An RSS Feed from melniklegal.com melniklegal.com Blog http://melniklegal.com/programs/weblog.cgi e-commerce Copyright melniklegal.com en-us Sun, 11 Oct 2026 19:10:17 EST tatiana@melniklegal.com (Web Master) Sun, 11 Oct 2026 19:10:17 EST tatiana@melniklegal.com (Tatiana) e-commerce-inc.com sitebuilder blog press <![CDATA[Throwing Medical Records into a Recycling Container is Not Proper Disposal]]>

Oregon Fines a Medical Clinic for Violating the State's ID Theft Law - The Oregon Department of Consumer and Business Services announced on November 1, 2013 that it fined Samaritan Health Services, Inc., a regional health system, $5,000 (reduced to $1,000) for violating Oregon's identity theft law by improperly discarding business records and patient files with patient names and social security numbers. A patient discovered approximately 1,222 patient files in an unlocked recycling container outside of Samaritan's Family Medicine Clinic in Corvallis, Oregon in July 2013. Of the 1,222 about 20 files included patient names and unredacted social security numbers. [1] The Oregon Department learned of the incident from the press. [2]

[Jump to Take-a-Ways]

Samaritan "operates a non-profit network of hospitals, physician clinics, health plans, and senior care facilities in Albany, Corvallis, Lebanon, Lincoln City, Newport, and Sweet Home, Oregon." [3]

The action was based on the Oregon Consumer Identity Theft Protection Act (ORS 646A.600) ("ID Theft Law"), which, among other things, requires companies to notify consumers in the event of a data breach,  permits impacted consumers to put a security freeze on their credit report, prohibits companies from printing and otherwise displaying social security numbers, and requires companies to develop, implement and maintain reasonable safeguards to protect personally identifiable information. The Act also provides that violators may be subject to a civil penalty of not more than $1,000 for every violation.

Samaritan was charged with violating several sections of the ID Theft Law for improper disposal of the records and ordered to pay a civil penalty of $5,000 "for publicly posting, displaying or otherwise making available to the public, files bearing consumer names and unredacted Social Security numbers in violation of ORS 646A.620 (1)(c)." [4]

But, Patrick M. Allen, Director of the Department, agreed to suspend $4,000 of the $5,000 penalty provided that Samaritan "complies with all terms and conditions set out in this Consent Order and commits no new violations of the Identity Theft law, ORS chapter 646A, or Oregon Administrative Rules chapter 441, division 646" for five years.


  • The Oregon action serves to remind healthcare providers and those that manage protected health information (PHI) that, when disposing of records containing patient data, they must comply with both HIPAA and state data disposal laws. As of December 2013, at least 30 states have enacted laws setting forth disposal requirements for business records that contain personally identifying information. [5]
  • The Oregon Consumer Identity Theft Protection Act may be changing. Oregon House Bill 3411 proposed changes to a number of the sections including section 646A.622, which addresses the requirement to develop safeguards for personal information. But, entities subject to HIPAA and the Gramm-Leach-Bliley Act are deemed to comply with section 646A.622 of the Oregon Act if they comply with the respective federal regulations. [6]
  • Identity theft continues to be of great concern to both state and federal regulators and this concern tends to drive enforcement activity. Healthcare providers and group practices are particularly attractive targets to thieves and fraudsters because these companies have access to a lot of personally identifying information (e.g., names, phone numbers, social security numbers, credit card numbers, etc.) and may not have the proper security measures in place. Providers should be particularly cognizant of these concerns and take appropriate steps to minimize risks to their patients. Proof of identity theft often fulfills the damages requirement in a data breach class action.
  • Training workforce members on the proper handling and disposal of patient records must be an ongoing effort. As of December 31, 2013, two of the top complaints received by the Office of Civil Rights, the federal enforcer of HIPAA, is impermissible uses and disclosures of PHI and lack of PHI safeguards. [7]
  • For many people, a report to the press is the first stop. Negative publicity can cause great damage the goodwill and the bottom line of an organization. Moreover, as clear from this incident, state regulators are paying attention to press reports. The Office of Civil Rights pays attention as well. For example, OCR entered into a settlement agreement with Shasta Regional Medical Center for $275,000 after OCR learned from media reports that senior leaders at the company met with members of the press to discuss medical services provided to a patient. "When senior level executives intentionally and repeatedly violate HIPAA by disclosing identifiable patient information, OCR will respond quickly and decisively to stop such behavior," said OCR Director Leon Rodriguez. [8]

------------------
[1] In re Samaritan Health Services, Oregon Department of Consumer and Business, Division of Finance and Corporate Securities, Consent Order No. 13-0570 (11/1/13) [hereinafter Consent Order].

[2] Bloomberg BNA Health Law Resource Center, Oregon Regulator Fines Health System
After Records Discovered in Recycling Bin, 22 HLR 1674 (Nov. 5, 2013) ("Diane Childs, a spokeswoman for the Division of Finance and Corporate Securities, told Bloomberg BNA Nov. 5 that the agency found out about the breach through an article in a local newspaper.")

[3] Consent Order at para. 1.

[4] Id. at para. 10.

[5] A list may be obtained from the National Conference of State Legislatures, https://www.ncsl.org/research/telecommunications-and-information-technology/data-disposal-laws.aspx (last visited Jan. 14, 2014).

[6] 77th Oregon Legislative Assembly, 2013 Regular Session, House Bill 3411 (Sponsored by Representative Gomberg, Representatives Boone, Gallegos, Lovely, and Senator Roblan.

[7] Office of Civil Rights, https://www.hhs.gov/ocr/privacy/hipaa/enforcement/highlights/ (last visited Jan. 14, 2014).

[8] Press Release, Office of Civil Rights, HHS Requires California Medical Center to Protect Patients’ Right to Privacy, June 13, 2013, https://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/shasta-agreement-press-release.html.
]]> http://melniklegal.com/weblog/1389717685_Data-Breach.html http://melniklegal.com/weblog/1389717685_Data-Breach.html Tue, 14 Jan 2014 11:41:25 EST <![CDATA[A Few Telemedicine Resources]]> Following the release of the Model Policy for the Appropriate Use of Telemedicine Technologies in the Practice of Medicine by the Federation of State Medical Boards in April 2014[1], the Center for Connected Health Policy (CCHP) and the American Telemedicine Association (ATA) released telemedicine reports, providing insights into the state of telemedicine adoption, reimbursement barriers and physician licensing requirements throughout the United States.

