Wednesday, February 24, 2016

Real Property, Probate & Trust Law: What Notice Is Due to Ascertainable Creditors in Estate Proceedings?

By Robert S. Walton

        Recently, the Florida Supreme Court held that “claims of known or reasonably ascertainable creditors of an estate who were not served with a copy of the notice to creditors are timely if filed within two years of the decedent’s death.” Jones v. Golden, 2015 WL 5727788, at *7 (Fla. Oct. 1, 2015) (emphasis added). The decision ends the conflict between the Fourth District Court of Appeal’s ruling in Golden and the decisions of the First and Second District Courts of Appeal in Morgenthau v. Andzel, 26 So. 3d 628 (Fla. 1st DCA 2009) and Lubee v. Adams, 77 So. 3d 882 (Fla. 2d DCA 2012), which both held that unless reasonably ascertainable creditors filed a motion for an extension of time under section 733.702(3), Florida Statutes, claims filed three months after the first publication of the notice to creditors are forever barred.

         The Florida Supreme Court’s decision involved three particular provisions of Chapter 733, Florida Statutes: sections 733.2121, 733.702, and 733.710. Section 733.2121(1) sets forth the duty of a personal representative to promptly publish a notice to creditors, which “must state that creditors must file claims against the estate with the court during the time [limitations] periods set forth in § 733.702, or be forever barred.” § 733.2121(1), Fla. Stat. (2005) (emphasis added). Section 732.2121 also requires that a personal representative make a “diligent search to determine … creditors who are reasonably ascertainable” and “promptly serve a copy of the notice on those creditors.” § 733.2121(3), Fla. Stat. Section 733.702 is a “statute of limitations” that limits the time for creditors to file claims against the estate to three months after the first date of publication of the notice to creditors. Golden, 2015 WL 5727788, at *8; see also § 733.702, Fla. Stat. (2006). Section 733.710 is a “jurisdictional statute of nonclaim” that limits the liability of the personal representative and the beneficiaries of the estate for “any claim[s] … against the decedent” to a period of two years from the decedent’s date of death. Golden, 2015 WL 5727788, at *6; see also § 733.710(1), Fla. Stat. (2001).

         In Golden, the decedent, Harry Jones, died in February 2007. The probate of his estate was opened in April 2007. Harry’s personal representative published the notice to creditors in June 2007. Harry’s personal representative, however, failed to serve a copy of the notice to creditors to Harry’s ex-wife, Katherine Jones, or to Katherine’s guardian. In January 2009, Katherine’s guardian filed a statement of claim against Harry’s estate. Katherine died in 2010, and Edward Golden was appointed curator of her estate. Golden argued Katherine’s guardianship was a reasonably ascertainable creditor. Harry’s personal representative argued “Katherine was not a reasonably ascertainable creditor and that her guardian’s claim was time-barred under section 733.702 and 733.710.” Golden, 2015 WL 5727788, at *3-4 (emphasis added). Relying on section 733.702 and 733.710, as well as Morgenthau and Lubee, the probate court struck the claim by Katherine’s guardian as untimely. Id. at *4.

         On appeal, Golden argued that since Katherine was a known or reasonably ascertainable creditor and the notice was never properly served on her, the three-month limitations period in section 733.702(1) never began to run, and as a consequence, the claim by Katherine’s guardian could only be barred by the two-year statute of nonclaim in section § 733.710. The Fourth District agreed with Golden’s argument. The Supreme Court ultimately affirmed the Fourth District in Golden and disapproved the decisions of the First District in Morgenthau and the Second District in Lubee. Id. at *18.

Saturday, February 20, 2016

Securities Law: Cyber Security – Under the Microscope of Regulators

By Matthew Schwart

        No industry is immune from cyber-attack by sophisticated computer hackers looking to take advantage of weak firewalls and system controls. We regularly read headlines about large companies (i.e., Sony Pictures, Staples, The Home Depot), that suffer a breach that reveals their customers’ non-public, personally identifiable information. In June 2015, the Federal Office of Personnel Management’s computer systems were breached, exposing 21.5 million federal employees’ non-public, personally identifiable information. These breaches lead to rampant fraud and identity theft, which cost these companies, and the government, hundreds of thousands of dollars. Ponemon Institute Research Report, 2015 Cost of Data Breach Study: Impact of Business Continuity Management (June 2015).

