating the customer could cost tens of thousands of dollars.

Although it is legal to be engaged in your business as a sole proprietorship or “dba”, it is almost always better to operate your business as a corporation or limited liability company (“LLC”). In addition to the professionalism of having an entity, the entity affords some protection by shielding you from liabilities caused by others in the course of the business’ activities.

Therefore, while the business itself will be liable for acts or omissions by employees, agents, contractors, etc., the business owner would not have her own assets at risk (like her house or savings) unless the claim arises from something that the business owner herself did. A good attorney and tax advisor can help you choose the best entity for your situation.

Protecting Confidential Information:
Gloria was thrilled when a national charitable foundation hired her to help with a major campaign. She quickly signed a contract, not realizing that the terms of the agreement required that she divulge a list of former donors she had amassed over her years as a professional fundraiser.
Your value as a self-employed consultant or salesperson derives from your years of experience, know-how and contacts. Therefore, you must protect your “special sauce” — your proprietary information and sales base. This is facilitated with good confidentiality and non-disclosure agreements, which will also include provisions that prohibit solicitation of each other’s customers, clients, and employees.

Frequently, consultants are all too willing to sign such documents provided by the bigger companies for whom they wish to work. The problem with blindly signing them is that they frequently contain unfair provisions or are non-mutual, such that they protect the other party but not you. Without legal review, you might find yourself having given the other party access to your contacts and know-how without knowing it.

Employees vs. Independent Contractors:
“Grandma’s Kitchen” was such a success that Grandma Esther had to hire an assistant, Delores, to meet the demand for her home-baked cookies and cakes. Should Delores receive benefits at her new job?
If your business merits hiring underlings or associates, you need to determine whether they should be employees (W-2) or independent contractors (1099). Many small business people try to consider everyone a contractor in order not to put them on payroll, to have more flexibility, and to save money on a payroll service.

However, the rules about whether someone is an employee or independent contractor are very complex and are based upon the particular facts and circumstances of each unique relationship. The penalties for treating someone as a 1099 independent contractor when he or she is really an employee are significant, and you can avoid big headaches by discussing each situation with an experienced attorney.

In addition, the attorney can provide independent contracting agreements that will protect you from a contractor’s later trying to gain the benefits of being an employee and also protect you in the case you receive an inquiry by your friends at the IRS.

Whether you are hiring an employee or engaging a 1099 contractor, you will also want to protect your customer base, proprietary information and, if applicable, contractor and vendor relationships with NDA’s and non-solicitation agreements.

Contracts with Third Parties:
Making the move from a high-pressure international publishing house to freelance editing from home was easy for Arthur, but his contract as a consultant to his former employer was more complicated.
Most businesses also need some sort of basic contract that obligates the client to make payment, evidence the amount of your compensation and protect you from delinquent customers by imposing late charges, interest and court costs.

In addition, most consultants would benefit by a contract that, in simple terms, defines the scope of the project, pays the consultant for extras, further protects confidential information, and limits your liability in case that the other party later alleges that it is dissatisfied with the work or has had other problems. More complicated contracts will involve such issues as fixing defective work, warranties, indemnification, and dispute resolution.

Some self-employed people make the mistake of using nothing more than purchase orders, which usually are not binding, or of blindly signing contracts provided to them by their client or customer. These contracts are typically one-sided, often prepared by in-house attorneys who have added provisions buried in the “boiler plate,” which can go unnoticed by a layman and create trouble for you.

For these reasons, having a lawyer review such contracts is very important, and typically, an experienced contract lawyer will not need to charge much to review contracts on small projects.
Of course, these are just some of the issues baby boomers must consider when launching a home business. Other equally important concerns will be covered in Part 2 of this article.

Michael Goldman is an attorney with the Connecticut-based law firm Goldman, Gruder & Woods, LLC.
He can be reached at 203-899-8900 or
[email protected].

Goldman, Gruder & Woods represents individuals, employers and employees in matters related to business, real estate, employment, education, criminal, litigation and health care laws. Its attorneys believe that the best and most economical client service is achieved within a smaller firm with few barriers between client and principal. The firm, with a focus on smaller or closely-held businesses, has offices in Norwalk, Trumbull and Greenwich.