Rhode Island Governor Dan McKee signed a new law (R.I. Gen. Laws § 5-34-50) that prohibits the enforcement of non-competition agreements with advanced practice registered nurses (APRNs) in the state on June 17, 2024. Surprisingly, only three days after the APRN prohibition was enacted, the Rhode Island legislature sent a proposed bill containing a full ban on non-competition agreements (SB 2436) to Governor McKee for review. On June 26, 2024, Governor McKee vetoed this full ban, stating his concerns about the breadth of the proposed ban and that it exceeded the scope of the Federal Trade Commission’s April 23, 2024, final rule on non-competes. The Rhode Island legislature adjourned its 2024 legislative session on June 30, 2024, without seeking to override the governor’s veto. Read more.

In 2022, the City of Inglewood passed a healthcare worker minimum wage ordinance. The new $25.00 minimum wage applies to private-sector healthcare employees who work in hospitals, integrated health systems, and dialysis clinics in Inglewood. The new minimum wage applied to clinicians, nurses, certified nursing assistants, aides, technicians, maintenance workers, janitorial or housekeeping staff, groundskeepers, guards, food services workers, laundry workers, and pharmacists but does not include managers or supervisors. Read more.

The healthcare industry is among the most highly regulated industries when it comes to privacy protections. In addition to the federal Health Insurance Portability and Accountability Act (HIPAA), healthcare providers also must comply with a growing number of state laws governing data privacy and security. Fully complying with this patchwork of privacy protections is a complex task because these laws often classify different kinds of personal information as “protected information” and impose varying security and reporting requirements.

For example, HIPAA protects certain “individually identifiable health information,” often referred to as “protected health information” or PHI. HIPAA requires covered entities to adopt and implement a plethora of policies and technical safeguards to protect PHI. The California Consumer Privacy Act (CCPA), a relatively new law, protects consumers regarding the collection, use, processing, deletion, sale, and security of personal information, among other things, and also imposes obligations on businesses regarding the same. Healthcare providers who are HIPAA covered entities are exempt from the CCPA with respect to protected health information. However, HIPAA covered entities are not exempt when functioning as an employer with respect to the personal information of their employees who reside in California and therefore must comply with the CCPA to the extent it applies to them as employers.

With the growing number of state laws governing privacy protection, healthcare organizations must be sure their compliance efforts consider state law in addition to HIPAA. Meshing these obligations into one cohesive privacy protection system can be complicated. (See Personal Information, Private Information, Personally Identifiable Information…What’s the Difference?). A recent article by our Jackson Lewis Privacy, Data and Cybersecurity practice group addresses these issues. The article breaks down some factors that may trigger business obligations related to personal information and applies such considerations to the healthcare industry. These factors include but are not limited to industry, business location, categories of customers, types of equipment used, specific services provided, marketing and promotion methods, the categories of information collected, and employment practices. The article also provides some examples of laws that may be triggered (although it is not exhaustive).

So, what is the takeaway? Healthcare organizations should regularly evaluate their compliance efforts around the protection of personal information. This starts with understanding the state and federal laws applicable to their business. From there, healthcare organizations must work to establish and implement policies and safeguards that meet their obligations under each of the applicable laws. Failing to meet these obligations could expose an organization to potentially significant liability and reputational harm. To ensure compliance, healthcare organizations should, at minimum, consider doing the following:

  • Implement comprehensive data safeguards;
  • Conduct cybersecurity assessments;
  • Reconsider the types of data collected and the purposes for collection;
  • Determine whether data collected is the minimum necessary to accomplish the intended purpose; and
  • Monitor pending privacy legislation.

Jackson Lewis attorneys in our Privacy, Data and Cybersecurity practice group and Healthcare industry group regularly partner with healthcare providers to ensure they are up-to-date with this rapidly evolving area of law. Please contact your Jackson Lewis attorney if you would like to learn more about these services.

Update:  On May 17, 2024, we clarified our reference to HIPAA covered entities having to comply with HIPAA and the CCPA. HIPAA covered entities are exempt from the CCPA with respect to protected health information but must comply with the CCPA when functioning as an employer with respect to the personal information of their employees who reside in California.

On April 22, 2024, the federal Department of Health and Human Services’ Office for Civil Rights (OCR) announced a final rule enhancing privacy protections relating to reproductive health care. Specifically, the final rule amends the Privacy Rule under the Health Insurance Portability and Accountability Act (HIPAA) to, among other things, establish new limits on the use or disclosure of protected health information (PHI) relating to reproductive health care. Read more.