         The vast majority of Americans who own securities hold them at broker-dealers or registered investment advisors (RIAs). These financial institutions are required to have policies and procedures in place to ensure compliance with securities rules and regulations. More specifically, Rule 30(a) of Regulation S-P under the Securities Act of 1933 requires broker-dealers and SEC RIAs to adopt written policies and procedures reasonably designed to protect client records and information and to ensure the security and confidentiality of these records. 17 C.F.R. 248.1, et. seq. The purpose of Regulation S-P is to provide protection for financial and personal customer information held by financial institutions.

        On September 22, 2015, in the first enforcement case of its kind, the SEC entered into a settlement order with R.T. Jones, a St. Louis-based SEC RIA, for its alleged failure to establish cyber-security policies and procedures in advance of a breach. In this enforcement action, the SEC found that R.T. Jones was unable to prevent a data breach that compromised the non-public, personally identifiable information of nearly 100,000 individuals. Id. As part of the settlement, the firm agreed to cease future violations of Regulation S-P, to appoint an information security manager, adopt written security policies, and pay a $75,000 fine. Id. 

        Securities regulators have made it clear that cyber security, in the context of customer protection, is one of their highest regulatory priorities.  The R.T. Jones enforcement action signals a shift in regulatory attention to this previously overlooked and under-examined issue. As we can anticipate increased cyber-attacks across all industries, we can anticipate increased regulatory attention from securities regulators in this space. From a consumer standpoint, you should inquire with your broker-dealer and RIA to see what policies and procedures they have in place to ensure your personal information is not vulnerable to risks associated with cyber-attacks.

Thursday, February 18, 2016

Marital & Family Law: Bankruptcy and Domestic Support Obligations

By Alfred Villoch III

       An ex-spouse has fallen behind on alimony and now filed bankruptcy. That alimony will be discharged in the bankruptcy case, right?

       Not so fast. An ex-spouse cannot simply walk away from alimony, whether past, present, or future, by filing a bankruptcy case. Under Bankruptcy Code § 523, 11 U.S.C. § 523(a)(5), a debtor is not entitled to discharge any debt for a domestic support obligation, including alimony. 11 U.S.C. §§ 523(a)(5), (15).

       In fact, a bankruptcy court will not consider modification of alimony or other domestic support obligations,* like child support. This complete hands-off approach might seem harsh to some at first, but Congress wrote the Bankruptcy Code so that a person could not use “the protection of a bankruptcy filing in order to avoid legitimate marital and child support obligations.” In re Proyect, 503 B.R. 765, 773 (Bankr. N.D. Ga. 2013) (quoting H.R. Rep. No. 103-835, at 54 (Oct. 4, 1994), reprinted in 1994 U.S.C.C.A.N. 3340, 3363).

      An ex-spouse is not without recourse, however. Rather than file for bankruptcy, an ex-spouse may still turn to the state divorce court itself to modify the alimony and child support for the same financial reasons that would lead to or underlie a bankruptcy filing.

      Also, there is still some hope in bankruptcy. In certain limited instances, an ex-spouse in bankruptcy might argue that “what they owe” is not truly alimony or a domestic support obligation. For example, what if the state divorce court orders the ex-spouse to pay the other ex-spouse’s attorneys’ fees and costs? If the fees and costs awarded are punitive and not in the nature of support, then it may be possible to modify or discharge that obligation in bankruptcy.

       Bankruptcy courts look at the substance of the support obligation, largely disregarding what the parties call it. Cummings v. Cummings, 244 F.3d 1263, 1265 (11th Cir. 2001). The question is whether the obligation is “in the nature of support.” A debt is “in the nature of support” if, at the time the debt was created, the parties intended the obligation to function as support. The key determination in whether a debt is non-dischargeable alimony or a domestic support obligation under the Bankruptcy Code is the intent of the parties.

       In short, an ex-spouse cannot simply throw up his or her hands and file bankruptcy to avoid or modify alimony. Bankruptcy courts will only recharacterize and discharge a domestic support obligation if evidence shows that it is not in the nature of alimony, maintenance, or support.

* Note: “Domestic support obligation” is a broad term defined by the Bankruptcy Code and includes alimony, child support, and anything that is in the nature of alimony, maintenance, and support. 11 U.S.C. § 101(14A). 

Wednesday, February 17, 2016

Trial & Litigation: Amendments to Florida’s Construction Defects Statute

By Jaret J. Fuente and Mark A. Smith

        On October 1, 2015, amendments to Chapter 558, Florida Statutes, the “Construction Defects” statute, went into effect. Originally created in 2003, Chapter 558 requires pre-suit notice and an opportunity to inspect and propose a resolution before to commencement of construction defect lawsuits. It is intended as an alternative method to resolve construction disputes and protect the rights of property owners. § 558.001, Fla. Stat.

