An RSS Feed from melniklegal.com melniklegal.com Blog http://melniklegal.com/programs/weblog.cgi e-commerce Copyright melniklegal.com en-us Thu, 13 Aug 2026 02:39:02 EST tatiana@melniklegal.com (Web Master) Thu, 13 Aug 2026 02:39:02 EST tatiana@melniklegal.com (Tatiana) e-commerce-inc.com sitebuilder blog press <![CDATA[Hospital Settles with OCR for $ 218,400 Over Cloud-Based File Sharing]]> Covered entities, business associates and subcontractors using cloud-based file sharing offerings such as Dropbox, Box.com, and the various other similar solutions should note the most recent settlement announcement from the Office of Civil Rights (OCR). On July 10, 2015, OCR announced a settlement with St. Elizabeth’s Medical Center (Medical Center) for $ 218,400 involving allegations of violations of the HIPAA Security Rule stemming from two reported incidents, the first of which was brought to the OCR’s attention through a third-party complaint.

A few preliminary comments.... This settlement reminds organizations that they need to follow the flow of PHI in their environment and to pay attention to where their workforce members are storing PHI. It is possible with today's technology to log the software installed on corporate computers and, further, to prohibit certain software from being installed. Similarly, usb ports and cd/dvr drives can be disabled.

What is striking about this settlement is the specificity of the OCR settlement, where OCR has not only expressly required the Medical Center to interview workforce members, but also dictated the types of workforce members that must be interviewed.

St. Elizabeth’s Medical Center is a tertiary-care hospital based in Brighton, Massachusetts. The OCR Settlement stems from two separate incidents:
(1)   2012 Incident – This incident involved the Medical Center using an online file-sharing solution to store protected health information (PHI) of at 498 individuals “without having analyzed the risks associated with such a practice.”[1] This incident was brought to OCR’s attention through a third-party complaint received by OCR on November 16, 2012. OCR initiated its investigation on February 14, 2014 and found that the Medical Center “failed to timely identify and respond to the known security incident, mitigate the harmful effects of the security incident, and document the security incident and its outcome.”[2]

(2)   2014 Incident – This incident involved “a breach of unsecured ePHI stored on a former [Medical Center’s] workforce member’s personal laptop and USB flash drive, affecting 595 individuals” that the Medical Center self-reported to the OCR on August 25, 2014. OCR initiated this second investigation on November 17, 2014.[3]
While the two incidents were two years apart, strikingly, the Settlement Agreement does encompass both incidents.[4]

According to the Resolution Agreement, the OCR found the following conduct problematic:
  • Medical Center disclosed the PHI of at least 1,093 individuals.
  • Medical Center failed to implement sufficient security measures regarding the transmission of and storage of ePHI to reduce risks and vulnerabilities to a reasonable and appropriate level.
  • Medical Center failed to timely identify and respond to a known security incident, mitigate the harmful effects of the security incident, and document the security incident and its outcome.
Similar to past Resolution Agreements, the Medical Center and OCR entered into a Corrective Action Plan, requiring the Medical Center to take a number of steps to address the HIPAA Rule deficiencies. What appears to be different between this agreement and past agreements, however, is the relative amount of detail required by OCR, including setting froth relatively detailed requirements for the Self-Assessment. Specifically, the Corrective Action Plan requires the Medical Center to:

Conduct and Report a Self-Assessment
Within one hundred twenty (120) calendar days of the Effective Date, [Medical Center] . . . shall conduct an assessment … of [Medical Center’s] workforce members’ familiarity and compliance with [Medical Center] policies and procedures that address the following:
a. transmitting ePHI using unauthorized networks;

b. storing ePHI on unauthorized information systems, including unsecured networks and devices;

c. removal of ePHI from Medical Center;

d. prohibition on sharing accounts and passwords for ePHI access or storage;

e. encryption of portable devices that access or store ePHI; and

f. security incident reporting related to ePHI.
[The] Self-Assessment will include, but not be limited to:
a. Unannounced site visits to five [Medical Center] departments, including the Cardiology Department (the “Covered Departments”) to assess implementation of the policies and procedures [described in this Settlement Agreement];

