Arkansas Childrens Hospital Data Breach (2009)

Former hospital employees who retained PHI following their termination at an Arkansas hospital did not commit a HIPAA violation, according to an Arkansas court decision. Pam Howard previously worked at the Division of General Surgery of the University of Arkansas for Medical Sciences, also serving as director of the Burn Center at Arkansas Childrens Hospital. Eben Howard was employed by the Cardiology, Cardiovascular, and Cardiothoracic Surgery Department of Arkansas Childrens Hospital, according to the Eastern District of Arkansas Western Division. The duo reportedly began to question Arkansas Childrens Hospital about how it billed the federal government. Specifically, they claimed that certain individuals created false records that caused Arkansas Childrens Hospital and third parties to bill the federal government for patient care and procedures. Through normal job functions, the plaintiffs collected PHI, which they maintained after they had been terminated from the hospital. The information was then given to their attorney in anticipation of the pending court case, according to the decision. From there, Arkansas Childrens claimed they had committed a HIPAA violation by acquiring PHI and then disclosing it to their counsel. However, the plaintiffs claimed that they were protected under the HIPAA whistleblower exception. The defendants filed a motion for partial summary judgment on their defense that the plaintiffs are not entitled to whistleblower status under the False Claims Act, the decision explained. The plaintiffs, in turn, filed a response to the motion for partial summary judgment and a second verified motion to stay the time for a response to the motion for partial summary judgment in order to take depositions and to obtain discovery sought in a separately-filed motion to compel. Citing another court case, the decision added that the plaintiffs believed in good faith that the hospital was submitting false claims and illegally billing the government: To constitute protected activity, an employees conduct must satisfy two conditions. (1) it must have been in furtherance of an FCA action and (2) it must be aimed at matters which are calculated, or reasonably could lead, to a viable FCA action, meaning the employee in good faith believes, and . . . a reasonable employee in the same or similar circumstances might believe, that the employer is possibly committing fraud against the government. The decision explained that there were four main reasons that the court ruled that the plaintiffs qualified under the whistleblower protection and that HIPAA violations, therefore, did not take place. First, Arkansas Childrens is a covered entity, which makes it susceptible to certain rulings. Secondly, Pam Howard and Eben Howard were hospital employees and acquired the sensitive information under their normal duties. Third, the plaintiffs believed that Arkansas Childrens Hospital behaved unlawfully, violated professional or clinical standards, or was endangering patient safety, the court explained. And finally, the disclosure was to attorney Brian Brown and to Luther Sutter, for purposes of determining their legal options with regard to their concerns. Therefore, the plaintiffs have met their burden of showing that they qualify as whistleblowers under the HIPAA regulations.