Resolution Agreement with Management Services Organization Washington, Inc.

6+#glv1cq.% ~ DEPARTMENT OF HEALTH & HUMAN SERVICES OFFICE OF THE SECRETARY 1 ~=,~ Voice - (206) 615-2290, (800) 362- 1 710 Office for Civil Rights, Region X 6-.... TDD - (zoe) 615-22%, (so0) 537-7697 22o1 sum Avenue, Man $mp Rx- 11 (FAX) - (zo6) 615-2297 Seame, WA 98121-1831 http ://www. hhs. gov/ocr/ DEC 1 3 2mo Date: Adam G. Snyder, Esquire Inslee Best Doezie & Ryder, P.S. 777 108th Avenue N.E., Suite 1900 Bellevue, WA 98009-9016 Transaction Number: 1 0-l 04342 Dear Mr. Snyder: On December 8, 2009, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) notified your client, Management Services Organization Washington, Inc. (MSO), that OCR was investigating a complaint alleging MSO Was not in compliance with the Federal Standards for Privacy of Individually Identifiable Health Information and/or the Security Standards for the Protection ofElectronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). To resolve the issues raised by that complaint, OCR entered into a Resolution Agreement and Corrective Action Plan ("RA/CAP") with MSO on December 13, 2010 ("Effective Date"). On the Effective Date, the complaint investigation was completed and the case was placed into monitoring as required by the RA/CAP. As agreed, OCR has enclosed one ofthe two signed RA/CAPS. Under Section V ofthe Collective Action Plan, MSO is required to provide specified policies and procedures to OCR within 30 calendar days ofthe Effective Date. See pages 5-7 ofthe RA/CAP. Please provide drafts ofthe specified policies and procedures no later than January 12, 201 1, for OCR'S review and approval. Under the Freedom ofInformation Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as pemiitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion ofpersonal privacy. If you have any questions, please contact David Corbett at (206) 61 5-2291. Sincerely, WM'" 41/;/4 Linda You Connor Regional Manager cc: Charles Plunkett, MSO owner RESOLUTION AGREEMENT I. Recitals 1. Parties. The Parties to this Resolution Agreement (Agreement) are the United States Department of Health and Human Services, Office for Civil Rights (HHS) and Management Services Organization Washington, inc. (MSO), a corporation organized under the laws of and doing business in the state ofWashington. 2. Factual Background and Covered Conduct. HHS enforces the Federal Standards for Privacy of Individually identifiable Health information and the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules) promulgated by HHS pursuant to the administrative simplification provisions ofthe Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub.L. 104- 191 (42 U.S.C. 1320d - 1320d-8, 1320d-2 (note)). HHS has authority to investigate complaints and review pertirrent policies, procedures, and practices of covered entities and ofthe circumstances regarding any alleged violations in complaints. See 45 C.F.R. } 160.306. Covered entities must cooperate with HHS investigations. See 45 C.F.R. } 160.310(b). MSO is a covered entity as defined at 45 C.F.R. } 160.103. Thus, MSO is required to comply with the Privacy and Security Rules and is hereafter referred to as "Covered Eniiyy" On December 8, 2009, HHS opened an investigation of Covered Entity based on a referral from the HHS Office of Inspector General (DIG) and Department ofJustice, Civil Division (DOJC), which had been investigating Covered Entity and its owner for violations ofthe Federal False Claims Act (FFCA). During the course of its investigation, DIG discovered that Covered Entity's owner also owns Washington Practice Management, LLC (WPM) that cams commissions by marketing and selling Medicare Advantage plans. The HHS investigation indicates that the following conduct occurred ("Covered Conduct"): ia) Between January 2007 and November 2010, Covered Entity impermissibly disclosed the protected health information (PHI) maintained by Covered Entity in electronic media (ePHI) ofnumerous individuals to WPM without a valid authorization, for WPM'S purpose of marketing Medicare Advantage plans to those individuals; and 1 ib) Covered Entity intentionally did not have in place appropriate and reasonable administrative, teclmical, and physical safeguards to protect the privacy ofthe PHI described 1 in the paragraph above and did not implement required administrative, physical, and 1 tecfmical safeguards for the ePHI described in the paragraph above. 3. No Admission: This Agreement is not an admission of liability by Covered Entity. 