        Although well-intended and capable at facilitating pre-suit dialogue, some of the statute's requirements have created confusion among practitioners in application. The legislature recently attempted to clarify the statute by amending it to provide as follows:

§ 558.001 (Legislative Findings & Declaration) – Amended to add insurers of contractors, subcontractors, suppliers, and design professionals as parties who should be provided an opportunity to resolve claims through confidential settlement negotiations before litigation.

§ 558.002 (Definitions) – Amended the definition of “Completion of a building or improvement” to mean the issuance of a certificate of occupancy, whether temporary or otherwise, that allows for occupancy or use of the entire building or improvement.

§ 558.004 (Notice and opportunity to repair)

  • Subsection (1) dealing with the subject of pre-suit notice was split into three parts (a, b, c), and part b now requires greater detail from claimants, providing that: "Based upon at least a visual inspection … the notice of claim must identify the location of each alleged construction defect sufficiently to enable the responding parties to locate the alleged defect without undue burden. The claimant has no obligation to perform destructive or other testing for purposes of this notice."
  • Subsection (4) now provides that: "The written response must include one or more of the offers or statements specified in paragraphs (5)(a)-(e), as chosen by the responding contractor, subcontractor, supplier, or design professional, with all of the information required for that offer or statement."
  • Subsection (13) now provides that providing a copy of a notice of claim to an insurer shall not constitute a claim for insurance purposes unless the terms of the policy specify otherwise.
  • Subsection (15) now includes among records to be exchanged upon request: photos and videos of the alleged construction defect identified in the notice of claim and maintenance records and other documents related to the discovery, investigation, causation, and extent of the alleged defect identified in the notice of claim and any resulting damages. It also now states: "A party may assert a claim of privilege … with respect to any of the disclosure obligations specified in this chapter."

        These changes should assist in requiring greater detail from claimants and providing clarity with respect to the nature of responses to be provided and documents to be exchanged. Time will tell if this ultimately renders the amended statute more effective.

Monday, February 15, 2016

Workers' Compensation: Update on Pending Cases Before the Florida Supreme Court

By Anthony V. Cortese

       At the time this article was written, major issues in state workers’ compensation appeals were still pending before the Florida Supreme Court. All section members who have their email addresses registered with the HCBA workers’ compensation section will receive an email alert when each of those decisions is released. In the meantime, tensions are rising with the Florida Supreme Court’s grant of certiorari review in Stahl v. Hialeah Hospital, and major changes to the procedural rules governing Longshore and Defense Base Act claims and case law interpreting those acts are affecting specialists who practice in that field.

In Stahl v. Hialeah Hospital, 160 So. 3d 519 (Fla. 1st DCA 2015), the First District Court of Appeal argued that the 1994 addition of a $10 copay for medical visits after the claimant attains maximum medical improvement and the 2003 elimination of permanent partial disability benefits made the workers’ compensation law an inadequate exclusive replacement for a tort action. The Florida Supreme Court’s decision to grant certiorari review in Stahl could have significant implications for the two other workers’ compensation cases pending before the Florida Supreme Court: Westphal v. City of St. Petersburg and Castellanos v. Next Door.

By way of contrast, the Longshore Act and Defense Base Act provide generous medical and indemnity benefits without the limitations of Florida workers’ compensation statute. 33 U.S.C. §§ 907 and 908. But those acts do not permit the claimant to avoid exclusivity or immunity issues. Munn v. Kerry, 782 F.3d 402 (9th Cir. 2015) (holding that family members of three security guards kidnapped and murdered in Iraq could not pursue tort actions in civil court because those claims are precluded by the Longshore and Defense Base Acts). And recent decisions under the Longshore Act continue to make it more difficult for a claimant to obtain attorney fees from an employer or carrier under section 28(a). 33 U.S.C. § 928(a).

By providing minimal initial medical care, an employer or carrier can avoid fee shifting under section 28(a). Asadi v. Tradesman International, 2014-LHC-01003 (March 5, 2015). But a claimant will still be able to shift his or her attorney’s fee to the employer or carrier so long as he or she satisfies all of the formal requirements of section 28(b), including an informal conference, certain District Director recommendations, and refusal by the employer/carrier to comply with those recommendations. Id. A claimant should oppose a procedural effort by the employer or carrier to circumvent this initial procedure. Rendon v. L-3 Communications, 2015-LDA-00529 (June 30, 2015).

