Review & Update Medical Record Confidentiality Policies In Response To Newly Revised Federal Substance Abuse Disorder Confidentiality Rules

February 29, 2024

Physicians, substance abuse and mental health facilities, and other health care providers providing or handling substance abuse treatment records should review and update their medical privacy and confidentiality policies to comply with revisions (Final Rule) to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (“Part 2”) adopted by the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) on February 8, 2024. Providers subject to Part 2 should move quickly to review and update their policies and practices to comply with Part 2 and other applicable federal and state confidentiality, privacy and data security requirements avoid the potentially serious and expensive consequences that can result from violations.

Part 2 Generally

The Part 2 statute (42 U.S.C. 290dd-2) protects “[r]ecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.” Confidentiality protections help address concerns that discrimination and fear of prosecution deter people from entering treatment for SUD.

Like violation of HIPAA and other federal and state medical privacy and confidentiality rules, violation of Part 2 carries serious consequences, including:

  • Civil Penalties: Organizations or individuals found in violation may face fines or monetary penalties. These can vary depending on the severity of the breach and the specific circumstances.
  • Criminal Charges: In cases of intentional or willful violations, criminal charges may be filed. This could result in imprisonment or probation for the responsible parties.
  • License Revocation: Medical professionals, facilities, or organizations may have their licenses revoked or suspended if they fail to protect patient confidentiality.
  • Legal Liability: Violations can lead to lawsuits and legal claims by affected individuals. This may result in financial damages awarded to the aggrieved parties.
  • Reputation Damage: Breaches of confidentiality can harm an organization’s reputation and trust among patients, clients, and the public.

It is crucial for covered healthcare providers and programs to adhere to confidentiality regulations, as well as otherwise applicable HIPAA and other legal and ethical standards to avoid these consequences.

The requirements of Part 2 run in tandem with, and where applicable, apply in addition to the much more broadly privacy, security, data breach, and patient rights requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) applicable to health care providers, health plans, health care clearinghouses and their business associates. Part 2 Part 2 directly applies to all records relating to the identity, diagnosis, prognosis, or treatment of any patient in a substance abuse program that either is federally assisted and holds itself out as providing, and provide, alcohol or drug abuse diagnosis, treatment or referral for treatment. A program is “federally assisted” if it is:

  • Any entity that receives federal funding
  • Certified by Medicare
  • Registered to distribute controlled substances
  • A tax exempt non-profit.

Since most physicians and many other treatment providers register with the Drug Enforcement Agency (DEA) to distribute controlled substances, this includes most prescribers. Providers that do not directly fall within the scope of the rule also need to confirm that their state licensure or other rules do not require their compliance with the Part 2 rules.

While the restrictions and requirements for covered health care providers of Part 2 and HIPAA both can affect the hoops that employers may have to negotiate to access applicants’ and employees’ substance abuse treatment records, neither Part 2 or HIPAA applies to employers to implement and administer Drug Free Workplace Act or other workplace-related substance abuse policies. However, the Americans with Disabilities Act (ADA) of 1990, the Civil Rights Act of 1964, the Family and Medical Leave Act (FMLA) of 1993, the National Labor Relations Act (NRLA) of 1935, state common law or statutory privacy, confidentiality, employment and other laws, and a variety of other federal and state laws may restrict employer use and access to, and require employers to protect the confidentiality of drug testing and other substance use and abuse screening, treatment and other substance abuse related records. Consequently, while employers are not directly subject to Part 2 and HIPAA, they nevertheless need to ensure compliance with other applicable requirements, particularly since violations of these employer rules tend also to carry potentially substantial liability.

New Part 2 Revisions

The revisions will bring the Part 2 program privacy and confidentiality requirements into closer alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and Enforcement Rules, as well as require enhanced coordination among providers treating patients for substance abuse disorders (SUDs), and enhance integration of behavioral health information with other medical records in response to provisions of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). that, among other things, required HHS to bring the Part 2 program into closer alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and Enforcement Rules.

Among other things, the Final Rule makes the following modifications to Part 2:

  • Allows a single patient consent for all future uses and disclosures for treatment, payment, and health care operations.
  • Allows HIPAA covered entities and business associates that receive records under this consent to redisclose the records in accordance with the HIPAA regulations.1
  • Aligns Part 2 penalties with HIPAA by replacing criminal penalties currently in Part 2 with civil and criminal enforcement authorities that also apply to HIPAA violations.2
  • Applies the same requirements of the HIPAA Breach Notification Rule3 to breaches of records under Part 2.
  • Aligns Part 2 Patient Notice requirements with the requirements of the HIPAA Notice of Privacy Practices.
  • Creates a limit on civil or criminal liability for investigative agencies that act with reasonable diligence to determine whether a provider is subject to Part 2 before making a demand for records in the course of an investigation. The safe harbor requires investigative agencies to take certain steps in the event they discover they received Part 2 records without having first obtained the requisite court order.
  • Clarifies and strengthens the reasonable diligence steps that investigative agencies must follow to be eligible for the safe harbor: before requesting records, an investigative agency must look for a provider in SAMHSA’s online treatment facility locator and check a provider’s Patient Notice or HIPAA Notice of Privacy Practices to determine whether the provider is subject to Part2.
  • Adds an express statement that segregating or segmenting Part 2 records is not required.
  • Adds a right to file a complaint directly with the Secretary for an alleged violation of Part 2. Patients may also concurrently file a complaint with the Part 2 program.
  • Creates a new definition for an SUD clinician’s notes analyzing the conversation in an SUD counseling session that the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical record and that require specific consent from an individual and cannot be used or disclosed based on a broad TPO consent. This is analogous to protections in HIPAA for psychotherapy notes.4
  • Prohibits combining patient consent for the use and disclosure of records for civil, criminal, administrative, or legislative proceedings with patient consent for any other use or disclosure.
  • Creates a new right for patients to opt out of receiving fundraising communications.
  • Permits disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule.
  • Restricts the use of records and testimony in civil, criminal, administrative, and legislative proceedings against patients, absent patient consent or a court order.
  • Requires a separate patient consent for the use and disclosure of SUD counseling notes.
  • Requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent.