b. Interviews with a total of fifteen (15) randomly selected [Medical Center] workforce members who have access to ePHI, thirteen (13) of whom shall be from the Covered Departments—including at least one intern, resident, or fellow, and the remaining two (2) of whom shall be interns, residents, or fellows working in Hematology/Oncology; and

c. Inspection of at least three (3) portable devices at each of the Covered Departments that can access ePHI, including one (1) laptop, one (1) other portable device, such as a tablet or smartphone, and one (1) portable storage media, such as a USB flash drive, randomly selected to ensure that such devices satisfy all applicable requirements of the policies and procedures [described in this Settlement Agreement].
[The Medical Center must produce a written report within] one hundred fifty (150) calendar days of the Effective Date [and provide the report to HHS.] The Self-Assessment Report shall include, but not be limited to:
a. Dates and locations of unannounced site visits;

b. Job titles and duties of workforce members interviewed;

c. Summaries of results of interviews;

d. Summaries of inspections of workstations and other devices containing ePHI; and

e. Identification of any material compliance issues with the policies described [described in this Settlement Agreement], and recommendations for improving these policies and procedures, oversight and supervision, or training.

Revision and Distribution of Policies and Procedures
[If the Self-Assessment reveals that the Medical Center must revise its policies and procedures, then the Medical Center will] draft the appropriate revisions for review by HHS. If the Self-Assessment indicates that [Medical Center] workforce members are unfamiliar with or not substantially complying with [Medical Center’s] policies and procedures[, such as those involving the use of unauthorized networks, removal of PHI from the Medical Center, encryption, security incident reporting and others identified in the Settlement  Agreement, then the Medical Center will] develop an oversight mechanism reasonably tailored to ensure that all Medical Center workforce members follow such policies and procedures, and that ePHI is only used and disclosed as provided for by such policies and procedures.

[The Medical Center must provide the revised policies and procedures as well as the oversight mechanism to HHS for review and approval.] Within thirty (30) calendar days after receiving HHS’ final approval of any revisions to the policies and procedures [the Medical Center will] implement and distribute the policies and procedures to all appropriate workforce members.


Train Workforce Members
[If the Self-Assessment reveals that the Medical Center must revise its training materials, then the Medical Center will] draft the appropriate revisions for review by HHS. [Upon final approval by HHS, the Medical Center will] distribute a security reminder reflecting the content of such training and describing any revised policies and procedures to all [Medical Center] workforce members who have access to ePHI. [Medical Center] shall incorporate the revised training into its next annual refresher training for all applicable Medical Center workforce members [and] provide such training to new members of the workforce who have access to ePHI within sixty (60) calendar days of the workforce members beginning their service. Each individual who is required to attend training shall certify, in writing or in electronic form, that the individual has received the required training. The training certification shall specify the date training was completed. A sign-in sheet shall suffice to meet this requirement. All course materials shall be retained [for the six (6) year document retention period].[5]

For a chart summary of the OCR fines as well as other HIPAA related litigation, please see https://melniklegal.com/list_of_HIPAA_fines_and_penalties.html.

---------------------
[1] Press Release, HHS Office of Civil Rights, HIPAA Settlement Highlights Importance of Safeguards When Using Internet Applications, July 10, 2015, available at https://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/SEMC/bulletin.pdf.

[2] Id.

[3] Resolution Agreement between HHS Office of Civil Rights and St. Elizabeth’s Medical Center (July 8, 2015), available at https://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/SEMC/ra.pdf.

[4] Id. at I.1.2 (In describing the so-called “Covered Conduct,” OCR identifies a total of 1,093 patients, meaning that it was adding the patients from both the 2012 and 2014 incidents).

[5] Id. at V.
---------------------

Posted by: Tatiana Melnik on July 23, 2015
]]> http://melniklegal.com/weblog/1437673811_Data-Breach.html http://melniklegal.com/weblog/1437673811_Data-Breach.html Thu, 23 Jul 2015 13:50:11 EST <![CDATA[IBM and the EEOC Experiment with BYOD]]>
Many companies are moving to a BYOD system. And the move is understandable given anticipated employee efficiency and productivity increases as well as cost savings for employers. On the other hand, companies also need to be aware of the problems that can arise when moving to a BYOD environment, including employee push back and increased security concerns.