Phishing has long been a favorite tactic for threat actors (hackers) to commence a cyberattack. The rapid expansion of more adaptable and available artificial intelligence (AI) technologies, such as natural language processing and large language models, now fuels more ferocious phishing campaigns. The effects are being felt in many industries, perhaps most notably the healthcare industry. One indicator of that may be the recent Office for Civil Rights (OCR) announcement of its “First Ever Phishing Cyber-Attack Investigation.” Read more.

Many HIPAA covered entities and business associates struggle with developing and implementing a sanctions policy. What should it say, is zero-tolerance required, do we have to impose discipline in every case, etc. These are examples of frequent and thorny questions that arise in connection with the development and implementation of these policies. But they are important questions to answer, especially considering the federal Office for Civil Rights (OCR) position concerning these policies. Read more.

What do ransomware, Yelp, and website tracking technologies all have in common? They are troubling areas of concern for HIPAA covered entities and business associates, according to one official from the federal Office for Civil Rights (OCR) which enforces the HIPAA privacy and security rules. Recently, the Executive Editor of Information Security Media Group’s (ISMG’s) HealthcareInfoSecurity.com media site, Marianne Kolbasuk McGee, sat down with Susan Rhodes, the OCR’s acting deputy for strategic planning and regional manager to discuss these issues. Read more.

The healthcare sector is a prime target for data breaches. According to a summary by the HIPAA Journal, 32% of all data breaches between 2015 and 2022 were in the healthcare sector, “almost double the number recorded in the financial and manufacturing sectors.” Industry analysts cite to many reasons for this, including the sensitivity of health data and its value on the black market compared to other forms of data. Evidently, another driver of data breaches for healthcare entities is M&A activity. Read more.

Recently, things may have sped up a little in your doctor’s office. The notes for your recent visit may have been organized and filed a little more quickly. You might have received assistance sooner than expected with a physician letter to your carrier concerning a claim. You also may have received copies of those medical records you have been waiting for, earlier than usual. Greasing the skids in these areas could be due to the use of generative AI technologies, such as ChatGPT, being leveraged in a myriad of ways across all industries, not just healthcare. Read what our Privacy, Data Management & Security colleagues have to say about steps to consider before sharing protected health information with a third party.

The EEOC has filed suit in federal court against a home care provider, alleging it unlawfully discriminated against employees when it changed their work assignments to accommodate client preferences. EEOC v. ACARE HHC d/b/a Four Seasons Licensed Home Health Care, 23-cv-5760 (E.D.N.Y. July 31, 2023).

The suit alleges the home care provider “routinely would accede to racial preferences of patients in making home health aide assignments, including by removing Black and Hispanic home health aides based on clients’ race and national origin-based requests. Those aides would be transferred to a new assignment or, if no other assignment were available, lose their employment completely.” The EEOC contends this conduct violates Title VII of the Civil Rights Act of 1964. The EEOC seeks compensatory and punitive damages for the affected employees, and injunctive relief to remedy and prevent future discrimination based on employees’ race and national origin.

The issue of accommodating patient or client preferences in making assignments is a familiar one for healthcare providers. We previously reported in 2016 about a case in which a federal district court ruled a respiratory therapist could proceed with her civil rights claims because questions remained about whether her hospital employer intended to honor a patient’s request that he not be treated by black employees. That case arose under 42 U.S.C. §1981, which prohibits discrimination in making and enforcing contracts but, unlike Title VII, does not require evidence of an “adverse employment action.” Thus, the court rejected the hospital’s defense that the plaintiff did not suffer an alteration in terms and conditions of employment, which is currently required under Title VII. The Supreme Court recently accepted for review  a case that challenges the Title VII adverse employment action requirement. Muldrow v. City of St. Louis, Mo., No. 22-193. Removing the adverse employment action requirement could make it easier for employees to prevail in cases where healthcare providers change employee assignments based on patients’ racial or national origin preferences.

While healthcare providers strive to accommodate a wide range of patient preferences, they must be careful that such accommodations do not run afoul of applicable state and federal employment discrimination laws. Much has been written in scholarly journals and trade publications regarding strategies for dealing with patients refusing treatment by providers based on race and national origin. One such resource is the American Medical Association’s article, “When Patients Are Prejudiced, Here’s What Physicians Should Do.” This article and the EEOC’s suit against this home care provider are reminders of the importance of training all patient-facing staff on your organization’s commitment to maintaining a work environment free from unlawful discrimination.

Members of the Jackson Lewis Healthcare Industry Group routinely advise clients on anti-discrimination policies and diversity, equity, and inclusion strategies and provide training on preventing workplace discrimination. Please contact your Jackson Lewis attorney if you would like to learn more about these services.