Given the concurrent applicability of Part 2 and HIPAA and the Part 2 revisions’ incorporation of HIPAA standards and requirements, providers subject to Part 2 should confirm the compliance of their policies and practices with both the specific requirements of Part 2 and HIPAA generally. When evaluating compliance, covered entities should keep in mind that along with the Part 2 changes, OCR’s applicable regulatory and enforcement HIPAA guidance also has undergone significant change in recent months. The review and update will need to validate compliance with current requirements of both Part 2 and HIPAA, as well as all otherwise applicable federal and state laws and ethical standards. Verifying compliance is particularly important because the Biden Administration has made expansion and enforcement of federal rules protecting access to treatment and safeguarding the confidentiality of mental health and substance abuse treatment records a top priority. In light of this emphasis, all health care providers should act promptly to review and update their policies with these Part 2 changes.as well as other HIPAA and related federal and state changes.

For More Informational

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations GroupHR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™


OCR Nails Second HIPAA Covered For Allowing Ransomware Breach

February 23, 2024

Health care providers, health plans, health care clearinghouses and their business associates (covered entities) that fail to appropriately safeguard their protected health information and systems against randomware and other malware threats as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) should expect to pay hefty amounts to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) if an attack occurs. That is the clear message sent by OCR’s February 22, 2022 announcement of its second ransomware settlement since October, 2023.

Duty To Guard Against Malware

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information. 

Ransomware and hacking are the primary cyber-threats in health care. A type of malware (malicious software) designed to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid, OCR has seen large breaches affecting more than 500 individuals reported to OCR involving hacking increase 256% and those from ransomware increase 264% increase over the past five years,

In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.

In light of the growing threat, OCR is prioritizing enforcement, education and compliance outreach to HIPAA covered entities.

OCR’s February 22, 2024 announcement of its second ever and second settlement of a malware related enforcement action in less than five months demonstrates OCR’s readiness to hold covered entities accountable for failing to fulfill this responsibility.

Green Ridge Ransomeware Breach

OCR’s February 22, 2022 announcement of its second ever ransomware related resolution agreement and corrective action plan  reaffirms OCR’s readiness to hold covered entities accountable for failing to guard against ransomware and other cyber risks.

Green Ridge Behavioral Health, LLC, (Green Ridge), a Maryland-based practice that provides psychiatric evaluations, medication management, and psychotherapy. This marks the second settlement that OCR has reached with a HIPAA regulated entity for potential violations identified during an investigation following a ransomware attack. 

The settlement resolves an investigation following a ransomware attack that affected the protected health information of more than 14,000 individuals.  

OCR learned of the breach after Green Ridge filed a breach report with OCR in February 2019 that stated that its network server had been infected with ransomware resulting in the encryption of company files and the electronic health records of all patients.

In keeping with its policy of investigating all breaches affecting more that 500 individuals (large breaches), OCR opened an investigation in April, 2019.

OCR’s investigation of the breach found evidence of potential violations of the HIPAA Privacy and Security Rules leading up to and at the time of the breach. Other findings included that Green Ridge Behavioral Health failed to:

  • Have in place an accurate and through analysis to determine the potential risks and vulnerabilities to electronic protected health information;
  • Implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level; and 
  • Have sufficient monitoring of its health information systems’ activity to protect against a cyber-attack.

Under the terms of the settlement, Green Ridge agreed to pay $40,000 and implement a corrective action plan that will be monitored by OCR for three years to avoid exposure to potentially much greater HIPAA monetary penalties.

The plan also requires Green Ridge to take many actions to resolve potential HIPAA violations and to protect electronic protected health information, including:

  • Conducting a comprehensive and thorough analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information;
  • Designing a Risk Management Plan to address and mitigate security risks and vulnerabilities found in the Risk Analysis;
  • Reviewing, and as necessary, developing, or revising its written policies and procedures to comply with the HIPAA Rules;
  • Providing workforce training on HIPAA policies and procedures;
  • Conducting an audit of all third-party arrangements to ensure appropriate business associate agreements are in place, where applicable; and
  • Reporting to OCR when workforce members fail to comply with HIPAA.

First Malware Settlement

Prior to this week’s announcement of the Green Ridge resolution agreement, OCR already had announced its first ever malware related resolution agreement on October 31, 2023.

That $100,000 settlement resolved a potentially much greater HIPAA liability business associate Doctors’ Management Services (DMS) could have faced for alleged HIPAA violations OCR found investigating a large breach report DMS filed on April 22, 2019.

The DMS breach report disclosed that a ransomware attack affected DMS’ network server with GandCrab ransomware beginning with an initial unauthorized access to the network that occurred on April 1, 2017; however, DMS did not detect the intrusion until December 24, 2018, Once the DNS system was accessed, ransomware was used to encrypt their files. The attack affected the electronic protected health information of 206,695 individuals

OCR’s investigation of the DNS breach found evidence of potential failures by DMS to have in place an analysis to determine the potential risks and vulnerabilities to electronic protected health information across the organization. Other findings included insufficient monitoring of its health information systems’ activity to protect against a cyber-attack, and a lack of policies and procedures in place to implement the requirements of the HIPAA Security Rule to protect the confidentiality, integrity, and availability of electronic protected health information.

Under the terms of the DMS settlement agreement paid $100,000 to OCR and agreed to implement a corrective action plan that requires:

  • DMS to submit to OCR monitoring for three years to ensure compliance with HIPAA
  • Review and update its Risk Analysis to identify the potential risks and vulnerabilities to Doctor’s Management Services data to protect the confidentiality, integrity, and availability of electronic protected health information.
  • Update its enterprise-wide Risk Management Plan (strategy to protect the confidentiality, integrity, and availability of ePHI) to address and mitigate any security risks and vulnerabilities found in the updated Risk Analysis.
  • Review and revise, if necessary, its written policies and procedures to comply with the Privacy and Security Rules.
  • Provide workforce training on HIPAA policies and procedures.

Warning To All Covered Entities

Along with announcing the two recent resolution agreements, OCR also is warning all covered entities to tighten their malware and ransomware safeguards.

OCR’s announcement of the Green Ridge resolution agreement, for instance, quotes OCR Director Melanie Fontes Rainer as stating, “Health care providers need to understand the seriousness of these attacks and must have practices in place to ensure patients’ protected health information is not subjected to cyber-attacks such as ransomware.”