4. No Concession. This Agreement is not a concession by HHS that Covered Entity is not in violation ofthe Privacy and Security Rules and not liable for civil money penalties. 5. Intention ofParties to Effect Resolution. This Agreement is intended to resolve Complaint Number 10- 104342 regardirrg possible violations ofthe Privacy and Security Rules related to the Covered Conduct. In consideration ofthe Parties' interest in avoiding the uncertainty, burden and expense of further investigation and fomral proceedings, the l Parties agree to resolve this matter according to the Terms and Conditions below. At the same time, Covered Entity and DOJC and DIG are entering into a settlement agreement to resolve the issues raised in the FFCA investigation. II. Term$ and Conditions 6. Pay@ent. Covered Entity agrees to pay HHS the amount of $35,000 ("Resolution Amount"). Covered Entity agrees to pay the Resolution Amount by iii certified check made payable to "United States Department of Health and Human Seriices" or (2) electronic fhnds transfer pursuant to written instructions to be provided by HHS. Covered Entity agrees to make this payment on or before the date it signs this Agreement. 7. Collective Action Plan. Covered Entity has entered into and agrees to comply with the Collective Action Plan (CAP), attached as Appendix A, which is incorporated into this Agreement by reference. If Covered Entity breaches the CAP and fails to cure the breach as set forth in the CAP, then Covered Entity will be in breach ofthis Agreement and HHS will not be subject to the Release set forth in paragraph 8 ofthis Agreement. 8. Release by HHS. in consideration of and conditioned upon Covered Entity's performance of its obligations under this Agreement, HHS releases Covered Entity from any actions it may have against Covered Entity under the Privacy and Security Rules for the Covered , Conduct identified in paragraph 2. HHS does not release Covered Entity from, nor waive any rights, obligations, or causes of action other than those specitically referred to in this paragraph. This release does not extend to actions that may be brought under section 1177 ofthe Social Security Act, 42 U.S.C. } 1320d-6. 9. Agreement by Released Parties. Covered Entity shall not contest the validity of its obligations to pay, nor the amount oL the Resolution Amount or any other obligations agreed to under this Agreement. Covered Entity waives all procedural rights granted under Section 1128A ofthe Social Security Act (42 U.S.C. } 1320a- 7a) and 45 C.F.R. Part 160 Subpart E, and HHS claims collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice, hearing, and appeal with respect to the Reso lution Amount. 10. Binding on Successors. This Agreement is binding on Covered Entity and its successors, heirs, transferees, and assigns, including any person(s) las defined at 45 C.F.R. }160.103) that is or becomes a covered entity las also deiined at 45 C.F.R. }160.103) to which the ownership or control of Covered Entity is soid or transferred by merger; acquisition of ste ok, assets or other ownership interest; or any other form ofpurchase or transfer during the term of the CAP. ll. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in cormection with this matter, including the preparation and performance ofthis Agreement. 12. No Additional Releases. This Agreement is intended to be for the benefit ofthe Parties only, and by this instrument the Parties do not release any claims against any other person or entity. 13. Effect ofAgreement. This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises ofthe Parties are contained in this Agreement. Any modifications to this Agreement shall be set forth in writing and signed by all Parties. 2 14. Execution ofAgreement and Effective Date. The Agreement shall become effective (i.e., final and binding) upon the date of signing ofthis Agreement and the CAP by the last signatory ("Effective Date"). 15. Telling of Statute ofLimitations. Pursuant to 42 U.S.C. } 1320a-7a(c)(1), a civil money penalty must be imposed within six years from the date ofthe occurrence ofthe violation. To ensure that this six-year period does not expire during the term ofthis agreement, Covered Entity agrees that the time between the Effective Date ofthis Reso lution Agreement las set forth in paragraph 14) and the date same may be terminated by reason of Covered Entity's breach, plus one-year thereafter, will not be included in calculating the six (6) year statute oflimitations applicable to the violations which are the subject ofthis agreement. Covered Entity waives and will not plead any statute of limitations, laches, or similar defenses to any administrative action relating to the Covered Conduct identified in paragraph 2 that is filed by HHS within the time period set forth above, except to the extent that such defenses would have been available had an administrative action been filed on the Effective Date ofthis Agreement. 