A few preliminary comments....These reports provide a great resource for those researching the regulatory environment surrounding telemedicine and telehealth. But, it is important to remember that the laws and policies in this area change frequently throughout the US. The three reports cover most of the same areas, although they are presented differently. The report from the Center for Connected Health sets out eleven policy areas that are generally crucial when providers are formulating a telemedicine based business model. The American Telemedicina Association reports provide some very helpful charts comparing the laws of the various states. It is also important to remember that other regulatory requirements impact the practice of telemedicine, such as state and federal data privacy and security laws as well as general medical practice requirements (e.g., record keeping).

If you have questions regarding any telemedicine related issues, please contact us today.


Center for Connected Health Policy Report on State Telehealth Policies and Reimbursement Schedules: A Comprehensive Plan of the 50 States and District of Columbia (Sept. 2014)[2]

In its second annual report, the CCHP looked at the Medicaid reimbursement policies and telemedicine laws in all 50 states. As CCHP notes, some "states have incorporated policies into law, while others have addressed issues such as definition, reimbursement policies, licensure requirements, and other important issues in their Medicaid Program Guidelines." This is a good reminder to those interested in operating in this space must take care to review all appropriate laws and guidance documents prior to starting their telemedicine based practice or otherwise offering healthcare services via telemedicine. For example, some technologies may seen appropriate until a board of medicine takes action against a provider. See e.g., Can Doctor’s Use Skype for Telemedicine? Not in Oklahoma.

CCHP observed the following major trends regarding reimbursement for live video, store-and-forward and remote patient monitoring:
  • In comparison to forty-four states last year, currently forty-six state Medicaid programs reimburse for some form of live video. Washington DC’s Medicaid program is also now required to reimburse for live video as a result of recent legislation.
  • Ten state Medicaid programs offer some reimbursement for store-and-forward (states that only reimbursed for tele-radiology are not included in this count).
  • Thirteen state Medicaid programs offer reimbursement for remote patient monitoring compared to ten states at the time this report was first published in 2013.
  • Three state Medicaid programs (Alaska, Minnesota and Mississippi) reimburse for all three.
In reviewing state telemedicine policies, the survey focused on eleven policy areas:
  • Definition of the term telemedicine/telehealth
  • Reimbursement for live video
  • Reimbursement for store-and-forward
  • Reimbursement for remote patient monitoring (RPM)
  • Reimbursement for email/phone/fax
  • Consent issues
  • Location of service provided
  • Reimbursement for transmission and/or facility fees
  • Online prescribing
  • Private payer laws
  • Cross-state licensure
These policy areas are important to understand when developing a telemedicine based practice, evaluating offering services to existing patients via telemedicine, or developing a telemedicine compliance program. Physicians and physician extenders (e.g., nurse practitioners, registered nurses, and others) who wish to practice across state lines must also pay close attention to the licensure requirements keeping in mind that the law is based on the physical location of the patient and not the provider.

American Telemedicine Association Report on Physician Practice Standards & Licensure [3]

This report evaluated the physician licensure laws in the states for both in-state and out-of state practice. The report also looked at the physician-patient encounter requirements when using telemedicine, telepresenter requirements that may be more stringent as compared to in-person services, and informed consent requirements. The report provides a summary chart grading each state on a A - F scale.

American Telemedicine Association Report on Coverage & Reimbursement [4]

Payment and coverage remains one of the biggest obstacles to the widespread adoption of telemedicine. In this report, the ATA "extracts and compares telemedicine coverage and reimbursement standards for every state in the U.S." Notably, as the ATA explained:
  • Of the 21 states that have telemedicine parity laws for private insurance, only 15 of them and D.C. scored the highest grades indicating policies that authorize state-wide coverage, without any provider or technology restrictions. Over half of the country, 29 states, ranked the lowest with failing scores for having no parity law in place.
  • Forty-seven state Medicaid programs have some type of coverage for telemedicine. Only five states and D.C. scored the highest grades by offering more comprehensive coverage, with few barriers for telemedicine-provided services . Connecticut, Hawaii, Idaho, Iowa, Nevada, Rhode Island, Utah and West Virginia ranked the lowest with failing scores in this area.
  • One disappointing observation includes the lack of coverage and reimbursement for telemedicine under state employee health plans. Eighty-two percent of the country is ranked the lowest with failing scores including Arkansas which will only cover the use of store-and-forward for diabetic retinopathy screening, and Nebraska which requires their plans to cover autism treatment via telemedicine.
  • Regarding Medicaid regulations, states are slowly moving away from the traditional hub-and-spoke model and allowing a variety of technology applications. Twenty-three states and D.C. do not specify a patient setting or patient location as a condition for payment of telemedicine. Aside from this, 21states recognize the home as an originating site, while 13 states recognize schools and/or school-based health centers as an originating site. Utah ranks the lowest with only one eligible originating site
  • South Dakota has the highest ranking for Medicaid operations because its program covers telemedicine when providers use interactive audio-video, store-and-forward, remote patient monitoring, e-mail, fax, or phone mail. Fifty-seven percent of the country ranked the lowest with failing scores either because they only cover synchronous only or provide no coverage for telemedicine at all. Idaho, Missouri, North Carolina and South Carolina prohibit the use of cell phone video to facilitate a telemedicine encounter.[5]

-------------------------------------------
[1] Federation of State Medical Boards, Model Policy for the Appropriate Use of Telemedicine Technologies in the Practice of Medicine (April 2014), available at https://www.fsmb.org/Media/Default/PDF/FSMB/Advocacy/FSMB_Telemedicine_Policy.pdf.

[2] Center for Connected Health Policy, State Telehealth Policies and Reimbursement Schedules: A Comprehensive Plan of the 50 States and District of Columbia (Sept. 2014), available at https://cchpca.org/sites/default/files/resources/Fifty%20State%20Medicaid%20Report.09.2014_1.pdf.

[3] American Telemedicine Association, Physician Practice Standards & Licensure (Sept. 2014), available at https://www.americantelemed.org/docs/default-source/policy/50-state-telemedicine-gaps-analysis--physician-practice-standards-licensure.pdf?sfvrsn=6.

[4] American Telemedicine Association, Coverage & Reimbursement (Sept. 2014), available at https://www.americantelemed.org/docs/default-source/policy/50-state-telemedicine-gaps-analysis---coverage-and-reimbursement.pdf?sfvrsn=6.

[5] Id. at 2-3.
-------------------------------------------

Posted by Tatiana Melnik on October 28, 2014.