To assist covered entities to meet this responsibility, OCR has developed Fact Sheet guidance that recommends covered entities to take at least the following steps to guard against breaches from ransomware and other malware attacks:

  • Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
  • Risk analysis and risk management should be integrated into business processes; conducted regularly and when new technologies and business operations are planned.
  • Ensure audit controls are in place to record and examine information system activity.
  • Implement regular review of information system activity.
  • Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
  • Encrypt ePHI to guard against unauthorized access to ePHI.
  • Incorporate lessons learned from incidents into the overall security management process.
  • Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.
  • two recent resolutions agreements and other guidance and enforcement actions make clear that all covered entities should ensure their ability to demonstrate their completion of these and other actions a risk analysis shows are needed to defend against a ransomware or other malware threats. This guidance also alerts covered entities to stay vigilant and update risk assessments and safeguards in response as to evolving threats.

Covered entities should not assume the relatively modest settlement amounts collected in the two new ransomware settlements compared to exponentially greater resolution settlements like the $4.75 million settlement payment New York based Montefiore Medical Center made last year reflect greater tolerance for ransomware related threats versus internal or external hacking. To the contrary, the Montefiore Medical Center resolution makes clear the randomware threat is one of a multitude of internal and external threats covered entities must defend their protected health information against to comply with HIPAA.

Moreover, covered entities and their leaders also should take steps to understand and fully address all other statutory, ethical, contractual or other privacy or confidentiality requirements beyond those imposed by HIPAA. For example, health care providers, health plans and their fiduciaries, brokers, administrators and insurers also may bear responsibilities under the Employee Retirement Income Security Act fiduciary responsibility rules, the Fair and Accurate Credit Transactions Act, federal and state electronic crimes, privacy data security, artificial intelligence, workforce, tax, and other laws.

Publicly traded organizations and their leaders also may face responsibilities and liability under new Securities and Exchange Commission regulations, clawback rules and other laws arising from the occurrence or bungled response to a breach.

Likewise, got businesses sponsoring or administering employment-based health plans, Employee Benefit Security Administration considers managing cybersecurity risks a part of the fiduciary obligations of fiduciaries of employment-based health plans. Meanwhile, health care providers, insurance organizations and brokers, third party administrators, government contractors, attorneys and other advisors and others also may be subject to medical confidentiality and other data privacy and security obligations under federal and state electronic crimes, identity theft, ethics, professional licensure, contractual, common law privacy and other statutory and common laws. Since HIPAA and many of these other laws involve potential criminal as well as civil liability, organizations and leaders in covered entities generally should ensure their HIPAA and other cybersecurity compliance efforts are included in and administered according to their Federal Sentencing Guidelines Compliance program.

While it commonly is necessary or advisable to involve consulting or other technical support in the conduct of these activities, HIPAA entities should keep in mind the likelihood that their analysis and review is likely to uncover and prompt discussion of potentially legally or politically sensitive information. For this reason, HIPAA entities and their leaders generally will want to engage experienced legal counsel for assistance in structuring and executing these activities to maximize their ability to claim attorney-client privilege or other evidentiary protections against discovery or disclosure of certain aspects of these activities.

In planning for an implementing these procedures, Covered Entities also are reminded that the effectiveness of these efforts requires that the Covered Entities incorporate appropriate processes and policies for monitoring and investigating compliance with the policies and procedures implemented to comply with HIPAA. Conducting this monitoring and investigation by necessity is likely to involve surveillance, investigation and cooperation of employees, contractors, vendors and others for which Fair Credit Reporting Act background check notification and consent and other procedures are necessary or advisable. 

Finally, HIPAA entities should keep in mind that HIPAA and other cybersecurity compliance and risk management is an ongoing process requiring constant awareness and diligence.  Consequently, HIPAA entities should both monitor OCR and other regulatory and enforcement developments as well as exercise ongoing vigilance to monitor and maintain compliance within their organizations.

For More Informational

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations GroupHR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™


Nearly $900K FLSA Backpay Award Warns Other Home Health Employers

February 22, 2024

The U.S. Department of Labor’s Wage and Hour Division is warning other home health employers to clean up their pay and timekeeping practices in announcing its recovery of nearly $900,000 in back wages and damages from home care employer Advantage Home Care LLC and co-owners Dondra Nichols and Phillip Simons (Advantage). These and the long and ever-growing list of recoveries showother health industry employers the perils of failing to track and pay required overtime properly as required by the Fair Labor Standards Act (FLSA).

FLSA Rules

The FLSA requires that most employees in the U.S. be paid at least the federal minimum wage for all hours worked and overtime pay at not less than time and one-half the regular rate of pay for all hours worked over 40 in a workweek. It also prohibits employers from firing or taking adverse action against employees for exercising their rights. Violating employers and their complicit owners and other leaders risk liability for actual backpay, interest, double damages and costs of enforcement through Labor Department or private enforcement actions.

Advantage’s Costly Lesson

Advantage Home Care LLC provides nurses and home health aides for in-home care services. It’s nearly $900,000 schooling resulted after a Wage and Hour Division investigation found that Advantage failed to pay 108 workers their required overtime rates for all hours worked over 40 in a workweek and did not maintain accurate records of hours worked. Advantage paid $438,277 in back wages and an equal amount in liquidated damages for committing these FLSA violations.

In its announcement of the award, the Division warned other home health employers to clean up their own wage and hour practices.

“Workers in the low-wage home care industry must stretch their wages as far as they can go to make ends meet, making Advantage Home Care’s wage theft especially harmful,” said Wage and Hour Division District Director Roberto Melendez in Richmond, Virginia. “We encourage other home care employers to evaluate their own pay practices to ensure they are in compliance with the law.”

The Advantage recovery tops thr $324,049 in back wages and liquidated damages that a federal judge ordered another home health provider, Destiny Healthcare Services Inc. and its owner to pay for wrongfully failing to pay required overtime to 159 workers last Fall in Su v. Destiny Healthcare Services, Inc,. Mirza Baig, Sonia Chalal.

Like the Advantage recovery, that judgement came after a Labor Department investigation determined owner Mirza Baig and administrator Sonia Chalal did not keep accurate records of hours worked and paid the affected workers straight-time wages for all hours worked. By doing so, the Westchester-based employers failed to pay overtime as required by the FLSA. The Labor Department obtained a consent order resolving all issues, including payment of $324,049 in back wages and liquidated damages, and an injunction for future compliance. The award included $162,024.69 in unpaid overtime compensation and the additional sum of $162,024.69 in liquidated damages,

Heightened Health Industry Employer Risk

Home health and other health industry employers should recognize that the Labor Department specifically scrutinizes the health industry for special FLSA oversight and enforcement, Given this targeted scrutiny, health industry employers should be particularly careful to avoid getting nailed for FLSA violations by the Labor Department or private litigants. 