16. Disclosure. HHS places no restriction on the publication ofthe Agreement. This Agreement and information related to this Agreement may be made public by either party. in addition, HHS may be required to disclosethis Agreement and related material to any person upon request consistent with the applicable provisions ofthe Freedom ofInformation Act, 5 U.S.C. } 552, and its implementing regulations, 45 C.F.R. Part 5. 17. Execution in Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all ofwhich shall constitute one and the same agreement. 18. Authorizations. The individual(s) signing this Agreement on behalfof Covered Entity represent and warrant that they are authorized by Covered Entity to execute this Agreement. The individual signing this Agreement on behalfof HHS represents and warrants that she is signing this Agreement in her official capacity and that she is authorized to execute this Agreement. ' / For Covered Entity Dec ~ ;lcxg Charles Plunkett, Owner Date Management Services Organization Washington, Inc. For United State$ Department of Health and Human Services - JM . £3 za /0 Linda u Connor Date Regional Manager, Region X Office for Civil Rights , 3 ' Appendix A CORRECTIVE ACTION PLAN BETWEEN THE UNITED STATES DEPARTMENT oF HEALTH AND HUMAN SERVICES AND MANAGEMENT SERVICES ORGANIZATION WASHINGTON, INC. I. Preamble i Management Services Organization Washington, Inc. (MSO), a corporation organized under the laws of and doing business in the state of Washington, hereby enters into this Corrective Action Plan (CAP) with the United States Department ofHealth and Human Services, Office for Civil Rights (HHS). MSO is hereafter referred to as "Covered Entity." Contemporaneously with this CAP, Covered Entity is entering into a Resolution Agreement with HHS, and this CAP is incorporated by reference into the Reso lution Agreement as Appendix A. Covered Entity enters into this CAP as consideration for the release set forth in paragraph 8 ofthe Resolution Agreement. H. Contact Persons and Submissions A. Contact Persons Covered Entity has identified the fo llowing individual as its authorized representative and contact person regarding the implementation ofthis CAP and for receipt and submission of notifications and reports: Charles Plunkett, Owner Management Services Organization Washington, Inc. 4903 108th Street, SW Lakewood, WA 98496 cpl@mso-wa.com 253 -984-7247 ext. 10 Facsimile: 253-588-8244 HHS has identified the following individual as its authorized representative and contact person with whom Covered Entity is to report information regarding the implementation of this CAP: Linda You Connor, Regional Manager Office for Civil Rights, Region X U.S. Department of Health and Human Services 2201 Sixth Avenue, Mail Stop RX-ll 4 Seattle, WA 98 1 21 - 1 831 Linda.comior@hhs.gov Telephone: 206-61 5 -2290 Facsimile: 206-615-2297 Covered Entity and HHS agree to promptly notify each other of any changes in the contact persons or the other information provided above. B. Proofof Submissions. Unless otherwise specified, all notitications and reports required by this CAP may be made by any means, including certiiied mail, ovemight mail, or hand delivery, provided that there is proofthat such notification was received. For purposes ofthis requirement, intemal facsimile confirmation sheets do not constitute proof ofreceipt. HI. Term of CAP The period of compliance obligations assumed by Covered Entity under this CAP 1 shall be two (2) years from the effective date ofthis CAP ("Effective Date"). Additionally, Covered Entity shall be obligated to ia) submit the Amiual Report for the final Reporting Period, as set forth in section VI.B. and ib) comply with the document retention requirement set forth in section VII. The Effective Date ofthis CAP shall be calculated in accordance with paragraph 14 ofthe Reso lution Agreement. IV. Time In computing any period oftime prescribed or allowed by this CAP, the day ofthe act, event, or default &om which the designated period oftime begins to run shall not be included. The