BYOD Can Garner Cost Savings - A BYOD Case Study

In 2012, the U.S. Equal Employment Opportunity Commission (EEOC) undertook a BYOD pilot, during which the EEOC was able to significantly reduce the information technology budget for BlackBerry mobile devices. The EEOC explained,
Last year [2011], the EEOC was paying $800,000 for its Government issued BlackBerry devices. Subsequently, the EEOC’s FY2012 IT budget was cut from $17.6 million to $15 million, nearly a 15% reduction. The EEOC’s Chief Information Officer, Kimberly Hancher, significantly reduced contractor services, eliminated some software maintenance, and slashed the agency’s budget for mobile devices -- leaving only $400,000 allocated for Fiscal Year 2012. . . . [As a result of several cost saving measures discussed below,] FY 2012 costs were reduced by roughly $240,000[.]
Importantly, before implementing changes, the EEOC evaluated use of existing devices. Specifically, the EEOC found that,
75% of our users never made phone calls from their BlackBerrys … Email is the killer app. They either used the phone on their desk or they used their personal cell phone to make calls because it’s just easier. We also found there were a number of zero-use devices. People have them parked in their desk drawer, and the only time they use it is when they travel.
After evaluating the existing environment, the EEOC was able to form a plan to implement several cost saving measures, including pressing their "wireless carrier, a GSA Networx contract provider, to help cut costs or risk losing the EEOC’s BlackBerry business." The EEOC also eliminated zero-use devices and moved the remaining BlackBerry devices to a bundled rate plan with shared minutes.

But, moving to a BYOD environment can also be problematic. While employees desire to use their own devices, they may also push back on a company's efforts to monitor and track the devices. Moreover, as IBM learned in its implementation, employees must be trained on best practices to protect their devices and avoid security pitfalls.

IBM Experiments with BYOD

IBM is a sophisticated technology company whose storied history of innovation dates back to 1880. IBM holds more patents than any other U.S. based IT company and has lead the list of top patent recipients for 19 consecutive years. Yet, when IBM adopted a BYOD policy in 2010, similar to other companies, it too encountered technology challenges

In an interview with the MIT Technology Review in 2012, Jeanette Horan, IBM's Chief Technology Officer, reported that her IT department was bogged down with security issues brought about by employees using certain apps (e.g., Dropbox), forwarding internal e-mail to public e-mail services, and creating open Wi-Fi hotspots with their mobile devices.

According to the MIT Technology Review, Horan's team "surveyed several hundred employees using mobile devices, [and found that] many were 'blissfully unaware' of what popular apps could be security risks." In general, her team "found a tremendous lack of awareness as to what constitutes a risk."

Given the lack of awareness among IBM employees of security risks associated with mobile apps and time spent addressing these concerns, "[t]he trend toward employee-owned devices isn’t saving IBM any money . . . Instead, [Horan] says, it has created new challenges for her department of 5,000 people, because employees’ devices are full of software that IBM doesn’t control."

BYOD Is Not For Everyone

It is important for companies to recognize that a bring your own device approach is not appropriate for every company. True, IBM, the EEOC, and many other organizations have managed to make BYOD work for them. But, that does not mean that this approach is the best approach for every organization. As is clear from IBM's experience, companies may not see an immediate cost savings from moving to a BYOD environment. On the other hand, companies could realize immediate cost savings by eliminating zero-use devices as did the EEOC.


Resources and Supporting Materials
  • White House Digital Government - Bring Your Own Device - A Toolkit to Support Federal Agencies Implementing Bring Your Own Device (BYOD) Programs (August 23, 2012)
    • Includes three BYOD Case Studies:
      • Alcohol and Tobacco Tax and Trade Bureau (TTB) Virtual Desktop Implementation
      • U.S. Equal Employment Opportunity Commission (EEOC) BYOD Pilot
      • State of Delaware BYOD Program
    • Includes Sample Policies
      • Sample #1: Policy and Guidelines for Government-Provided Mobile Device Usage
      • Sample #2: Bring Your Own Device – Policy and Rules of Behavior
      • Sample #3: Mobile Information Technology Device Policy
      • Sample #4: Wireless Communication Reimbursement Program
      • Sample #5: Portable Wireless Network Access Device Policy
      • **Disclaimer - inclusion does not constitute endorsement or approval.
  • Brian Bergstein, IBM Faces the Perils of "Bring Your Own Device": After letting its employees use their own phones and tablets for work, the company confronted a flood of insecure apps from the open Web, MIT Technology Review (May 21, 2012).