Among other things, employers should confirm the current defensibility of their current treatment of any workers as salaried and assess the risk of reclassification as non-exempt any employee the employer currently classifies as salaried. Employers also should confirm proper tracking and documentation of all required hours of work and other additional data necessary to comply with recordkeeping requirements of the FLSA.

Because of the high likelihood of some pre-existing misclassification of workers, underpayment of overtime or other violations, a health industry business also should consider conducting this analysis within the scope of attorney, client privilege, and under the guidance of an experienced licensed attorney. 

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions LaPress, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations GroupHR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™


3/4 Dallas Bar Association Virtual Program Covers Disability Accommodation In Education, Facilities, Technology & Beyond

February 9, 2024

Disability accommodation presents many challenges for academic medical centers and other educators, as well as other health care, real estate, hospitality, technology, retail, state and local government, community and other organizations. 

The Dallas Bar Association invites interested attorneys, compliance and risk management, and other interested individuals to attend the March 4, 2024, virtual continuing education program on “Disability Accommodation In The Schools:  Education, Facilities, Technology and Beyond” hosted by the Education Law Study Group. The Program will be held virtually on Zoom from Noon to 1:00 p.m. Central Time.

Public and private schools, community colleges, universities, and other educational organizations must evaluate and deliver a broad range of accommodations to meet their federal responsibility to provide individuals with disabilities access to and an equal opportunity to benefit from their educational and all other programs, services, facilities, and activities. While the applicable statutes may vary, many of the public and other accommodations applicable to educational organizations also apply to other public and private organizations. Meanwhile, the educational rights of students with disabilities affect many individuals, their families and others throughout their communities.

Attorneys Hans P. Graff and Cynthia Marcotte Stamer will discuss the scope, similarities, and differences in the requirements and procedures that govern the duties of schools to provide accommodation for individuals with disabilities in their classrooms and curriculum, social and other activities, facilities, technology, and other aspects of the student’s relationship and participation in the school.  The program is approved for 1.00 hours of MCLE Credit.

All attorneys, educational leaders, and others interested in this important topic are encouraged to attend. To register and for other details about attending the program in person or via Zoom, see here.

About the Presenters

Hans P. Graff has over 30 years of education law experience.  After leaving active duty as a Navy Judge Advocate in 1993, Hans entered private practice with a firm representing school districts throughout Texas.  In 1995, Hans began serving as an Assistant and later Deputy General Counsel for the Houston Independent School District. In that capacity, he represented the school district in matters involving the U.S. Department of Education Office of Civil Rights, the Office of Special Education Programs, the Family Policy Compliance Office, and the U.S. Department of Justice. Additionally, he was responsible for representing Houston ISD in contested matters and hearings before the Texas Education Agency, the State Office of Administrative Hearings, the Texas Department of Agriculture, the State Board for Educator Certification, the Texas State Board of Examiners of Psychologists, and the State Board of Nursing.  For more than 20 years, Hans annually reviewed and revised the HISD Code of Student Conduct and routinely provided advice on student discipline and student issues. 

In addition to his representation of public schools, Hans also brings decades of combined public and private experience advising and representing governmental entities in litigation at all levels.  He also routinely advised administrators and the HISD Police Department on potential Constitutional matters such as free speech, search and seizure, and matters related to child custody, DFPS conservatorship, and family law and represented Houston ISD in over 300 special education due process hearings. Hans also advises and represents a broad range of other clients in federal and state courts, as well as in state administrative hearings.

Cynthia Marcotte Stamer has more than 35 years of experience advising and representing public and private school districts, colleges, universities, academic medical centers, health care, early childhood education, insurance, employee benefits, financial services, technology, real estate, hospitality, sports, entertainment, sports, entertainment, community and a diverse range of other organizations and their leaders about disability accommodation and other federal and state Civil Rights, diversity, inclusion and other discrimination laws and standards; FERPA, HIPAA, and other privacy and data use and security; employment, employee benefits, and other workforce; health care; mental health; substance abuse and testing; student, workforce and community safety; procurement and contracting; Student Justice Courts and other discipline; workforce and vendor performance management and discipline; governance; internal controls and compliance; governmental and regulatory affairs; crisis preparedness, response, and resolution; and a broad range of other legal and operational concerns. 

Cindy has extensive experience advising and representing school districts, colleges, universities, academic medical centers, and other educational organizations and others extensively about special education, workforce, health care, and community disability assessment and accommodation. This experience is further informed by her experience as the parent of a child with developmental disabilities, as well as her past service in the leadership of an early childhood intervention agency.  She frequently conducts compliance audits and investigations and advises and represents school districts and other educational institutions as well as students, parents and caregivers, and others about IEP/Section 504 and other special education; ESL, student and staff discipline; facility, technology, transportation, and other public accommodation; mental health; and related concerns. Cindy also advises, represents, and defends educational and other organizations about government, contractor, and other audits, investigations, enforcement actions, and other dealings with the UIL and other sports, academic or other associations, the Department of Education, Medicaid and other Department of Health and Human Services, EEOC, Wage and Hour and other Department of Labor; Department of Justice, Department of Agriculture, Internal Revenue Service, Texas Employment Agency, Texas Department of Health, Child Protective Services, Veterans Affairs, Department of Transportation, law enforcement and other government agencies and relations. She also has worked with Congress, legislatures, and federal and state regulators on education, disability, public health and safety, nutrition, workforce, employee benefits, compensation, Social Security and other public benefits, migration, transportation, tax, public finance, and a host of other legislative and regulatory issues through her client engagements and her regulatory affairs and public policy advocacy practice and leadership and involvement with PROJECT COPE; The Coalition on Patient Empowerment, the American Bar Association, and many other professional, civic and community organizations.

For More Information

Solutions Law Press, Inc. is honored to share information about this upcoming program. We hope this information is of interest to its readers. For more information about the Program, the Dallas Bar Association or its Education Law Study Group or other committees and activities, see the Dallas Bar Association Website.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations GroupHR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™


Hospital System Pays $4.75 Million HIPAA Breach Settlement

February 8, 2024

The $4.75 million settlement payment New York based Montefiore Medical Center is paying to settle charges by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) Health Insurance Portability and Accountability Act (HIPAA) that multiple breaches of HIPAA’s Security Rule allowed a former employee to steal and sell more than 12,000 patients’ electronic personal health care information (EPHI) warns other health care providers, health plans, health care clearinghouses and their business associates (Covered Entities) to ensure their HIPAA compliance efforts incorporate adequate safeguards to protect their organizations’ EPHI against insider theft or other misuse as well as against external actors.