last day ofthe period so computed shall be included, unless it is a Saturday, a Sunday, or a legal ho liday, in which event the period runs until the end ofthe next day which is not one ofthe aforementioned days. V. Corrective Action Obligations Covered Entity agrees to the following actions: A. Policies and Procedures 1. Covered Entity shall develop, maintain, and revise, as necessary, written policies and procedures ("Policies and Procedures") that ia) address the Covered Conduct specified in paragraph 2 ofthe Reso lution Agreement and ib) are consistent with the Federal Standards for Privacy of Individually Identitiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Covered Entity's Policies and Procedures shall include, but not be limited to, the minimum content set forth in section V.C. 2. Covered Entity shall provide such Policies and Procedures, consistent with paragraph 1 above, to HHS within 30 calendar days ofthe Effective Date for review and approval. Upon receiving any recommended changes to such Policies and Procedures from HHS, Covered Entity shall have 20 calendar days to revise such Policies and Procedures accordingly and provide the revised Policies and Procedures to HHS for review and approval. s 3. Covered Entity shall implement such Po licies and Procedures Within 20 calendar days ofreceipt of HHS' approval. t B. Distribution and Updating of Policies and Procedures i 1. Covered Entity shall distribute the Policies and Procedures identified in section V.A. to all members ofthe workforce within 20 calendar days of HHS approval of such Policies and Procedures and to new members ofthe workforce within 10 calendar days of j their begirming of service. 1 2. Covered Entity shall require, at the time ofdistribution of such Policies and Procedures, a signed written or electronic initial compliance certification from all members of the workforce, stating that the workforce members have read, understand, and shall abide by such Policies and Procedures. 3. Covered Entity shall not revise such Policies and Procedures without HHS' permission. If HHS permits or requires such Policies and Procedures to be revised, Covered Entity shall distribute such revised Polices and Procedures to all members of its workforce, and shall require new compliance certifications. 4. Covered Entity shall not invo lve any member of its workforce in the use or disclosure ofprotected health information (PHI), including, but not limited to, electronic PHI (ePHI), ifthat workforce member has not signed or provided the written or electronic certification required by paragraphs 2 & 3 ofthis section. C. Minimum Content ofthe Policies and Procedures The Policies and Procedures shall include, at a minimum, the following provisions: 1. Definitions ofHealth Care Operations, Marketing, Payment, and Treatment consistent with 45 C.F.R. } 164.501. 2. The requirements for a valid authorization to use or disclose PHI for marketing consistent with 45 C.F.R. } 164.508. 3. Administrative, Technical, and Physical Safeguards consistent with the Privacy Rule at 45 C.F.R. } 164.530(c) that protect against impermissible uses and disclosures ofPHI for marketing. 4. Administrative, Physical, and Technical Safeguards consistent with the Security Rule at 45 C.F.R. Z}} 164.306, 164.308, 164.310 and 164.312 that protect against impermissible uses and disclosures of ePHI for marketing. 5. Training on the requirements ofthe Privacy and Security Rules consistent with 45 C.F.R. }} 164.308(a)(5) and 164.530(b). Such training Policy and Procedure must require that all members ofthe workforce, including management, receive training within 20 calendar days ofthe implementation of any po licies and procedures implementing the Privacy Rule and/or Security Rule. Such training Policy and Procedure must require that each new member ofthe Workforce receive training within 10 calendar days ofhis or her begirming as a member ofthe workforce. Lastly, such training Policy and Procedure must require that all members of the workforce, including management and new employees, receive training on the policies 6 and procedures implementing the Privacy Rule and/or Security Rule, at a minimum, every 12 months. 