Showing posts with label HIPAA violation. Show all posts
Showing posts with label HIPAA violation. Show all posts

Tuesday, April 1, 2014

Fines And The Cost of Health Care

I was sure that the pharmacist had made an error when he charged me over $200 for those few pills. Perhaps he had inadvertently added a zero to the bill. But he double-checked and insisted that the price was accurate.

Wondering how the cost of medicine had gotten so high, I remembered a recent case  involving a particular pharmacy chain. The Drug Enforcement Agency alleges that this company “lost” 37,000 hydrocodone pills. The street value of the pills is $370,000.00. But the lost profits on the drugs are the least of the chain’s worries. It also faces fines of $29 million for violations of federal controlled substance laws. In addition the state Board of Pharmacy is taking action against it. This makes the $169,000 that OSHA wants from the chain for safety hazards in a separate case look like chump change.

This pharmacy chain seems to repeatedly run into problems with governmental agencies. Just last year it paid $11 million in connection with another DEA investigation. In that case, the pharmacy’s employees created fake DEA numbers on dispensing records, filled prescriptions for unlicensed doctors, and improperly labeled medications. In another case, it paid $658,000 for failing to offer patients consultations regarding their medications. The company also saw a $57,305.50 fine for price scanner inaccuracies, a $650,000 fine for dispensing the wrong medications to patients, and a $250,000 fine for selling out-of-date products and violating patient privacy.  OSHA leveled a $40,000 fine against it for lack of an emergency action plan.  One thing this chain certainly needs is an emergency action plan. 

2012 was another landmark year for this company. It paid $77.6 million for failing to monitor sales of pseudoephedrine. In another case, the federal government called two of the company’s Florida pharmacies an “imminent danger” to the public. It banned the stores from selling controlled substances.

In 2010 this company paid $13.75 million to resolve illegal hazardous waste disposal charges. 2009 brought more fines. The company paid $2.5 million in connection with throwing patient records in dumpsters and $2.8 million for making “unsubstantiated” claims regarding a product that allegedly boosted the immune system.

The above fines total almost $139 million. This does not include the costs of attorney fees, investigation expenses, and employees’ lost time. Moreover, I’m sure this is not a complete list of the fines assessed by state and local governments against this pharmacy chain over the past few years.  Also, it doesn't include the thousands of cases filed by state Pharmacy Boards.

The litany of government actions against this one pharmacy chain raises three important questions. First, isn’t the company simply passing these fines on to the consumer by raising the cost of medications? Second, are these fines having any impact on this company? And third, if the fines are not protecting the public and are increasing the cost of health care, should the government consider other options?

I guess I was lucky that the price of the pills was a mere $200.00. If these fines keep on coming, that price will probably soon double.  Like many people, I can no longer afford to get sick.

Thursday, December 26, 2013

HIPAA And The Dangerous Flea Bargain



Years ago, I represented a young man who had lost his job. “Idle hands” being “the devil’s workshop”, he got into drug trafficking while our case was pending.  In the process, he accidentally blew up a car stuffed with cocaine.  Reporting the fiasco to me, he jubilantly told me not to worry as he had worked out a great “flea bargain” with the “feds.”

Negotiated settlements can be the best way out of a legal problem.  They are especially beneficial when a Board such as the Psychology or Medical Board threatens a health care provider with the loss of a professional license.  Often these Boards will allow the provider to keep his license if the licensee pays a small fine and gets additional training.   But sometimes settlements, like my client’s car, can blow up on you.  Take the case of a Virginia psychiatrist accused of violating a patient’s privacy. 

In September of 2007, Dr. Jones* began treating a female highway patrol officer who had been beaten, kidnapped and raped by three men.  Although he diagnosed her with post traumatic stress disorder, he wrote that she was “not a danger to the public.”

Later that year, the patient filed a complaint with the doctor’s employer about his behavior.  Shortly after receiving her complaint, Dr. Jones’ employer fired him.

On January 30, 2008, other physicians had the trooper involuntarily committed to a mental health facility.  The facility discharged her on February 1, 2008.  Dr. Jones heard rumors about the trooper’s hospitalization.  On February 4, 2008, he contacted “a friend” and “co-worker” of the trooper and told her about the involuntary commitment.  He made a second call on February 7, 2008 to another of the trooper’s “co-workers”.  He again reported that the trooper had been involuntarily committed to a mental health facility. 

Based on Dr. Jones’ reports, the Highway Patrol suspended the trooper.  However, once the Patrol’s doctor found her to be “fit for duty”, the Patrol sent her back to work. 

When the Virginia Medical Board learned of Dr. Jones’ disclosures, it prosecuted him for violating state confidentiality laws.  An “informal” conference took place.  Such conferences often allow the Board and licensee to negotiate licensure issues.  The Board found that, “Despite direct and repeated questioning,” Dr. Jones could not “justify” violating the trooper’s privacy.  His only reason for calling her friends was that he was worried because she had a gun.  The Board fined Dr. Jones $5,000 and ordered him to take 8 hours of training in ethics.  Dr. Jones did not appeal the ruling.  He must have been very relieved to keep his license.  His relief would be short-lived. 

In 2011, the US Justice Department filed criminal charges against the doctor for violating HIPAA.  Prosecutors argued that his discussions with the troopers’ co-workers were in retaliation for her complaints against him.  Surprisingly, after the prosecution presented its case, a federal judge dismissed the charges.

HIPAA allows health care providers to release information that is:
1.       Necessary to prevent a “serious and imminent threat” to others IF
2.      The threat is made to a person reasonably able to lessen the threat – this may include law enforcement, family members, the target of the threat, or others.

So what can we learn from Dr. Jones’ case?
1.      When deciding whether to accept punishment offered by a licensing board, it’s important to consider the possibility of a subsequent federal charge related to the case.  It is likely that the HIPAA police relied in part on the Virginia Medical Board order when deciding whether to prosecute Dr. Jones.
2.      Credibility issues arise when a defendant’s words contradict earlier written statements.  Dr. Jones claimed that the patient was a threat after he wrote in her medical record that she was NOT a threat. 
3.      It’s important to report threats to the proper person.  Dr. Jones should have expressed his concerns to the trooper’s immediate supervisor, not to her “friends.”
4.      Only witnesses with first-hand knowledge of a threat should report it.  The doctors who committed the trooper were in the best position to evaluate her mental health and were the appropriate persons to report any threat that she posed.
5.      You should be sure that you have accurate information before filing any report.     Because Dr. Jones did not have complete or accurate information about the trooper’s commitment, the report he gave was based on rumors and was in error. 

While I’m sure that Dr. Jones was thrilled to avoid jail time, he was probably less joyous about paying thousands of dollars in attorney fees, enduring the negative nationwide publicity, and spending three years of his life defending the charges related to this incident.  The only good to come out of the case may be the many lessons it offers concerning HIPAA compliance.

*Dr. Jones is not this defendant’s real name.