HIPAA Requirement To Protect Protected Health Information

The HIPAA Privacy, Security, and Breach Notification Rules require health care providers, health plans and insurers and others take steps to protect the privacy and security of patients’ protected health information. The HIPAA Security Rule requires Covered Entities to protect electronic protected health information and other protected health information against use, access, disclosure or destruction by third parties except under the conditions allowed by HIPAA.  These requirements include the requirements of the Security Rule to conduct and document comprehensive security assessments of risks to sensitive data systems, to implement and enforce detailed security safeguards to protect EPHI and the systems containing that data against these threats, to train and enforce compliance with these safeguards, and other requirements.  Meanwhile, the HIPAA Breach Notification Rule requires Covered Entities to report most breaches of unsecured EPHI to individuals whose data is affected, OCR, and in the case of breaches of EPHI affecting more than 500 individuals, to the media. 

Despite these Rules and the expanded audit and enforcement efforts by OCR, cybersecurity threats and breaches continue to present significant threats to the privacy and security of protected health information possessed by Covered Entities. OCR’s breach reports reflect that EPHI breaches affecting more than 500 individuals (large breaches) remain common. These breach reports reveal that more than 134 million individuals were affected by large breaches in 2023, compared to the not insignificant 55 million individuals affected in 2022. In response to this continuing threat, HHS released a Department-wide Cybersecurity strategy for the health care sector in December of 2023, and released voluntary performance goals to enhance cybersecurity across the health sector just last week. The enforcement action and settlement with Montefiore Medical Center is the latest of the growing list of investigations and resulting high dollar settlements obtained by OCR in its efforts to enhance the security of EPHI through enforcement of the Security Rule.

Montefiore Medical Center $4.75 Million Settlement

The $4.75 million monetary settlement agreement and corrective action plan resolves Montefiore Medical Center’s exposure to potentially much greater penalties that OCR could impose for multiple Security Rule violations OCR reports finding while investigating a Montefiore Medical Center data breach report of the theft and sale of personal health information by an employee.

Montefiore Medical Center learned of the data theft while investigating a report from the New York Police Department of evidence of theft of a specific patient’s medical information in 2015. The internal investigation revealed two years previously a Montefiore Medical Center employee stole the electronic records containing patient’s name, address, SSN, next of kin, and health insurance information, of 12,517 patients from its electronic medical record system and then sold patient information to an identity theft ring. OCR learned of the breach when Montefiore Medical Center filed the breach report about the theft with OCR to comply with the HIPAA Breach Notification Rule.

In accordance with its policy of investigating all breach reports involving the personal health information of more than 500 individuals (a large breach), OCR conducted an investigation of the breach reported in the Montefiore Medical Center breach notification report. According to OCR, that investigation revealed the breach and theft of the Montefiore patients’ EPHI was made possible by multiple potential violations of the HIPAA Security Rule, including failures by Montefiore Medical Center:

  • To analyze and identify potential risks and vulnerabilities to protected health information,
  • To monitor and safeguard its health information systems’ activity, and
  • To implement policies and procedures that record and examine activity in information systems containing or using protected health information.

OCR concluded without these safeguards in place, Montefiore Medical Center was unable to prevent the cyberattack or even detect the attack had happened until years later.

Under the terms of the settlement, Montefiore Medical Center will pay $4,750,000 to OCR and implement a corrective action plan that identifies certain steps toward protecting and securing the security of protected health information. These actions include:

  • Conducting an accurate and thorough assessment of the potential security risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information;
  • Developing a written risk management plan to address and mitigate security risks and vulnerabilities identified in the Risk Analysis;
  • Developing a plan to implement hardware, software, and/or other procedural mechanisms that record and examine activity in all information systems that contain or use electronic protected health information;
  • Reviewing and revising, if necessary, written policies and procedures to comply with the HIPAA Privacy and Security Rules;
  • Providing training to its workforce on HIPAA policies and procedures; and
  • Submit to monitoring of its compliance by OCR for two years.

Covered Entities Urged To Protect EPHI From Internal & External Security Threats

The Montefiore breach illustrates both how cyber criminals and thieves frequently target EPHI held by Covered Entities for criminal purposes and reminds Covered Entities that these breaches often are committed or facilitated by employees or other insiders of their own or a business associate’s organization. The $4,750,000 settlement paid by Montefiore Medical Center demonstrates the significant financial consequences that a Covered Entity is likely to incur if it experiences a breach as a result of its failure to adequately comply with HIPAA Security Rules from both external and internal threats.

To mitigate these risks, Covered Entities must be prepared to demonstrate their efforts to implement safeguards to mitigate or prevent cyber threats in accordance with the HIPAA Security Rule. In conducting these activities, Covered Entities should heed the clear warning from the Montefiore Medical Center breach and settlement that the Security Rule requires the protection of EPHI from a broad range of ever-evolving internal and external threats. While theft by a malicious insider definitely is one of these risks, cyberthreat and breach experiences within the health care and other industries as well as OCR’s enforcement, investigation and other guidance demonstrate that Covered Entities must be vigilant to monitor and manage a multitude of ever-changing risks. Covered Entities and their leaders must be prepared to demonstrate the adequacy of their ongoing efforts to identify and manage these risks in compliance with the Security Rule.

As part of these efforts, OCR recommends that Covered Entities HIPAA Security and other cybersecurity defenses include, but not be limited to:

  • Reviewing all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident reporting obligations.
  • Integrating risk analysis and risk management into business processes; and ensuring that they are conducted regularly, especially when new technologies and business operations are planned. Ensuring audit controls are in place to record and examine information system activity.
  • Implementing regular review of information system activity.
  • Utilizing multi-factor authentication to ensure only authorized users are accessing protected health information.
  • Encrypting protected health information to guard against unauthorized access.
  • Incorporating lessons learned from previous incidents into the overall security management process.
  • Providing training specific to organization and job responsibilities and on regular basis; and reinforcing workforce members’ critical role in protecting privacy and security.

