Texas Right to Life had their Celebration of Life 2016 on Saturday. It was an elegant event, and David Daleiden received an award and gave an acceptance speech. Listening to the speech and contemplating what all has previously been investigated and written by various people and entities one aspect stood out as conspicuously missing. What is Texas doing to enforce any HIPAA violation by way of civil action?
In the investigations following the undercover video release evidence emerged implicating Planned Parenthood of HIPAA violations with StemExpress. If this is true significant consequences can follow. At the federal level, knowingly engaging in a HIPAA violation can lead to substantial penalties even if the conduct is corrected.
It’s unlikely the federal government will act, so what remedies does Texas have? The Health and Safety Code Chapter 181 is the controlling law. In the code there’s a specific prohibition against disclosure of protected information for monetary involvement with the code stating, “A covered entity may not disclose an individual’s protected health information to any other person in exchange for direct or indirect remuneration.” (exceptions omitted.) The Attorney General is empowered to seek enforcement as the code states, “(a) The attorney general may institute an action for injunctive relief to restrain a violation of this chapter. (b) In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter.”
There is one significant limitation to the ability to seek civil penalties in that “The attorney general may institute an action against a covered entity that is licensed by a licensing agency of this state for a civil penalty under this section only if the licensing agency refers the violation to the attorney general under Section 181.202(2).” If the licensing agency refuses to refer a violation, the Attorney General is hamstrung and not able to seek anything other than injunctive relief. Of course, a future legislative session can remove this limitation. While the law does not permit ex post facto litigation, the deterrent effect of removing the limitation would serve the purpose of the already enacted legislation.
While injunctive relief and monetary penalties can apply for discrete violations the significant potential consequences are found slightly farther down in the code. Exclusion from state healthcare funding can flow from a violation as the code requires, “In addition to the penalties prescribed by this chapter, a covered entity shall be excluded from participating in any state-funded health care program if a court finds the covered entity engaged in a pattern or practice of violating this chapter.” The code talks in terms of shall be excluded, not may be excluded, indicating that exclusion is mandatory. Such a finding settles the funding question.
While it’s unlikely a referral will ever be issued the Attorney General still has authority to seek injunctive relief. This is a legal proceeding outside of the reach of the Harris County District Attorney’s office. With evidence of HIPAA violations having occurred the discrete issue needs to be considered. If the standard is “go where the evidence leads” then action should follow.