]]> http://melniklegal.com/weblog/1414554679_Telemedicine.html http://melniklegal.com/weblog/1414554679_Telemedicine.html Tue, 28 Oct 2014 23:51:19 EST <![CDATA[Alabama Board of Optometry Makes Final a Rule on Telemedicine]]> The Alabama Board of Optometry recently made final a Rule on the "Practice of Optometry Through Telemedicine." In making this Rule final, it repealed the "Practice of Optometry Across State Line" Rule, which has been in place since 1998.

A few preliminary comments....Under the new Rule, a physician-patient relationship may be established through the use of telemedicine. But, patients must be present at an "Established Treatment Site" to receive services. The Rule defines "Established Treatment Site" as:
A location where a patient shall present to seek optometric care (through telemedicine). An established treatment site shall have an optometrist licensed by the Alabama Board of Optometry present on site during the provision of any telemedicine to a patient, and there must exist between said optometrist and patient an optometrist-patient relationship. There shall be sufficient equipment and technology present at any established treatment site to allow for an adequate physical evaluation as appropriate for the patient's presenting complaint. A patient's home is not considered an established treatment site.
The Rule also provides greater flexibility for the means of providing services via telemedicine as compared to other states. Under the Rule, "Telemedicine" is defined as:

(7) Telemedicine. As used in these regulations, a health service that is delivered by a licensed optometrist acting within the scope of his or her license and that requires the use of telecommunications technology other than telephone or facsimile. Telecommunications technology as used herein shall include, but not be limited to:

(a) compressed digital interactive video, audio, or data transmission;

(b) clinical data transmission using computer imaging by way of still image capture and store and forward;

(c) other technology that facilitates access to health care services or optometric specialty services.

Finally, the Rule also sets out security requirements for communicating with patients, including requiring that providers implement written policies and procedures. The security requirements cover "all patient communications through electronic mail," which includes "any type-written communication that is transferred via the Internet, telephone or cable line, or cellular telephone service, but shall not include facsimile, or 'fax' communications." The Rule enumerates a number of required policies and procedures that are not required under HIPAA and therefore not typically included in a HIPAA manual:
The written policies and procedures for such security measures for electronic mail shall address all of the following:

(1) Confidentiality and integrity of patient-identifiable information;

(2) The identity—by position or title—of health care personnel who will process or otherwise have access to information sent by electronic mail;

(3) Hours of operation and availability of the provider and distant site provider;

(4) Types of transaction which shall be permitted electronically;

(5) The type of information to be included in the communication, such as patient name, identification number, and type of transaction;

(6) How and when electronic mail will be archived and retrieved;

(7) Mechanisms for the oversight of the processing, handling, storage, and archival of electronic mail.

Alabama optometrists providing services via telemedicine must carefully review their existing policies and procedures and bring them in line with these new requirements.

This new Final Rule becomes effective on March 13, 2015



New Rule (scroll down for Rule that was repealed)

PUBLICATION DATE: 03/04/2015
ACTION DATE: 02/06/2015
EFFECTIVE DATE: 03/13/2015

ALABAMA BOARD OF OPTOMETRY
Chapter 630-X-13
Practice of Optometry Through Telemedicine (New Chapter)

Chapter 630 x 13
630 x 13.01 Definitions
630 x 13.02 Optometric Telemedicine
630 x 13.03 On-site Optometrist
630 x 13.04 Security Measures for Electronic Mail
630 x 13.05 Communication in Patient Records
630 x 13.06 Alternative Forms of Communication
630 x 13.07 Patient Records
630 x 13.08 Emergency Telemedicine

630 x 13.01 Definitions
 
   (1) Distant Site Provider. A provider of optometric services through telemedicine from a site other than the patient's then current location. A distant site provider shall hold an active Alabama optometry license as set out in § 34-22-20 and § 34-22-21 of the Alabama Code.

    (2) Emergency. A situation or condition where failure to provide immediate treatment poses a threat of loss of sight to a person. For the purposes hereof, routine visual care shall not be an emergency.

    (3) Established Treatment Site. A location where a patient shall present to seek optometric care (through telemedicine). An established treatment site shall have an optometrist licensed by the Alabama Board of Optometry present on site during the provision of any telemedicine to a patient, and there must exist between said optometrist and patient an optometrist-patient relationship. There shall be sufficient equipment and technology present at any established treatment site to allow for an adequate physical evaluation as appropriate for the patient's presenting complaint. A patient's home is not considered an established treatment site.

    (4) Face-to-face Visit. An evaluation or appointment for treatment at which both the provider and patient are at the same physical location, or where the patient is at an established treatment site and the provider is a distant site provider.

    (5) In-person Evaluation. A patient evaluation conducted by a provider who is at the same physical location as the location of the client.

    (6) Provider. As used in this chapter the term "provider" shall mean an optometrist holding an active license to practice optometry granted by the Alabama Board of Optometry in accordance with § 34-22-20 and § 34-22-21 of the Alabama Code.

    (7) Telemedicine. As used in these regulations, a health service that is delivered by a licensed optometrist acting within the scope of his or her license and that requires the use of telecommunications technology other than telephone or facsimile. Telecommunications technology as used herein shall include, but not be limited to:

(a) compressed digital interactive video, audio, or data transmission;

(b) clinical data transmission using computer imaging by way of still image capture and store and forward;

(c) other technology that facilitates access to health care services or optometric specialty services.

630 x 13.02 Optometric Telemedicine

   (1) The provision of optometric diagnosis, treatment, or other services to a patient through telemedicine at an established treatment site may be used for all patient visits, including initial evaluations to establish an optometrist-patient relationship between a provider and a patient.

   (2) A distant site provider who provides telemedicine services to a patient that is not present at an established treatment site shall ensure that a proper provider-patient relationship is established, which shall include at least the following:

(a) Having had at least one face-to-face meeting, either In person, or at an established treatment site via telecommunications technology as set out in 630 x 13.01 (7);

(b) Confirming the identity of the person requesting treatment by establishing that the person requesting the treatment Is in fact whom he or she claims to be.

   (3) Evaluation, treatment, and consultation recommendations made via telemedicine, including, but not limited to the issuance of prescriptions, shall be held to the same standards of practice as those in traditional in-person clinical settings. The provision of optometric diagnosis, treatment, or other services through telemedicine shall comply with the requirements of the Alabama Code, this chapter, ana these regulations. Failure to comply with such requirements shall be considered a failure to meet standard of care as required by 630-X-12-.06 herein.