Additionally, HIPAA entities and their leaders also should take steps to understand and fully address all other statutory, ethical, contractual or other privacy or confidentiality requirements beyond those imposed by HIPAA. For example, health care providers, health plans and their fiduciaries, brokers, administrators and insurers also may bear responsibilities under the Employee Retirement Income Security Act fiduciary responsibility rules, the Fair and Accurate Credit Transactions Act, federal and state electronic crimes and privacy laws. Publicly traded organizations and their leaders may face responsibilities and liability under new Securities and Exchange Commission regulations. The Employee Benefit Security Administration considers managing cybersecurity risks a part of the fiduciary obligations of fiduciaries of employment-based health plans. Meanwhile, health care providers, insurance organizations and brokers, third party administrators, government contractors, attorneys and other advisors and others also may be subject to medical confidentiality and other data privacy and security obligations under federal and state electronic crimes, identity theft, ethics, professional licensure, contractual, common law privacy and other statutory and common laws.

While it commonly is necessary or advisable to involve consulting or other technical support in the conduct of these activities, HIPAA entities should keep in mind the likelihood that their analysis and review is likely to uncover and prompt discussion of potentially legally or politically sensitive information. For this reason, HIPAA entities and their leaders generally will want to engage experienced legal counsel for assistance in structuring and executing these activities to maximize their ability to claim attorney-client privilege or other evidentiary protections against discovery or disclosure of certain aspects of these activities.

In planning for an implementing these procedures, Covered Entities also are reminded that the effectiveness of these efforts requires that the Covered Entities incorporate appropriate processes and policies for monitoring and investigating compliance with the policies and procedures implemented to comply with HIPAA. Conducting this monitoring and investigation by necessity is likely to involve surveillance, investigation and cooperation of employees, contractors, vendors and others for which Fair Credit Reporting Act background check notification and consent and other procedures are necessary or advisable. 

Finally, HIPAA entities should keep in mind that HIPAA and other cybersecurity compliance and risk management is an ongoing process requiring constant awareness and diligence.  Consequently, HIPAA entities should both monitor OCR and other regulatory and enforcement developments as well as exercise ongoing vigilance to monitor and maintain compliance within their organizations.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations GroupHR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™


Health Care Facilities Should Ensure Their Patient, Employment and Other Operational Defensibility Against Religious Discrimination Charges Amid Rising Risks

February 3, 2024

Hospitals, long term care facilities and other facilities funded by the Department of Health and Human Services (HHS) should audit and tighten their visitation, employment and other policies, oversight and training about federal prohibitions against religious or other discrimination in response to guidance issued by the HHS Office of Civil Rights (OCR) on January 25, 2024 and other developments signaling heightened exposures to religious discrimination liabilities and enforcement.

The January 25, 2024 guidance titled FAQs on Patient Visitation at Certain Federally Funded Entities and Facilities (FAQ) reiterates that hospital, long-term care and other facilities receiving funding under HHS-regulated programs must have and enforce written policies to prohibit and ensure their facility visitation policies do not discriminate based on religion or other prohibited grounds at all times including during a public health emergency. Part of a series of recent guidance and other actions by HHS demonstrating its commitment to enforce federal civil rights religious and other discrimination prohibitions, the FAQ warns covered facilities and providers to ensure their ability to defend their facilities’ compliance with these and other federal civil rights laws and regulations.

Section 1557 & Other Rules Prohibit Religious & Other Discrimination

CMS regulations generally prohibit hospitals, long term care facilities, and critical access hospitals from restricting, limiting, or otherwise denying visitation privileges based on race, color, national origin, religion, sex, gender identity, sexual orientation, or disability and require these facilities have written visitation policies, procedures, and practices regarding such prohibitions. These and other civil rights prohibitions generally apply to facilities receiving funding from HHS adminstered programs including:

  • Hospitals and health clinics
  • Medicaid and Medicare agencies
  • Alcohol and drug treatment centers
  • Extended care facilities
  • Public assistance programs
  • Nursing homes
  • Adoption agencies and
  • Day care, mental health and senior citizen center

Additionally, other federal civil rights laws also prohibit discrimination based on race, color, national origin, sex (including sexual orientation and gender identity), age, and disability in certain federally funded programs.

HHS OCR January 25 Warning Against Facilities Visitation Religious Discrimination

OCR published the January 25, 2024 FAQ in response to directives announced in the Biden-Harris Administration’s recently announced U.S. National Strategy to Counter Antisemitism.  The FAQ reminds covered facilities OCR enforces CMS regulations prohibiting religious and other discrimination and provides examples of the following “concerning” fact patterns where OCR feels facilities need to use extra care to ensure adequate consideration of the religious needs of patients and other individuals when implementing visitation policies and procedures.

  • Hospitals prevented family members from bringing patients Kosher food or halal food that met the patient’s religious dietary restrictions while allowing other visitors to bring patients food items.
  • Members of certain religious groups were subjected to more rigorous screening processes and/or denied opportunities for visitation based on the patient’s and/or visitor’s religious affiliation.   
  • Hospitals adopted policies during the COVID-19 pandemic that allowed patients to visit with family members or friends but prohibited them from visiting with clergy. 

This guidance also contains information OCR intends to help covered facilities and entities effectively communicate with patients and others regarding their visitation policies, procedures, and practices.

Previous HHS OCR Religious Discrimination Enforcement

The January 25, 2024 FAQ is not the first time OCR has warned HHS-funded and regulated health care and other facilities against discriminatory facilities access policies or actions. 

During the COVID-19 Pandemic emergency, OCR published OCR’s policies for protecting conscience and religious freedom during COVID-19. In addition, on December, 26, 2020, for instance, OCR warned facilities against religious discrimination when it announced its resolution of a religious discrimination complaint against Mt. Sinai Health System in New York (Mt. Sinai) that required Mt. Sinai to ensure clergy access to patients for religious purposes during the COVID-19 pandemic systemwide.

The Ms. Sinai resolution agreement resulted after OCR investigated an August 5, 2020 complaint filed by a Jewish community advocacy organization that alleged that several hospitals in various hospital systems in New York, including Mt. Sinai in Manhattan, were denying Jewish patients access to clergy and engaging in other discrimination in both COVID and non-COVID units.

In one instance at Mt. Sinai, the complaint alleged that when a Jewish patient asked for his rabbi to visit to assist in the location of Kosher food that the patient had been unable to access at the facility, hospital staff told the patient that his rabbi could not visit due to concerns about COVID-19.