]]> http://melniklegal.com/weblog/1381716709_BYOD.html http://melniklegal.com/weblog/1381716709_BYOD.html Sun, 13 Oct 2013 22:11:49 EST <![CDATA[Family Stumped by Fired Live-In Nanny Who Won't Leave]]> The Importance of Running Background Checks.

Employers generally recognize that there is a need to run background checks on prospective employees. But, sometimes after an interview or because of a time crunch, this simple detail is overlooked. A story reported by ABC News out of California on June 26, 2014 on a nanny who refuses to work and leave the premises serves as a good reminder of the need to run comprehensive background checks on prospective employees.[1] As reported by Sarah Figalora, 
A California family is stumped about what to do with a live-in nanny they say refuses to work, refuses to be fired and refuses to leave.

In fact, Marcella Bracamonte claims that the nanny, Diane Stretton, has threatened to sue the family for wrongful firing and elder abuse. . . .

 Bracamonte called the police, but the cops declined to do anything, saying it was a civil matter. Lt. John Moore of the Upland Police Department confirmed to ABC News that there is no immediate action that can be taken against Stretton, saying "generally, once somebody has established residency, you have to go through a formal eviction process.”

Bracamonte soon realized that this was not Stretton’s first time with legal matters. Stretton reportedly has been involved in 36 lawsuits, landing herself on California’s Vexatious Litigant Lists for repeatedly abusing the legal system.
While the experience of the Bracamonte family is certainly unusual, it serves as a good example of the need to run thorough background checks on employees and to double check references. Employees do misbehave and are often the cause of data breaches and other security lapses. See for example, Former Employee of a Florida Medical Center Pleads Guilty to Identity Theft.

Aside from issues related to identity theft, employees with access to company funds have also been prosecuted for embezzlement.  For example, in the dental space, it is often stated that three out of five dental practices are being embezzled from. Further, in a 2012 Ponemon Institute report, the organization found that "[o]n average, it takes 87 days to first recognize that insider fraud has occurred and more than three months (105 days) to get at the root cause of the fraud [and that according] to 73 percent of respondents, an employee’s malfeasance has caused financial loss and possibly brand damage."[2] With the costs of data breach notification and remediation increasing, these are pretty frightening statistics that all business owners should take to heart (particularly those where employees have misused information to commit identity theft).

While running background checks is important, they must also be done in accordance with both federal and state legal requirements. It is important to remember that any background check must be job-related and consistent with business necessity.The Federal Trade Commission and the Equal Employment Opportunity Commission (EEOC) have been particularly active in this space recently, because of their concerns that employers are using criminal background checks to exclude applicants. As the EEOC and the FTC have clarified:
Except for certain restrictions related to medical and genetic information (see below), it's not illegal for an employer to ask questions about an applicant's or employee's background, or to require a background check.

However, any time you use an applicant's or employee's background information to make an employment decision, regardless of how you got the information, you must comply with federal laws that protect applicants and employees from discrimination. That includes discrimination based on race, color, national origin, sex, or religion; disability; genetic information (including family medical history); and age (40 or older). These laws are enforced by the Equal Employment Opportunity Commission (EEOC).

In addition, when you run background checks through a company in the business of compiling background information, you must comply with the Fair Credit Reporting Act (FCRA). The Federal Trade Commission (FTC) enforces the FCRA.[3]
Aside from federal laws, many states also have laws addressing pre-employment background screening. In Florida, for example, Chapter 435 of the Florida Statutes addresses employment screening. Some states also have laws addressing whether social media information may be used as part of pre-employment screening.


