Gone Employee Threats

An employee is gone.  Fired or voluntarily.  What next?  OCR recently posted a bulletin called “Insider Threats and Termination Procedures” reminding the healthcare industry of the recurring risks of terminated employees in accessing or revealing PHI or other important data.

In summary, OCR reminds us all that good procedures following the termination of an employee include:

• Make immediate changes to terminate both IT and physical access to the facility.
• Have procedures in place to alert key employees regarding physical and IT security and of an employee’s termination.
• Periodically audit former employee IT or physical access and also audit any user account that has not been used within a set number of days.
• Change administrator level and user level passwords periodically particularly for privileged accounts that any former employee had access to during employment.

#MeToo Employee Threats

While Hollywood executives, presidents and others steal the headlines about sexual battery and sexual harassment, this behavior can present serious problems for hospitals and other providers.  Clearly the first step to eliminating this behavior is a solid and well written policy on gender or sexual based harassment.  The second step is making sure that your employees, doctors and administrators understand the policy and that it will be enforced.  In order to reduce the temptation of certain employees to mistreat other employees:

• Train all your employees how to handle harassment complaints.  Also train your staff so they understand your policy.
• Make it clear throughout your work environment that harassment is not tolerated.  Bad behavior, perhaps short of the classical definition of harassment should not be tolerated either.  Make it clear that such bad behavior will not be tolerated no matter who is involved.
• Act immediately.  If you see the potential problems and hear stories, act then.  When you observe warning signs such as degrading comments, inappropriate jokes, high turnover rates and low employee morale because of an unpleasant work environment, don’t wait, take action.

Spoliation

Spoliation is a legal claim regarding lost or destroyed evidence.  Where spoliation is found, the court will assume that the destroyed evidence would have supported the other parties claim.

This claim recently arose in an Indiana appeals decision.  Dr. Flenar had a patient who was in a car accident. She was treated by Dr. Flenar.  In connection with a lawsuit against the driver of the car that hit Dr. Flenar’s patient, she requested a copy of her medical records in 2013.  Dr. Flenar failed to respond and despite multiple follow-up requests, never provided them.

The patient then sued the doctor for failing to keep the records as required by Indiana law and also claimed that Dr. Flenar should pay damages because the lack of her medical records would likely reduce the amount she would get against the driver of the car that caused the accident.

Dr. Flenar’s response was less than convincing to the court.  He explained that he used electronic medical records (EMR) and that his company Allscripts stopped supporting his current software in 2015 and that he did not want to pay for a new Allscripts program.  Apparently he also failed to pay any money to Allscripts or anyone else to preserve the records as required by Indiana law and the records were subsequently destroyed by Allscripts.  Dr. Flenar failed to explain why he didn’t produce the EMR in 2013 or 2014 while it was still easily available to him.

This case points out several risks:

• Comply with the Indiana Medical Records Regulation that require doctors to provide prompt response to a request for copy of medical records.
• Understand the risks of trying to preserve medical records in an EMR format over many years.  Medical records companies come and go, medical records software changes or is superseded.
• Pay attention to these changes and discuss and prepare for maintaining the integrity of patient medical records while these various changes in technologies come and go.
• Review your insurance protections to determine whether you need any insurance for such events.

This newsletter is edited by Paul Wallace of Jones • Wallace, LLC, a member of the American Bar Association Healthcare Law Section and the American Health Lawyers Association who has been representing physicians and healthcare practices for over 25 years.  Mr. Wallace assists physicians, practices and hospitals in contract items, federal legal compliance, practice entity creation, estate and wealth planning and similar issues.  Please feel free to call if you have any questions on this newsletter or legal matters at (812) 402-1600 or pwallace@joneswallace.com.