   (4) Distant site providers shall obtain an adequate and complete medical history for the patient before providing treatment and shall document the medical history In the patient record.

630 x 13.03 On-site Optometrist

A provider may delegate tasks and activities at an established treatment site to an assistant who Is properly trained, supervised, and directed. There shall be, however, an Alabama-licensed optometrist present and available to assist with the provision of care at any established treatment site during the provision of optometric telemedicine.

630 x 13.04 Security Measures for Electronic Mail

Adequate measures shall be taken to ensure the security of all patient communications through electronic mail, and that said information remains confidential. Electronic mail includes any type-written communication that is transferred via the Internet, telephone or cable line, or cellular telephone service, but shall not include facsimile, or "fax" communications. Providers of optometric telemedicine shall, prior to providing optometric telemedicine services, establish and adopt written policies and procedures to ensure the security of patient communications, recordings, and records transferred by electronic mail. Policies shall be evaluated periodically so that they remain up-to-date. The written policies and procedures for such security measures for electronic mail shall address all of the following:

(1) Confidentiality and integrity of patient-identifiable information;

(2) The identity—by position or title—of health care personnel who will process or otherwise have access to information sent by electronic mail;

(3) Hours of operation and availability of the provider and distant site provider;

(4) Types of transaction which shall be permitted electronically;

(5) The type of information to be included in the communication, such as patient name, identification number, and type of transaction;

(6) How and when electronic mail will be archived and retrieved;

(7) Mechanisms for the oversight of the processing, handling, storage, and archival of electronic mail.

630 x 13.05 Communication in Patient Records

All relevant provider-patient electronic communications, including recordings and electronic mail shall be stored and filed in or with the patient's record in addition to any other storage methods.

630 x 13.06 Alternative Forms of Communication

All patients who are served through optometric telemedicine shall be informed of alternative forms of contacting their provider for urgent matters. Conventional telephone numbers used by a provider for traditional on-site optometry shall be sufficient[.]

630 x 13.07 Patient Records

   (1) Patient records shall be maintained for all telemedicine services. The provider or distant site provider shall maintain the records created at any site where treatment or evaluation is provided.

   (2) Patient records shall include copies of all relevant patient-related electronic communications, including relevant provider-patient email, prescriptions, laboratory and rest results, evaluations and consultation, records of past care, medical histories, and instructions. If possible, telemedicine encounters that are recorded electronically shall also be included in the patient record. Where means of storage will not allow for the storage of electronically recorded encounters with or in the patient record, the patient record shall include a notation or entry that the recording exists and the location and means of storage of such recording.

630 x 13.08 Emergency Telemedicine

   (1) An optometrist who is licensed by another state to practice optometry, but who is not licensed in the state of Alabama pursuant to §§ 34-22-20 or 34-22-21, who utilizes telemedicine to provide optometric services in the state of Alabama from a distant site outside of the state of Alabama during a state of emergency is not subject to the requirements of this article. For the purposes of this section 13.08(1), a state of emergency means a natural or man-made disaster for which the Governor of the State of Alabama has declared or proclaimed a state of emergency or where the President of the United States has declared a disaster in accordance with the Disaster Relief and Emergency Assistance Act of 1988 as amended. For the exemption contained in this section to apply, the patient receiving telemedicine services from the distant site must be located within the geographical boundaries established In the governor's declaration of a state of emergency or the president's disaster declaration.

   (2) A provider who is contacted in an emergency shall not be subject to the notice and security provisions of this article, the provisions of this section 13.08(2) shall not apply to any non-emergency optometric services provided to the patient as a continuation of treatment initiated in the emergency or for a different condition or issue which arises later. For the purposes of this section 13.08(2), an emergency shall have the meaning and definition set out in section 13.01(2) above.

Author: Dr. Fred Wallace
Statutory Authority: Code of Ala., 1975, §34-22-80 through 87.
History: New Rule: Filed February 6, 2015; effective March 13, 2015 .



Old Rule
Alabama Board of Optometry
Chapter 630-X-13
Practice of Optometry Across State Lines (Repealed)

630-X-13-.01 Definition Of Distance-Based Optometrist
630-X-13-.02 Definition Of Alabama Patient
630-X-13-.03 Definition Of The Practice Of Optometry Across State Lines
630-X-13-.04 Special Purpose License To Practice Optometry Across State Lines
630-X-13-.05 Issuance Of Certificate Of Qualification
630-X-13-.06 Issuance Of Special Purpose License To Practice Optometry Across State Lines
630-X-13-.07 Renewal Of Special Purpose License To Practice Optometry Across State Lines
630-X-13-.08 Revocation or Suspension Of Special Purpose License To Practice Optometry Across State Lines
630-X-13-.09 Exemptions
630-X-13-.10 Reciprocity

630-X-13-.01 Definition Of Distance-Based Optometrist
For the purpose of these regulations, a distance-based optometrist is defined as an optometrist located outside the boundaries of the State of Alabama who does not have a full, unrestricted and current license to practice optometry in Alabama.
History: Author, Dr. William Sullins; Filed December 11, 1998
630-X-13-.02 Definition Of Alabama Patient.
For the purposes of these regulations, an Alabama patient is an Individual whose physical location is within the boundaries of the State of Alabama.
History: Author, Dr. William Sullins; Filed December 11, 1998
630-X-13-.03 Definition of The Practice Of Optometry Across State Lines.
The practice of optometry across state lines means the examination of, or consultation regarding, an Alabama patient by a distance-based optometrist and shall include:
(1) The rendering by a distance-based optometrist of a professional opinion, either written or otherwise documented, concerning the diagnosis or treatment of an Alabama patient as a result of transmission of individual patient data by electronic or other means to such distance-based optometrist or his or her agent, or
(2) The rendering by a distance-based optometrist of treatment to an Alabama patient as a result of transmission of individual patient data by electronic or other means to such distance-based optometrist or his or her agent, but

(3) This definition shall not include an informal consultation regarding an Alabama patient between an Alabama licensed optometrist and a distance-based optometrist provided that the consultation does not result in either:

(a) compensation or the expectation of compensation by either optometrist, or

(b) the format rendering of a written or otherwise documented professional opinion concerning the diagnosis or treatment of said patient by the distance-based optometrist.

History: Author, Dr. William Sullins; Filed December 11, 1998

630-X-13-.04 Special Purpose License To Practice Optometry Across State Lines.