A Few Outside Resources:
-----------------------------
[1] Sarah Figalora, Family Stumped by Fired Live-In Nanny Who Won't Leave, ABC News, Good Morning America, June 26, 2014, https://abcnews.go.com/US/family-stumped-fired-live-nanny-leave/story?id=24316229.

[2] Press Release, Ponemon Institute, Ponemon Survey Indicates the Growing Threat of Insider Fraud Not a Top Security Priority for Organizations, Proves a Costly Mistake (Feb. 28, 2013), available at https://www.ponemon.org/news-2/49.

[3] EEOC, Background Checks - What Employers Need to Know, A joint publication of the Equal Employment Opportunity Commission and the Federal Trade Commission, https://www.eeoc.gov/eeoc/publications/background_checks_employers.cfm (last visited June 29, 2014).
---------------------

Posted by: Tatiana Melnik on June 29, 2014
]]> http://melniklegal.com/weblog/1404071750_Employment.html http://melniklegal.com/weblog/1404071750_Employment.html Sun, 29 Jun 2014 15:55:50 EST <![CDATA[When Looking at Security, Consider Every Device]]> Internet of Things to Complicate Compliance.

When evaluating security, organizations must evaluate every device that is connected to the Internet, whether directly or through the company's network. This includes everything from radiology software systems, to VPNs, to video conferencing equipment, to printers and faxes. The more devices that are connected, the more difficult this process becomes. The move to the Internet of Things is sure to exacerbate this problem as organizations have that many more devices to monitor and control. Healthcare providers should take steps to prepare now by enrolling their devices into device management programs, taking stock of devices that are owned by the company or owned by employees but used for company purposes (e.g., smartphones, tablets, etc.), and implementing processes to receive and address security incident warnings from those outside of an organization, who may not be business associates.

In February 2014, the SANS Institute, with support from Norse, published a report summarizing findings from a year-long analysis of cybersecurity threats in the healthcare industry. The amount of data collected was specific to the healthcare industry:
During the sample period [(September 2012 and October 2013)], the Norse threat intelligence infrastructure—a global network of sensors and honeypots that process and analyze over 100 terabytes of traffic daily—gathered data. The intelligence data collected for this sample included:
  • 49,917 unique malicious events
  • 723 unique malicious source IP addresses
  • 375 U.S.-based compromised health care-related organizations [1]
The organizations that were compromised varied in size and financial resources:
About a third of the organizations represent small providers, while the rest represented clearinghouses, health plans, pharmaceutical companies and other types of medical organizations. Some of these providers were also quite large, with renowned research centers and teaching hospitals among the sources sending out the malicious packets. [2]
Interestingly, while most of the largest data breaches reported to the HHS Office of Civil Rights to date involved business associates, SANS found that a large percentage of the malicious IP traffic emanated from healthcare providers, with covered entities accounting for 78.6% of the compromised organizations:
  • Health care providers—72.0% of malicious traffic
  • Health care business associates—9.9% of malicious traffic
  • Health plans—6.1% of malicious traffic
  • Health care clearinghouses—0.5% of malicious traffic
  • Pharmaceutical—2.9% of malicious traffic
  • Other related health care entities—8.5% of malicious traffic [3]
Most strikingly, SANS noted:
Many of the organizations were compromised and, therefore, out of compliance for
months, and some for the duration of the study—meaning they never detected their compromises or outbound malicious communications, nor did they acknowledge warnings from the Norse response team.[4]
While it seems surprising that any organization would ignore a direct notice of an on-going security compromise, particularly an organization trusted with sensitive healthcare data, it is not unheard of (see e.g., the pending FTC case against LabMD, which was allegedly brought to the FTC by a security firm, and the FTC settlement with HTC America, where the FTC alleged that HTC ignored vulnerability reports from security experts [5]). But, as we continue to see data breaches in the healthcare space as well as healthcare providers becoming the victims of cyberattacks—such as the attacks against each of Anthem Inc. and Premera Blue Cross—healthcare providers will need to implement stronger policies and procedures to ensure that security warnings are not ignored.