Longshore and Defense Base Act practitioners should also note that new procedural rules became effective over the summer. The changes are substantial, including new filing and conference requirements, limitations on discovery, and other procedures for hearings. The rules are available at http://www.oalj.dol.gov/librules.htm. It has long been held that failure to follow the rules or pretrial orders hearings can support various sanctions, such as excluding certain evidence or witnesses, dismissing claims, or striking defenses. See Williams v. Marine Terminals, 14 BRBS 728 (1981) and Durham v. Embassy Dairy, 19 BRBS 106 (1986). 

Tuesday, February 9, 2016

Labor & Employment Law: Fifth Circuit Takes Another Jab at the NLRB

By Ashley A. Petefish and Nicole Bermel Dunlap

The Fifth Circuit stepped into the ring for another round, knocking down yet another National Labor Relations Board (NLRB) decision that class- and collective-action waivers are unlawful. Recently, in Murphy Oil USA, Inc. v. NLRB, the Fifth Circuit again reversed the NLRB, rejecting the board’s argument that arbitration agreements requiring employees to waive their right to pursue class and collective actions are unlawful. 2015 WL6457613

Previously, the Fifth Circuit, in D.R. Horton, Inc. v. NLRB, reversed the NLRB’s position on this precise issue. D.R. Horton, Inc., v. NLRB, 737 F.3d 344 (5th Cir. 2013). Rather than seeking certiorari review by the United States Supreme Court, the NLRB simply issued its decision in Murphy Oil less than a year later, reaffirming its reasoning and result in D.R. Horton. In Murphy Oil, the NLRB again insisted that the National Labor Relations Act (NLRA) provides a substantive right to engage in collective action and, as such, is a contrary congressional command that precludes application of the Federal Arbitration Act (FAA), thus prohibiting the application of class- and collective-action waivers. 

The Fifth Circuit’s reversal of the NLRB decision in Murphy Oil delivers a hard uppercut to the board. Relying upon its earlier determinations in D.R. Horton that: the NLRA did not contain a congressional command overriding the FAA and that the use of class-action procedures was not a substantive right under the NLRA, the Fifth Circuit simply stated that its decision in D.R. Horton was issued less than two years ago and that the Fifth Circuit would not repeat its analysis. Murphy Oil, 2015 WL6457613, at *3.

Even in the aftermath of the Fifth Circuit’s decision in Murphy Oil decision, the NLRB continues to assert that it is an unfair labor practice for employers to: (1) have employees sign arbitration agreements waiving their right to bring complaints on a class or collective basis, or (2) seek the enforcement of such agreements in any forum. The Fifth’s Circuit’s recent decision and the NLRB’s insistence on its contrary position has labor and employment law practitioners wondering how many rounds this matchup will last before the Supreme Court is given the opportunity to resolve the split between the NLRB and the courts.

In Murphy Oil, the petitioner also requested that the Fifth Circuit sanction the NLRB for its blatant defiance of the Fifth Circuit’s D.R. Horton decision. However, recognizing that the NLRB did not always know which circuit’s law would be applied on a petition for review,* the Fifth Circuit refused to condemn the NLRB’s nonacquiescence with D.R. Horton. Murphy Oil, 2015 WL6457613, at *4. Although the Fifth Circuit’s decision not to sanction the NLRB may appear to give the board the opportunity to bob and weave its argument through the other circuits, the Second, Eighth, Ninth, and Eleventh Circuits have already implicitly or explicitly agreed with the Fifth Circuit’s decision in D.R. Horton. Walthour v. Chipio Windshield Repair, LLC, 745 F.3d 1326, 1336 (11th Cir. 2014), cert. denied 134 S. Ct. 2886 (2014); Richards v. Ernst & Young, LLP, 744 F.3d 1072, 1075 n.3 (9th Cir. 2013); Owen v. Bristol Care, Inc., 702 F.3d 1050, 1053–55 (8th Cir. 2013); Sutherland v. Ernst & Young LLP, 726 F.3d 290, 297 n.8 (2d Cir. 2013). Hopefully, given these circuit court decisions, the NLRB will weigh-in for a final matchup and seek certiorari review by the Supreme Court.


*Note: An employer can seek review of a board decision in the circuit where the unfair labor practice allegedly took place, in the United States Court of Appeals for the District of Columbia, or in any circuit in which it transacts business.  29 U.S.C. § 160(f).