A special purpose license issued by the Alabama Board of Optometry shall be required for the practice of optometry across state lines in Alabama.

History: Author, Dr. William Sullins; Filed December 11, 1998

630-X-13-.05 Issuance Of Certificate Of Qualification.


An individual may apply to the Alabama Board of Optometry for the issuance of a certificate of qualification for a special purpose license to practice optometry across state lines. Such application shall be on a form provided by the Board upon request and shall include an application fee in the amount of $600.00. The Board shall issue such certificate of qualification providing the following requirements are met:

(1) The applicant holds a current full and unrestricted license to practice optometry in a state or territory of the United States.

(2) The applicant has no previous or pending disciplinary action or other action taken against the applicant by any state or other licensing jurisdiction, provided, however, that the Board may issue a certificate of qualification in such cases where the previous or pending disciplinary action or other action does not indicate that the applicant is a potential threat to the public.

(3) The applicant shall affirm his or her intent and willingness to report to the Alabama Board of Optometry in writing the initiation of any disciplinary action against him or her by any state or territory in which he or she is licensed. Said report shall be submitted to the Alabama Board of Optometry within 15 days of the Initiation of such disciplinary action.

History; Author, Dr. William Sullins; Filed December 11, 1998. Amended effective February 20, 2008.

630-X-13-.06 Issuance OF Special Purpose License to Practice Optometry Across State Lines.


The Alabama Board of Optometry shall issue a special purpose license to practice optometry across state lines upon presentation by a distance-based optometrist of a certificate of qualification issued by the Alabama Board of Optometry in accordance with this chapter. Special purpose licenses to practice across state lines limit the holders thereof solely to the practice of optometry across state lines as defined herein and does not confer the authority to practice optometry while said licensee is within the physical boundaries of the state of Alabama.

History: Author, Dr. William Sullins; Filed December 11, 1998

630-X-13-.07 Renewal Of Special Purpose License To Practice Optometry Across State Lines.

The special purpose license to practice optometry across state lines is valid for a period of three years. Such special purpose license may be renewed for additional three year terms upon receipt of a renewal fee of $260.00.

History: Author, Dr. William Sullins; Filed December 11, 1998. Amended effective February 20, 2008.

630-X-13-.08 Revocation Or Suspension of Special Purpose License To Practice Optometry Across State Lines.

(1) A special purpose license to practice optometry across state lines may be revoked or suspended, or other disciplinary action may be imposed, by the Alabama Board of Optometry for any of the following causes:

(a) Failure to renew special purpose license according to the renewal schedule established by the Board shall result in the automatic revocation of said license.

(b) Failure to comply with rules and regulations of the Alabama Board of Optometry shall be cause for the Board to initiate disciplinary actions as set forth in Sections 34-22-1 to 34-22-43, inclusive, Code of Alabama 1975,

(c) Failure to comply with rules and regulations governing optometrists in any other state or territorial licensing jurisdiction in which the licensee holds a license to practice optometry shall be cause for the Board to initiate disciplinary actions in Alabama and to impose the same discipline it would have imposed had the violation been committed by an Alabama licensee in the course of practice in Alabama.

(2) The Alabama Board of Optometry is authorized to temporarily suspend a special purpose license to practice optometry across state lines without a hearing on either of the following grounds:

(a) The failure of the licensee to appear or produce records or materials as requested by the Board.

(b) The initiation of a disciplinary action against the licensee by any state or territorial licensing jurisdiction in which the licensee holds a license to practice optometry. The temporary suspension provided hereby shall remain in effect until the temporary suspension is terminated by written order of the Alabama Board of Optometry, finding that any violation of the rules or regulations governing optometrists committed by the licensee, or any failure by the licensee to honor requests of the Board, does not indicate that the licensee is a potential threat to the public.

History: Author, Dr. William Sullins; Filed December 11, 1998

630-X-13-.09 Exemptions.

  (1) A distance-based optometrist who engages in the practice of optometry across state lines in an emergency, is not subject to this rule.

  (2) A distance-based optometrist who engages in the practice of optometry across state lines on an irregular or infrequent basis is not subject to this rule. Irregular or infrequent practice of optometry across state lines is defined as such practice involving fewer than 10 patients, occurring less than 10 times in a calendar year, or comprising less than one percent of the distance-based optometrist's diagnostic or therapeutic practice of optometry.

History: Author, Dr. William Sullins; Filed December 11, 1998. Amended effective February 20, 2008.

630-X-13-.10 Reciprocity.

Notwithstanding any provision of this regulation, the Board shall only issue a special purpose license to practice optometry across state lines to an applicant whose principal optometric practice location and license to practice optometry is located in a state or territory of the United States whose laws permit or allow for the issuance of a special purpose license to practice optometry across state lines or similar license to an optometrist whose principal practice location Is within the boundaries of the State of Alabama.

History: Author, Dr. William Sullins
Statutory Authority: Code of Ala., 1975, §34-22-80 through 87.
Filed December 11, 1998





-------------------------------------

Posted by Tatiana Melnik on March 9, 2015

 ]]> http://melniklegal.com/weblog/1425904258_Telemedicine.html http://melniklegal.com/weblog/1425904258_Telemedicine.html Mon, 09 Mar 2015 08:30:58 EST <![CDATA[Is Any Telemedicine Permitted in Florida?]]> The Florida legislature recently attempted to pass a telemedicine law, which would have significantly expanded the scope of permissible telemedicine in Florida. But, the bill (CS/SB 1646) died in appropriations on May 2, 2014.[1]

As part of that bill, the legislature prepared a "Bill Analysis and Fiscal Impact Statement," which included the following excerpt providing an overview of the current state of telemedicine in Florida.[2] (The footnotes have not been renumbered, but have been changed to L-, to designate them as the legislative footnotes.) As can be seen from the summary, compared to a number of other states, Florida is lagging behind in its coverage.

[Start of Excerpt]

Telemedicine Services in Florida

The University of Miami (UM) initiated telehealth services in 1973 and claims the first teleheath service in Florida, the first use of nurse practitioners in telemedicine in the nation, and the first telemedicine program in correctional facilities.[L-23] Today, UM has several initiatives in the areas of tele-dermatology, tele-trauma, humanitarian and disaster response relief telehealth, school telehealth services, and acute teleneurology or telestroke.[L-24] While some of the UM’s activities reach their local community, others reach outside of Florida including providing Haiti earthquake relief and teledermatology to cruise line employees. Telehealth communications are also used for monitoring patients in the hospital and conducting training exercises.