The complaint also alleged Mt. Sinai denied another Jewish patient access to a spiritual care volunteer when she requested a spiritual care volunteer after giving birth to a stillborn baby. The organization explained to OCR that religious visitation was important to their community because rabbis provide assistance with prayer rituals, including end-of-life rituals; spiritual comfort; translation services for those members of their community who do not speak English; and with other needs specific to their faith tradition.

According to OCR, its Conscience and Religious Freedom Division (CRFD) responded by offering Mt. Sinai technical assistance accepted by Mt. Sinai to ensure that its visitation policy was consistent with best practices under federal guidance, which Mt. Sinai accepted. This acceptance of technical assistance likely played a big role in Mt. Sinai’s avoidance of penalties based on the complaint.

In response to this technical assistance, Ms. Sinai reportedly updated its visitation policies to address identified religious discrimination concerns. The updated Mt. Sinai visitation policy applies to all seven of its hospital locations, including Mt. Sinai Hospital in Manhattan.

Under the updated visitation policy, visiting clergy are to comply with the safety policies in place, which include COVID-19 screening, proper use of hand sanitizer and hand washing, and wearing of an approved face mask.  Visitors also continue to be required to visit during designated hours, unless an exception, such as an imminent end-of-life situation, applies. Mt. Sinai clarified that, although its visitation policy did not say so explicitly, one of the two visitors permitted to visit a patient each day could be a clergy member. Mt. Sinai then updated its visitation policy to include that clarification. Additionally, the updated visitation policy now includes an exemption to out of state quarantine requirements for end-of-life visitations provided that proper precautions are taken, which allows clergy to be with patients in imminent end-of-life circumstances, even if they travel to Mt. Sinai from out of state.

In announcing the resolution, then Director of OCR Roger Severino, commended Mt. Sinai Health System for modifying its policy to clarify that patients can receive safe clergy access for religious purposes during the COVID-19 pandemic, concluding, “We applaud the hospital for ensuring that it will treat the needs of the body without sacrificing the needs of the soul.”

In addition to these and other guidance and enforcement activities, HHS has engaged in a number of other actions to combat religious discrimination over the past several months. For instance, HHS:

  • Offers training on HHS’s antidiscrimination laws to medical schools nationwide to train future health care providers;
  • Offers support for Holocaust survivors by helping to ensure they receive person-centered trauma care through the Administration for Community Living;
  • Holds listening sessions with Jewish and Muslim chaplains on religious discrimination in healthcare settings to promote increased cultural and religious competence in healthcare settings, including through multifaith partnerships;
  • Issued a toolkit of resources for those working with and supporting individuals and communities emotionally impacted by the recent escalation of conflict between Israel and Hamas created by Substance Abuse and Mental Health Services Administration (SAMHSA);
  • Joined numerous other agencies in marking International Holocaust Remembrance Day on January 27, 2024; and
  • Launched a digital campaign led by members of the President’s Council on Sports, Fitness & Nutrition to encourage the public to share personal stories of how activities like sports or cooking have promoted connection, inclusion, and cross-community solidarity.

OCR also has taken specific steps to prevent and punish antisemitic, Islamophobic, and related forms of discrimination and bias as prohibited discrimination based on ancestry or national origin. In September, 2023, for instance, HHS joined seven other federal agencies in clarifying, for the first time in writing, that Title VI of the Civil Rights Act of 1964 prohibits discrimination based on shared ancestry or ethnic characteristics, including certain forms of antisemitic, Islamophobic, and related forms of discrimination and bias, in federally funded programs and activities. HHS continues to take other steps to raise awareness of Title VI and other civil rights laws—both among entities that are prohibited from discriminating in these ways, and by informing communities of their rights to be free from discrimination. For example, HHS translated its information about Title VI into Arabic, Hebrew, Punjabi, Spanish, Urdu, and Yiddish.

Facilities & Other Organizations Also Face Rising Employment Religious Discrimination Risks

Religious discrimination in facilities access is not the only religious discrimination concern impacting health industry and other businesses. Title VII of the Civil Rights Act of 1964 prohibits discrimination based on religion and requires employers to reasonably accommodate an employee’s religious observance or practice, unless an accommodation would impose an undue hardship. The Civil Rights Act prohibits discrimination in any aspect of employment, including hiring, firing, pay, job assignments, promotions, layoff, training, fringe benefits, and any other term or condition of employment. It also prohibits:

  • Forcing an employee to participate (or not participate) in a religious activity as a condition of employment;
  • Subjecting an applicant or employee to offensive remarks about a person’s religious beliefs or practice or other harassment that creates a hostile or offensive work environment or results in an adverse employment decision or other job detriment or certain other types of harassment, whether by the victim’s supervisor, a supervisor in another area, a co-worker, or someone who is not an employee of the employer, such as a client or customer;
  • Workplace or job segregation based on religion including religious garb and grooming practices;
  • Failing to reasonably accommodate an employee’s religious beliefs or practices, unless doing so would cause a burden that is substantial in the overall context of the employer’s business taking into account all relevant factors, including the particular accommodation at issue and its practical impact in light of the nature, size, and operating cost of the employer; and
  • Retaliating against an employee or applicant based on good faith exercise of his right to be free from religious discrimination or cooperation in investigations or other protected activities.

The duty to provide religious accommodation applies not only to schedule changes or leave for religious observances, but also to such things as dress or grooming practices that an employee follows as part of the employee’s religious reasons such as wearing particular head coverings or other religious dress or hairstyles or facial hair. It also includes an employee’s observance of a religious prohibition against wearing certain garments such as pants or miniskirts. 

Under the Civil Rights Act, the obligation to provide religious accommodation generally applies unless the employer demonstrate that the accommodation of the employee’s religious beliefs or practices would cause undue hardship to the employer. The burden of proving an undue hardship rests on the employer, who must show that the accommodation burden is substantial in the overall context of an employer’s business, taking into account all relevant factors in the case at hand, including the particular accommodation at issue and its practical impact in light of the nature, size and operating cost of the employer. The Supreme Court’s 2023 decision in Groff v. DeJoy, 143 S. Ct. 2279 (2023), makes clear that employers should not expect to meet this burden unless more than a “de minimis cost” or other burden is proven. Rather, employers denying a request for religious accommodation must be prepared to produce evidence proving the accommodation burden “is substantial in the overall context of an employer’s business” “taking into account all relevant factors in the case at hand, including the particular accommodations at issue and their practical impact in light of the nature, size and operating cost of an employer.” Id. See also EEOC Notice Concerning the Undue Hardship Standard in Title VII Religious Accommodation Cases.