These monitoring programs must include all systems and devices on the organizations' infrastructure. In its analysis, SANS evaluated the types of systems and devices emanating malicious traffic and found a wide variety of systems and edge devices. See Figure 1 below[6]. Many of these devices—particularly network-connected edge devices such as printers, faxes, web cameras, and video conferencing systems are often overlooked as the source of security vulnerabilities, despite being recognized as potential entry points for hackers and cybercriminals.[7]



Specifically:
  • Connected medical endpoints. The findings of this study indicate that 7 percent of traffic was coming from radiology imaging software, another 7 percent of malicious traffic originated from video conferencing systems, and another 3 percent came from digital video systems that are most likely used for consults and remote procedures. . . .
  • Internet-facing personal health data. The study shows 8 percent of malicious
    traffic was emitted through a web-based call center website, backed by a VoIP PBX,
    in use by a medical supply company. Also we found indications of a compromised
    personal health record (PHR) system. . . .
  • Security systems and edge devices. In this study, most of the malicious traffic passed through or was transmitted from VPN applications and devices (33 percent), whereas 16 percent was sent by firewalls, 7 percent was sent from routers and 3 percent was sent from enterprise network controllers (ENCs). This indicates that the security devices and applications themselves were either compromised, which is a common tactic among malware families, or that these “protection” systems are not detecting malicious traffic coming from the network endpoints inside the protected perimeter—inside the firewall or behind the VPN concentrator. . . . [8]
When evaluating security, organizations must take a broad look at their environment and consider any network-connected device a potential source of a security vulnerability.


-------------------------------------
[1] Barbara Filkins, Health Care Cyberthreat Report: Widespread Compromises Detected, Compliance Nightmare on Horizon, SANS Institute Whitepaper, 3, Feb. 2014.

[2] Id.

[3] Id.

[4] Id.

[5] LabMD Inc. v. Tiversa Holding Corp. et al., Case No. 2:15-cv-00092, U.S. District Court for the Western District of Pennsylvania (Jan. 21, 2015); Press Release, Federal Trade Commission, HTC America Settles FTC Charges It Failed to Secure Millions of Mobile Devices Shipped to Consumers: Company Required to Patch Vulnerabilities on Smartphones and Tablets, Feb. 22, 2013, https://www.ftc.gov/news-events/press-releases/2013/02/htc-america-settles-ftc-charges-it-failed-secure-millions-mobile.

[6] Filkins, supra note 1, at 8.

[7] Nicole Perlroth, Cameras May Open Up the Board Room to Hackers, NYTimes.com, Jan. 22, 2013, https://www.nytimes.com/2012/01/23/technology/flaws-in-videoconferencing-systems-put-boardrooms-at-risk.html

[8] Filkins, supra note 1, at 7.

-------------------------------------

Posted by Tatiana Melnik on March 28, 2015
 ]]> http://melniklegal.com/weblog/1427590149_Security.html http://melniklegal.com/weblog/1427590149_Security.html Sat, 28 Mar 2015 20:49:09 EST <![CDATA[Dentist Sued Over the Marketing Practices of Its Independent Contractor]]> Companies Must be Careful in Hiring Marketing Firms

A Florida dentist is currently in litigation over the actions of the subcontractor of his subcontractor. Briefly, the dentist hired an individual to help him market his dental practice. That individual then hired a third-party marketing firm located in Romania to send 10,000 fax ads to phone numbers within a specific zip code. The plaintiff, a golf course, filed a class action lawsuit based on violations of the Telephone Consumer Protection Act, which permits consumers to sue and receive statutory damages for certain unsolicited telemarketing efforts.

A few preliminary comments.... Companies must be careful when engaging third parties to undertake marketing efforts on their behalf. In the past several years, there has been a hot bed of litigation surrounding the TCPA, particularly since certain regulatory changes in October 2013, which removed the "established business relationship" exemption and put in place a requirement of prior express written consent for certain types of marketing efforts (e.g., text messages). The current case provides a great example that the chain of responsibility can be quite long. This is similar to what providers see in the context of HIPAA, where, generally, covered entities remain ultimately responsible. When engaging marketing firms, consider engaging only parties who are experienced, understand the regulatory landscape, and carry their own insurance. Be sure to ask for a copy of the certificate of insurance and double check that the type of insurance is appropriate for the services being offered.