The UM also utilizes telemedicine to research the effectiveness of telemedicine in different trauma situations with the United States military. The research utilizes a robot which is operated from a control station using a joystick. The control station is on a laptop that allows the provider to operate the robot from any location with a wireless connection.[L-25] Lessons learned from this research are intended to provide assistance to deployed surgeons on the battlefield treating injured solders.

The UM along with other designated trauma centers participate in the Florida Emergency Trauma Telemedicine Network (FETTN). Coordinated by the department, the FETTN, facilitates the treatment of trauma patients between trauma centers and community or rural hospitals.[L-26] The FETTN allows for multiple interface options and currently 7 out of 25 trauma centers are part of the network.[L-27] In 2011-12, the seven Level 1 or Level 2 trauma centers that participated as a hub site, known as the location where the consulting physician is delivering the services, were Holmes Regional Medical Center, Tallahassee Memorial Hospital, Sacred Heart Hospital, University of Miami, Shands-Gainesville, Shands-Jacksvonille, and Orlando Health.[L-28]

According to the department, the trauma centers and their satellites as well as the rural hospitals that currently participate in the FETTN are not reimbursed for the consultation and treatment services provided within the telemedicine network.

Florida Medicaid Program
Florida’s Medicaid program reimburses for a limited number of telemedicine services by designated practitioners.[L-29] Audio only, email messages, facsimile transmissions, or communications with an enrollee through another mechanism other than the spoke site, known as the site where the patient is located, are not covered under Florida Medicaid.

Telemedicine is currently covered by Medicaid for the following services and settings:[L-30]
Behavioral Health
  • Tele-psychiatry services for psychiatric medication management by practitioners licensed under s. 458 or 459, F.S.
  • Tele-behavioral health services for individual and family behavioral health therapy services by qualified practitioners licensed under ch s.490 or 491, F.S.
Dental Services
  • Video conferencing between a registered dental hygienist employed by and under contract with a Medicaid-enrolled group provider and under the supervision of a supervising dentist.
  • Services include oral prophylaxis, topical fluoride, and oral hygiene instructions.
Physician Services
  • Services provided using audio and video equipment that allow for two-way, real time interactive communication between physician and patient.
  • State plan waiver specifically authorizes reimbursement for specialty physician services for Children’s Medical Services Network.
  • Physicians may bill for consultation services only provided via telemedicine.
The distant or hub site, where the provider is located, is eligible for reimbursement; the spoke site, where the patient is located, is not eligible for reimbursement unless a separate service is performed on the same day. Medicaid also requires that the referring physician and the patient be present during the consultation.[L-31]

Medicaid requires the following specific clinical records documentation to qualify for reimbursement as a telemedicine service:[L-32]
  • A brief explanation of why services were not provided face-to-face;
  • Documentation of telemedicine services, including results of assessment; and,
  • A signed statement from the patient (or parent or guardian, if a child), indicating their choice to receive services through telemedicine.
Medicaid services are reimbursable only in the hospital outpatient, inpatient and physician office settings. During the 2013 Legislative Session, Medicaid provider enrollment requirements were revised to allow the enrollment of physicians actively licensed in Florida to interpret diagnostic testing results through telecommunications and information technology provided from a distance.[L-33]

Since 2006, the Children’s Medical Services Network (CMS Network) has been authorized to provide specified telemedicine services under Florida’s 1915(b) Medicaid Managed Care waiver. Authorized services include physician office visits (evaluation and management services) and consultation services already covered by the Medicaid state plan in select rural counties. Currently, the CMS Network provides telemedicine services in 57 of Florida’s 67 counties.[L-34]

The CMS Networkworks with the University of Florida’s (UF) pediatric endocrinology staff to provide telehealth services for enrollees with diabetes and other endocrinology diseases in the Dayton a Beach service area.[L-35] Additional partnerships with the Institute for Child Health Policy at UF include referring children with special health care needs to community health centers for consults via telehealth for nutritional, neurological, and orthopedics in Southeast Florida.[L-36]

Child Protection Teams

The Child Protection Team (CPT) program under Children’s Medical Services utilizes a telemedicine network to perform child assessments. The CPT is a medically directed multi-disciplinary program that works with local Sheriff’s offices and the Department of Children and Families in cases of child abuse and neglect to supplement investigative activities.[L-37] The CPT patient is seen at a remote site and a registered nurse assists with the medical exam. A physician or Advanced Registered Nurse Practitioner (ARNP) is located at the hub site and has responsibility for directing the exam.

Hub sites are comprehensive medical facilities that offer a wide range of medical and interdisciplinary staff whereas the remote sites tend to be smaller facilities that may lack medical diversity. In 2013, CPT telehealth services were available at 14 sites and 437 children were provided medical or other assessments via telemedicine technology.[L-38]

Other Department of Health Initiatives
The department utilizes tele-radiology through the Tuberculosis(TB) Physician’s Network.[L-39] The ability to read electronic chest X-Rays remotely can lead to a faster diagnosis, treatment and a reduction in the spread of the disease, according to the department. This service is not currently reimbursed by Medicaid.

[End of Excerpt]

Related Posts
-----------------------------------
[1] Florida Senate, CS/SB 1646: Telemedicine, https://www.flsenate.gov/Session/Bill/2014/1646/?Tab=BillHistory.
[2] Florida Senate Health Policy Committee, Bill Analysis and Fiscal Impact Statement: Telemedicine, SB 1646 (Mar. 5, 2014) (analysis prepared by Jennifer Lloyd, Chief Legislative Analyst for the Senate Health Policy Committee) (pdf).