Friday, February 5, 2016

Senior Counsel: The Nuremberg Justice Ministry Trial of 1947

By Thomas Newcomb Hyde

        In 1941, 76-year-old Leo Katzenberg, a prominent Jewish businessman in Nuremberg, Germany, rented an apartment in his house to Irene Seller, a non-Jew who was the 30-year-old daughter of Leo’s non-Jewish friend. Leo, who had rented the apartment to Irene as a favor to his friend, was eventually accused of having a sexual affair with her. While Leo and Irene admitted kissing with Irene on Leo’s lap, an investigator found no evidence of sexual intercourse. Nonetheless, Leo was arrested for race defilement in violation of a 1935 Law for Protection of German Blood forbidding relations between Jews and Aryans. Both Leo and Irene denied the accusations, claiming they were like father and daughter.

        So began the presentation by Second District Court of Appeal Judge Edward LaRose to over 50 people, including 15 judges, at the Senior Counsel Section Luncheon on “The Nuremberg Justice Ministry Trial of 1947” at the Ferguson Law Center. Judge LaRose described how Leo was tried before the Nuremberg Special Court, which had been established in 1933 with jurisdiction over cases involving inciting disobedience of governmental orders, sabotage, and acts contrary to public welfare. Leo’s case was tried by Judge Oswald Rothaug, a rabid Nazi who referred to Leo as “an agent of world Jewry” and a “syphilitic Jew.” In a trial without due process, Leo was convicted and sentenced to death by Judge Rothaug. Leo was beheaded in 1942.

        In the spring of 1945, the victorious Allies organized an International Military Tribunal to try Nazis responsible for the atrocities in Europe. The most famous Nuremberg trials involved Rudolf Hess, Albert Speer, and Herman Goering. But other lesser officials were also tried. In the Nuremberg Justice Ministry Trial of 1947, Judge Rothaug was on trial for convicting and sentencing Leo to death without due process of law. (The story is fictionally recounted in the 1961 film Judgment at Nuremberg with Burt Lancaster in the role of Judge Rothaug and Judy Garland as Irene.)

       Judge Rothaug’s lawyer argued that Rothaug should not be bound by ex post facto laws, that he was just following orders, and that he was bound by legislative acts. The prosecutor pointed out that Rothaug had acquiesced in the Nazification of the judiciary into a political tool for the Nazis. The Special Courts, he added, were not legitimate courts, but a vehicle for suppression of expression whose victims included Jews, Poles, and gypsies. There was no semblance of due process and no appeal.

        Judge LaRose discussed the legacy of the Nuremberg trials and asked difficult questions to ponder: What does the Justice Ministry Trial of 1947 say to us as lawyers and judges in a diverse, pluralistic, and ever-shrinking world beset by violence, prejudice, and inequality? Do we reject the existence of natural law? How do we react to an unjust law? Do we work to repeal it, commit civil disobedience, work to limit its reach, or resign? Should we defer to civil government in the hope that, over time, laws will be just? To what extent do our actions or inaction perpetuate unjust laws?

Wednesday, February 3, 2016

Intellectual Property: Inter Partes Review - You Can Run But You Cannot Hide from Federal Court

By Kathy Wade

        Anyone petitioning for inter partes review (IPR) of patent claims by the U.S. Patent and Trademark Office (PTO) with the intention to bypass federal court should be forewarned: Such action does not circumvent scrutiny by the U.S. Court of Appeals for the Federal Circuit. Under 28 U.S.C. section 1295 (a)(4)(A), the federal circuit has exclusive jurisdiction over appeals from the PTO’s Patent Trial and Appeal Board (PTAB), including jurisdiction over appeals of the PTAB’s final written decisions on IPRs. Belden Inc. v. Berk-Tek LLC, 610 F. App'x 997, 1001 (Fed. Cir. 2015). 

        Although the federal circuit largely rubber-stamped the PTAB’s IPR decisions in 2015, the court did not affirm all. In two appeals, the federal circuit substantively challenged ― and rejected ― the PTAB’s findings. Such action by the federal circuit is noteworthy in light of the substantial deference the court gives to the PTAB’s factual findings.