The EEOC’s lawsuit and resulting recently announced settlement with Blackwell Security Services, Inc. (Blackwell) is illustrative of one common scenario in which these religious discrimination cases often arises. On January 31, 2024, the EEOC announced Blackwell Security Services, Inc. will pay $70,000 and provide other relief to settle the EEOC’s religious discrimination lawsuit that charged Blackwell wrongfully refused to accommodate a Muslim employee’s religious practice of wearing a beard in observance of his religious beliefs. Shortly after Blackwell hired the employee, the EEOC alleged that a Blackwell supervisor told the employee company policy required all employees be clean-shaven. When the employee requested an exemption from the policy to accommodate his religious practice, Blackwell told him to shave his beard or be terminated even though the EEOC determined accommodating his religious practice would impose no cost or operational burden on the business. To avoid losing his job, the employee complied and shaved his beard, causing him significant distress. Under the consent decree resolving the EEOC lawsuit, Blackwell will pay $70,000 in compensation to the now-former employee. Blackwell will also provide training to relevant management employees on federal laws prohibiting religious discrimination and will report any additional complaints of religious discrimination to the EEOC for the decree’s duration.

The EEOC charge and lawsuit against Blackwell is one of a deluge of religious discrimination charges filed with the EEOC in recent years. In fact, EEOC enforcement data shows that religious discrimination charges received by the EEOC soared from 2,111 in 2021 to 13,814 in 2022 while over the same period settlements rose from 146 in 2021 to 730 in 2022.

Religion-Based Charges (Charges filed with EEOC) FY 2013 – FY 2022
 FY 2013FY 2014FY 2015FY 2016FY 2017FY 2018FY 2019FY 2020FY 2021FY 2022*
Receipts3,7213,5493,5023,8253,4362,8592,7252,4042,11113,814
Resolutions3,8653,5753,7363,8273,9973,6533,0012,5702,0807,453
Settlements331268275266233151171144146730
Reasonable Cause1681161391211192821231035960
Monetary Benefits (Millions)**$11.2$8.7$10.8$10.1$11.2%$9.2$9.9$6.1$9.5$12.8
The chart represents the total number of charges filed and resolved under Title VII alleging religion-based discrimination as compiled by the Office of Enterprise Data and Analytics from data compiled from the EEOC’s Integrated Mission System.  This does not include charges filed with state or local Fair Employment Practices Agencies.  *EEOC notes, “In FY 2022, there was a significant increase in vaccine-related charges filed on the basis of religion. As a result, FY 2022 data may vary compared to previous years.”  ** Does not include monetary benefits obtained through litigation. See https://www.eeoc.gov/data/religion-based-charges-charges-filed-eeoc-fy-1997-fy-2022.

The New EEOC religious accommodation guidance issued during the COVID-19 pandemic health care emergency and demands for religious accommodation exemptions to COVID-19 mask and vaccination mandates heightened religious accommodation claims by the EEOC. Unsurprisingly, charges from these COVID-19 related and other religious accommodation claims brought since the COVID-19 pandemic health care emergency has and continues to fuel litigation, settlements and judgements. See, e.g., Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit.

Furthermore, these religious sensitivities in many instances could be further heightened by the newly emerging religious and personal sensitivities, EEOC and other governmental outreach and widespread media coverage arising around religious and national origin discrimination concerns arising in relation to the latest Israeli/Palestinian conflict. See, e.g., Resolution of the U.S. Equal Employment Opportunity Commission Condemning Violence, Harassment, and Bias Against Jewish Persons in the United States; What to Do If You Face Antisemitism at Work; Anti-Arab, Anti-Middle Eastern, Anti-Muslim, and Antisemitic Discrimination are Illegal; Religious Garb and Grooming in the Workplace: Rights and Responsibilities; Fact Sheet on Religious Garb and Grooming in the Workplace: Rights and ResponsibilitiesEmployment Discrimination Based on Religion, Ethnicity, or Country of Origin; Q&A for Employees: Responsibilities Concerning the Employment of Individuals Who Are, or Are Perceived to Be, Muslim or Middle Eastern; Q&A for Employers: Responsibilities Concerning the Employment of Individuals Who Are, or Are Perceived to Be, Muslim or Middle Eastern. With these and other events continuing to escalate sensitivities and awareness of federal laws against religious discrimination, health care and other organizations should act to strengthen their ability to recognize and respond defensibly to religious accommodation and other religious discrimination risks whether arising from patients and other customers, employees or others.

Act To Mitigate Religious Discrimination Risks

In the face of the prioritization that the Biden Administration generally and OCR specifically is placing on religious and national origin in connection with the current Israeli-Palestinian hostilities, all covered facilities should brace for heightened oversight and enforcement by OCR the EEOC and other federal agencies, as well as private litigants. These organizations also should guard against retaliation liability, which can result even where the discrimination claim fails.

As a starting point, health care and other organizations should begin by reviewing their existing complaint history, policies, practices, training, reporting and investigation practices within the scope of attorney-client privilege and revise these policies as needed to strengthen their defensibility.

In connection with this review, health care and other organizations should ensure that their policies, procedures and notices clearly prohibit religious discrimination as well as communicate procedures for persons that believe their religious beliefs merit accommodation or otherwise believe they are subject to religious harassment or other discrimination to communicate their request to a representative of the organization appropriately trained to receive, evaluate and respond to the accommodation request defensibly. Most organizations will want to arrange for qualified legal counsel to be readily available to assist the responsible party with these activities. 

Organizations should consider adopting carefully crafted and documented internal procedures for receiving, investigating and responding to religious accommodation request in a manner that promotes their organization’s ability to demonstrate each request is assessed in accordance with the law free from the inappropriate application of assumptions or stereotypes about what constitutes a religious belief or practice or what type of accommodation is appropriate. Organizations should train managers and supervisors to grant religious accommodation requests whenever possible and to refer any questions about the appropriateness or response to any religious accommodation request to the designated responsible party.

When faced with a request for a religious accommodation which the organization believes cannot be implemented without undue hardship, most organizations will want to seek the advice of legal counsel while exploring opportunities to allow the requested or an alternative accommodation on a temporary basis pending further exploration of the requested more permanent accommodation. Appropriate communication and documentation processes also are important. In addition, all organizations will want to ensure that their organization takes appropriate steps to prevent and defend against potential retaliation claims.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations GroupHR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™