[L-23] University of Miami, Miller School of Medicine, UM Telehealth-Our History, https://telehealth.med.miami.edu/about-us/our-history (last visited Jan. 31, 2014).
[L-24] University of Miami, Miller School of Medicine, UM Telehealth, https://telehealth.med.miami.edu/featured/teledermatology (last visited Jan. 28, 2014).
[L-25] University of Miami, Miller School of Medicine, UM Telehealth-Teletrauma, https://telehealth.med.miami.edu/featured/teletrauma (last visited Jan. 31, 2014).
[L-26] Florida Department of Health, 2014 Agency Legislative Bill Analysis of SB 70, p.2, on file with the Senate Health Policy Committee (August 26, 2013).
[L-27] Id., at 3.
[L-28] Florida Department of Health, Long Range Program Plan (September 28, 2012), on file with the Senate Health Policy Committee.
[L-29] Agency for Health Care Administration, Highlights of Practitioner Services Coverage and Limitations Handbook Presentation, Bureau of Medicaid Services, Summer 2013, p.30.
[L-30] Agency for Health Care Administration, 2014 Legislative Bill Analysis of SB 70, November 7, 2013, p. 3, on file with the Senate Health Policy Committee.
[L-31] Agency for Health Care Administration, supra, note 29, at 34.
[L-32] Id. at p. 36.
[L-33] See Chapter 2013-150, L.O.F., sec. 1.
[L-34] Florida Department of Health, supra, note 28, at 2.
[L-35] Florida Department of Health, Maternal and Child Health Block Grant Narrative for 2013, https://www.floridahealth.gov/healthy-people-and-families/womens-health/pregnancy/mch-fl-2013-1narrative.pdf, p.21, (last visited: Jan. 31, 2014).
[L-36] Id.
[L-37] Florida Department of Health, Child Protection Teams, https://www.floridahealth.gov/AlternateSites/CMS-Kids/families/child_protection_safety/child_protection_teams.html (last visited Jan. 7, 2014).
[L-38] Florida Department of Health, supra note 35, at 21.
[L-39] Florida Department of Health, supra note 26, at 2.


Posted by Tatiana Melnik May 26, 2014.
]]> http://melniklegal.com/weblog/1401115424_Telemedicine.html http://melniklegal.com/weblog/1401115424_Telemedicine.html Mon, 26 May 2014 10:43:44 EST <![CDATA[FTC Targets a Medical Biller, Settles with Accretive Health for Privacy Violations]]> Accretive Health, Inc., a company providing medical billing and revenue management services to hospitals throughout the US. Accretive "has agreed to settle Federal Trade Commission charges that its inadequate data security measures unfairly exposed sensitive consumer information to the risk of theft or misuse." This settlement follows a settlement between Accretive and the Minnesota Attorney General for HIPAA violations.


Minnesota Action

The Accretive saga started in July 2011, when "an Accretive employee left an unencrypted laptop containing sensitive information on 23,500 Minnesota patients of two Minnesota hospital systems . . . in a rental car after 10 p.m." and the laptop was stolen. [1] (See my brief discussion of this case in the October issue of Nephrology News & Issues back in 2012 - "HIPAA: Privacy, Security & the Consequences of a Breach for Dialysis Providers - Part 2: Recommendations to Minimize Exposure to Data Breach-Related Liabilities" (PDF).) (According to the FTC Press Release, while there were 23,500 patients, the laptop contained 20 million pieces of information.)

The laptop contained sensitive patient information, including the patient’s name, address, date of birth, and Social Security number, as well as highly sensitive patient information, including "a checklist to denote whether the patient has 22 different chronic medical conditions and, if so, the condition of the patient [including] three mental health conditions (depression, bipolar disorder and schizophrenia) [and] HIV." [2]

The Minnesota State Attorney General was particularly concerned about Accretive's involvement in the revenue cycle, its "aggressive" debt collection practices, and lack of disclosure to patients. As the AG described: "Accretive has told Wall Street investors that its revenue cycle operations contract starts 'when a patient registers for future service or arrives at a hospital or clinic for an unscheduled visit' and ends when 'the hospital has collected all the appropriate revenue from all possible sources.' Through these contracts, Accretive controls the revenue functions of the hospitals, including front office (patient access), middle office (billing), and back office (collections) functions. It reports to Wall Street investors that it carries out these functions using 'data mining,' 'consumer behavior modeling,' and 'propensity to pay' algorithms."

The AG filed suit in the United States District Court in Minnesota, alleging that Accretive violated state and federal health privacy laws, state debt collection laws, and state consumer protection laws. The AG sought "It seeks an order requiring Accretive to fully disclose to [Minnesota] patients: (1) what information it has...; (2) what information it has lost...; (3) where and to whom it has sent information about [the] patients; [and] (4) the purposes for which it amasses and uses information about Minnesota patients."
A Few Highlights

- The matter came to light in 2011 when an unencrypted laptop containing detailed patient data was stolen out of an employee's car.

- As a result of this incident, Accretive was investigated by both the Minnesota Attorney General and the Federal Trade Commission.

- During the investigation, several practices came to light, including Accretive's lack of HIPAA compliance and its aggressive healthcare debt collection practices.

- The Minnesota AG brought an action pursuant to the HIPAA enforcement authority granted to AGs by the HITECH Act. Accretive is a business associate of a covered entity and, per the HITECH Act, direct enforcement against business associates is permitted.

- The Minnesota AG settled with Accretive in 2012. The settlement required Accretive to cease operations in Minnesota and banned the company from doing business in Minnesota for at least 2 years.

- The FTC brought an action based on Section 5 of the FTC Act, alleging that, Accretive Health created unnecessary risks of unauthorized access or theft of personal information.

- The FTC's action tracks the requirements of HIPAA, and sets forth additional requirements with respect to Accretive's subcontractors.

- The OCR is unlikely to take any action against Accretive.

The lawsuit also asked "Accretive to disclose whether it has sent health data about Minnesota patients to its so-called 'Shared Services Blended Shore Center of Excellence' in New Delhi, India."

Unlike previous State AGs that sought to take action against those who lost patient data, the Minnesota AG relied, at least in part, on the authority grated to state AGs by the HITECH Act to take enforcement action against covered entities and business associates that violated the HIPAA Privacy and Security Rules. [3] This case was also the first example of an enforcement action against a business associate.

The case came to end in July 2013, when Accretive settled wit the Minnesota AG. Compared to the settlements often entered into by the HHS Office of Civil Rights, the Minnesota AG settlement was relatively harsh. Under the settlement, Accretive agreed to "cease all operations in Minnesota within ... 90 days, or by November 1, 2012.  The company [was] then be subject to an outright ban on operating in Minnesota for two years, after which, for the next four years, it can only reenter the State if the Attorney General agrees to a Consent Order regarding its business practices in the State." [4]

The FTC Action

The FTC Action against Accretive stems from the same incident: the loss of the unencrypted laptop.