        In Microsoft Corp. v. Proxyconn, Inc., the federal circuit reversed the PTAB, in part, for the first time in an appeal of an IPR. 789 F.3d 1292, 1308 (Fed. Cir. 2015). Specifically, the court remanded with regards to the PTAB’s claims construction findings. The court first rejected the patent owner’s argument that the broadest reasonable interpretation (BRI) standard of claims construction used by the PTAB should not apply in IPR proceedings. Id. at 1297. The federal circuit held, in a case decided after the parties had fully briefed their appeal, In re Cuozzo Speed Techs., LLC, 793 F.3d 1268 1275-79 (Fed. Cir. 2015), that the PTAB properly adopted the BRI standard. Although the court affirmed the PTAB’s use of the BRI standard, it found the PTAB’s construction of certain terms were unreasonably broad and vacated the board’s unpatentability findings on that ground. Microsoft, 789 F.3d at 1298-99.

        The federal circuit’s second reversal of the PTAB’s factual findings involved an obviousness determination. In Belden Inc. v. Berk-Tec LLC, 610 F. App'x 997, 1005 (Fed. Cir. 2015), the federal circuit rejected the PTAB’s conclusion that two patent claims were not obvious. The PTAB had determined that there was no motivation to combine two prior art references to teach the two claims. The federal circuit disagreed, finding the PTAB had made a series of incorrect factual conclusions and that the undisputed record evidence pointed clearly to a motivation to combine the references. The court did not, however, vacate and remand to the PTAB to make appropriate findings. Instead, the court found the record was sufficient to reverse the board.

        Although Microsoft and Belden teach key lessons on the federal circuit’s legal analyses, they are largely important for their results. They signal that the federal circuit still has the last word on patent claim validity. Practitioners in IPR proceedings would do well to bear in mind that they may still have to litigate in federal court. 

Monday, February 1, 2016

Health Care Law: OCR HIPAA Compliance Audits 2016 - Are You Audit Ready?

By Maja Lacevic

       On September 10, 2015, the Department of Health and Human Services Office of Inspector General (OIG) recommended that the Office for Civil Rights (OCR) strengthen its oversight of covered entities’ compliance with the HIPAA Privacy Rule. U.S. Dept. of Health and Human Servs., OEI-09-10-00510, OCR Should Strengthen Its Oversight of Covered Entities’ Compliance with the HIPAA Privacy Standards (2015). The OIG made the following recommendations to OCR after conducting its study:

  1. Fully implement a permanent audit program;
  2. Maintain complete documentation of corrective action;
  3. Develop an efficient method in its case-tracking system to search for and track covered entities;
  4. Develop a policy requiring OCR staff to check whether covered entities have been previously investigated; and
  5. Continue to expand outreach and education efforts to covered entities. Id. at 11-12.

       In response to the report, OCR agreed with each of OIG’s recommendations and OCR Director, Jocelyn Samuels, announced that in early 2016, OCR will launch Phase 2 of its audit program. Letter from Jocelyn Samuels, Director of OCR, to Daniel R. Levinson, Inspector General of the Dept. of Health and Human Servs. (September 23, 2015). The audit program will measure compliance by covered entities and business associates with HIPAA’s privacy, security, and breach notification requirements through a combination of desk reviews of policies and on-site reviews. Id. Unlike the pilot audits in 2012, which were conducted by a consulting firm that OCR hired, the next round of audits will be performed by OCR staff.

      In anticipation of the upcoming audits and to avoid potential issues, covered entities should assess their preparedness and HIPAA compliance by using the existing protocol and other guidance available on the OCR Health Information Privacy website.

       Additionally, covered entities and business associates should invest time in identifying and closing any HIPAA compliance gaps and ensuring that they have the proper risk analysis, risk management, and breach reporting plans in place. Addressing the following common areas of concern can help with assessing preparedness:

  • Has a risk assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic Protected Health Information been implemented and documented? 45 C.F.R. § 164.308(a)(1)(ii)(A).
  • Is a breach reporting plan in place for responding to breaches of Protected Health Information?
  • Are written policies and procedures in place that address privacy and security standards, and the weaknesses identified in the risk assessment?
  • Is a training program in place with documented training for new staff and existing staff?
  • Is a HIPAA compliant Notice of Privacy Practices provided to patients and is the notice available on the covered entity’s website?
  • Are appropriate agreements in place with business associates?

       In preparation for the OCR audits, covered entities should be able to provide evidence that: (1) a risk analysis assessment has taken place; (2) policies have been adopted to reduce risks and vulnerabilities to a reasonable level; (3) HIPAA training has been conducted; and (4) the notices have been delivered. Having the right supporting documentation in place can go a long way toward helping a covered entity survive an OCR audit, even where operational compliance may not always be one hundred percent.