Companies often hold the mistaken belief that they cannot be held legally responsible for the actions of their independent contractors. Often, based on contract terms, they can be held directly responsible. For example, many commercial contracts may include a clause similar to:
USE OF SUBCONTRACTORS. Company may engage subcontractors to perform services under this Agreement.  Company understands and agrees that the management of any subcontractor is the sole responsibility of Company to the same extent as if Company had not subcontracted such performance and that a subcontractor's non-performance shall not relieve Company of any obligations or performance required under this Agreement.
Similarly, companies may be held responsible for the actions of their vendors under federal and state laws.

One such law is the Telephone Consumer Protection Act (TCPA) (47 U.S.C. § 227), which permits consumers to sue and receive damages for receiving unsolicited telemarketing calls, faxes, pre-recorded calls, auto-dialed calls, or text messages without their prior written authorization. The TCPA has been a hotbed of litigation, particularly class action litigation, because it provides for either actual damages or statutory damages ranging from $500.00 to $1,500.00 per unsolicited call/message.

The TCPA has become an issue for one Florida dentist. In February 2012, Palm Beach Golf Center-Boca filed a class action against Dr. John G. Sarris for allegedly sending unsolicited faxes. But, the faxes were not sent directly by Dr. Sarris, but by an independent contractor of an independent contractor. That is, Dr. Sarris engaged an individual named Roberts, an independent contractor, to market his dental practice. This contractor then engaged another entity called Business to Business Solutions ("B2B"), which sold facsimile advertising services in the US on behalf of a Romanian company called Macaw, to send 10,000 fax ads to phone numbers within a specific zip code. The Plaintiff purportedly received one of these fax advertisements.

On October 22, 2013, the United States District Court for the Southern District of Florida granted summary judgment in favor of Dr. Sarris. The court rejected the plaintiff's direct liability claim, ruling that the golf center could establish liability, if at all, only on the basis of vicarious liability. The court further held that Dr. Sarris could not be held vicariously liable for purported violations of the TCPA. The court's decision was based, in part, on a 2013 FCC decision, In re Joint Petition filed by Dish Network, 28 FCC Rcd. 6574 (2013) (addressed availability of direct and vicarious liability for unlawful telemarketing calls under the TCPA), where the FCC ruled "that the seller generally is not directly liable for unlawful telemarketing calls initiated by third-party telemarketers on the seller’s behalf." [1]

The Plaintiff appealed the decision to the Eleventh Circuit and on July 7, 2014, the Court sought comments from the FCC asking the FCC's position "on whether the [TCPA] and its accompanying regulations allow a plaintiff to recover damages from a defendant who sent no facsimile to the plaintiff, but whose independent contractor did." In a letter brief filed Thursday, July 17, 2014, the FCC answered in an affirmative yes. The FCC specifically addressed its decision in the Dish Network case, explaining:
The DISH Network ruling did not address or alter the treatment of facsimile transmissions under the TCPA or the Commission’s implementing regulations. Under the terms of the statute and regulations, the recipient of an unsolicited facsimile advertisement may recover damages from a defendant that does not itself transmit the offending facsimile, if the defendant has hired an independent contractor to transmit facsimiles advertising the defendant’s goods or services. Such liability does not depend upon the application of federal common law vicarious liability principles.
According to the court's docket, the Eleventh Circuit has scheduled to hear oral arguments on the appeal on July 30, 2014.

The case is Palm Beach Golf Center-Boca, Inc. v. John G. Sarris, D.D.S., P.A. et al., 9:12-cv-80178-KMW (S.D. Fla.), app. docket 13-14013. Complaint is available here.

-------------------------------------------
[1] FCC Brief in Response to Palm Beach Golf Center-Boca, Inc. v. Sarris, No. 13-14013, July 17, 2014.
-------------------------------------------


Posted by Tatiana Melnik on July 22, 2014



]]> http://melniklegal.com/weblog/1406032985_Marketing.html http://melniklegal.com/weblog/1406032985_Marketing.html Tue, 22 Jul 2014 08:43:05 EST