The FTC brought an action on its enforcement authority under the Section 5 of the FTC Act, prohibits "unfair or deceptive acts or practices in or affecting commerce." [5] In the Complaint, the FTC alleged the following violations:
Until at least July 2011, Accretive failed to provide reasonable and appropriate security for consumers' personal information it collected and maintained by engaging in a number of practices that, taken together, unreasonably and unnecessarily exposed consumers' personal data to unauthorized access. Among other things, Accretive Health created unnecessary risks of unauthorized access or theft of personal information by:
a. Transporting laptops containing personal information in a manner that made them vulnerable to theft or other misappropriation;

b. Failing to adequately restrict access to, or copying of, personal information based on an employee's need tor information;

c. Failing to ensure that employees removed information from their computers for which they no longer had a business need; and

d. Using consumers' personal information in training sessions with employees and failing to ensure that the information was removed from employees' computers following the training. [6]
The behaviors that the FTC identifies as creating "unnecessary risks of unauthorized access or theft" generally align with the types of behaviors that the Office of Civil Rights finds problematic.

Excerpts from the FTC Consent Order

In the Consent Order, the FTC sets forth a number of requires Accretive must undertake:
[E]stablish and implement, and thereafter maintain, or continue to maintain a comprehensive information security program reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. Such program ...shall contain administrative, technical, and physical safeguards appropriate to respondent's size and complexity, the nature and scope of respondent's activities, and the sensitivity of the personal infonnation collected from or about consumers, including:
(1) The designation of an employee or employees to coordinate and be accountable for the information security program;

(2) The identification of material internal and external risks to the security, confidentiality and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and the assessment of the sufficiency of any safeguards in place to control the risks. At a minimum, this risk assessment should include consideration of the risks in each relevant area of operations, including but not limited to: (a) employee training and management; (b) information systems, including network and software design, information processing, storage, transmission, and disposal; and (c) prevention, detection, and response to attacks, intrusions, and other system failures;

(3) The design and implementation of reasonable safeguards to control the risks identified through risk assessment and regular testing and monitoring of the effectiveness of the safeguards' key controls, systems, and procedures;

(4) The development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from respondent, and requiring service providers by contract to implement and maintain appropriate safeguards; and

(5) The evaluation and adjustment of the information security program in light of the results of the testing and monitoring required by [this Order], any material changes to operations or business arrangements, or any other circumstances that Defendant knows or has reason to know may have material impact on the effectiveness of the information security program. [7]
The FTC's consent order mirrors some of the HIPAA requirements, including, for example, undertaking a risk assessment, develop appropriate measures to address issues identified in the risk assessment, and designate a responsible individual. But, this Order also imposes additional requirements with respect to subcontractors that are beyond what is required by HIPAA, in that the Order requires for the "development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from" Accretive. Under HIPAA business associates are only required to obtain "reasonable assurances" in the form of a written agreement. As such, the FTC's language seems to suggest a requirement of more than a written agreement.

Like other FTC orders, this one too is in effect for a period of 20 years.

Where is the Office of Civil Rights?

The Office of Civil Rights (OCR) is unlikely to take any action against Accretive as a result of the data breach. Part of the reason that the HITECH Act specifically extended enforcement authority over business associates was to overcome an interpretation released by the Department of Justice many years ago that HHS lacked direct enforcement authority over business associates.

Leon Rodriguez, the Director of OCR, has previously stated that the OCR will not be taking enforcement actions against business associates until after HHS releases the revised HIPAA Rules (revised pursuant to HITECH) and the Rules come into effect. The HIPAA Omnibus Rule was not released until January 2013 and the compliance period came into effect in September 2013. But, the Accretive breach happened in July 2011. This may explain why the FTC Order tracks HIPAA so closely.


There are a number of legal take-a-ways from the FTC's latest action.
  • The FTC Consent Order requirements may track HIPAA requirements, including undertaking a risk assessment.
  • The FTC appears to be requiring Accretive to undertake some sort of vetting process of subcontractors to ensure that they are "capable of appropriately safeguarding personal information they receive from" Accretive, in addition to entering into business associate agreements.
  • In some respects, it would have been better for Accretive if it was OCR that brought an action because OCR's resolution agreements are generally for about 5 years. But, the FTC's agreement is for 20 years.
Similar to the recent action by OCR against Adult & Pediatric Dermatology, P.C., a dermatology practice delivering services in Massachusetts and New Hampshire, this is another breach that could have been avoided with the use of encryption on portable devices, including laptops. 

-----------------
[1] Press Release, Minnesota Attorney General, Attorney General Swanson Sues Accretive Health for Patient Privacy Violations: Debt Collector Lost Laptop Containing Sensitive Data on 23,500 Minnesota Patients, https://www.ag.state.mn.us/consumer/pressrelease/120119accretivehealth.asp (last visited Jan. 2, 2014).

[2] Id.

[3] Complaint, State of Minnesota by its Attorney General Lori Swanson v. Accretive Health, Inc., Civil File No. ___ (D. Minn. Jan. 19, 2012) ("Count 1: Violations of HIPAA. Accretive is business associate of both Fairview and North Memorial as defined in HIPAA. See, e.g., 45 C.F.R. § 160.103. Because HITECH Section 13401 (42U.S.C. § 17931) provides that 45 C.F.R. §§ 164.308, .310, .312 and .316 apply to a business associate of a covered entity in the same manner as they would to a covered entity, Accretive is thus subject to the security provisions contained within HIPAA as well as applicable civil and criminal penalties.")

[4] Press Release, Minnesota Attorney General, Attorney General Swanson Says Accretive Will Cease Operations in the State of Minnesota Under Settlement of Federal Lawsuit, Cannot Reenter Minnesota For Six Years Without Attorney General’s Agreement, https://www.ag.state.mn.us/consumer/pressrelease/07312012accretiveceaseoperations.asp (last visited Jan. 2, 2014).

[5] In the Matter of Accretive Health, Inc., FTC Complaint, Docket No. ___ (File. no. 122 3077) (Dec. 31, 2013), available at https://www.ftc.gov/enforcement/cases-and-proceedings/cases/122-3077/accretive-health-inc.

[6] Id. at para. 6

[7] In the Matter of Accretive Health, Inc., FTC Order, Docket No. ___ (File. no. 122 3077) (Dec. 31, 2013), available at https://www.ftc.gov/enforcement/cases-and-proceedings/cases/122-3077/accretive-health-inc.

FTC's Press Release - https://www.ftc.gov/news-events/press-releases/2013/12/accretive-health-settles-ftc-charges-it-failed-adequately-protect.
 
]]> http://melniklegal.com/weblog/1388685990_Privacy.html http://melniklegal.com/weblog/1388685990_Privacy.html Thu, 02 Jan 2014 13:06:30 EST