6. If a member ofthe workforce observes a violation ofthese Policies or Procedures, he or she must report the violation to Covered Entity. Covered Entity shall promptly investigate all reports. If Covered Entity determines that a member ofits workforce has vicrated these Policies and Procedures, Covered Entity shall notify HHS in writing. Such violations shall be known as "Reportable vvents." The report to HHS shall include the following information: a. A complete description of the event, including the relevant facts, the persons involved, and the provision(s) of the Policies and Procedures X implicated; and * b. A description of Covered Entity's actions taken to mitigate any harm and any further steps Covered Entity plans to take to address the matter and * prevent it from recurring. I D. Training 1. Each individual who is required to attend training pursuant to the Policies and Procedures required under section V.C.5. shall certify, in writing or in electronic form, that he or she has received the required training. The training certification shall specify the date training was received. All course materials shall be retained in compliance with section VII. 2. Covered Entity shall not involve any member of its workforce in the use or disclosure ofPHI if that workforce member has not signed or provided the written or electronic training certification required by paragraph 1 ofthis section V.D. E. Monitoring 1. Pugppse of Monitor Reviews. Monitor Reviews shall be conducted by the Privacy Oflicer or Security Officer ofthe Covered Entity, and shall seek to validate the following actions: a. All members ofCovered Entity's workforce are familiar with the Policies and Procedures described at section V.C.; b. All members ofCovered Entity's workforce are complying With the Policies and Procedures described at section V.C.; and c. No PHI is used or disclosed for marketing without a valid authorization. 2. Description of Monitor Reviews. Monitor Reviews shall include, but not be limited to, unarmounced interviews with members of Covered Entity's workforce who use or disclose PHI, who are selected at random, and represent a cross section of all members ofthe workforce to ascertain compliance with the Policies and Procedures described at section V.C. 3. Fr~uency of Monitor Rgports. Upon the implementation ofthe Policies and Procedures, Covered Entity shall conduct Monitor Reviews every 180 calendar days during the term ofthis CAP. 7 4. Documentation of Monitor Reviews. The results of Monitor Reviews shall be fully documented, including, but not limited to, the following data: a. Dates ofunannounced interviews; and b. Summaries ofresults of interviews. Reports containing the above documentation shall be submitted as part ofthe Armual Reports described in section VI.B. Any Reportable Event that is discovered during a Monitor Review shall be reported in accordance with section V.C.6. 5. Access to Monitor Records. In addition to the reports described in section V.E.4., HHS shall have access to notes, workpapers, and other records created during the Monitor Reviews. Such information shall be submitted to HHS, upon request, within 30 , calendar days of such request. 1 6. Validation Review. In the event HHS has reason to believe that ia) the Monitor reviews or reports fail to conform to the requirements ofthis CAP; or ib) the Monitor report results are inaccurate, HHS may, at its sole discretion, conduct its own review to detemiine whether the Monitor reviews or reports complied with the requirements ofthis CAP and/or are inaccurate ("Validation Review"). 7. The use of a monitor does not affect HHS' authority to investigate complaints or conduct compliance reviews itself, or the Covered Entity's responsibilities under 45 C.F.R. Part 160, Subpart C. VI. Implementation Repprt and Annual Reports A. Implementation Report. Within 90 calendar days after the receipt of HHS' approval ofthe Policies and Procedures required by section V.A. 1 ., Covered Entity shall submit a written report to HHS summarizing the status of its implementation ofthe requirements ofthis CAP. This report, known as the *7mplementation Report," shall include the following data: 1. An attestation signed by an owner or officer of Covered Entity attesting that the Policies and Procedures are being implemented, have been distributed to all members of the workforce, and that Covered Entity has obtained all ofthe compliance certifications required by sections V.B.2. and V.B.3.; 2. A copy of all training materials used for the training required by this CAP, a description ofthe training, including a summary ofthe topics covered, the length ofthe session(s) arid a schedule ofwhen the training session(s) were held; 3. An attestation signed by an owner or officer of Covered Entity attesting that all members ofthe workforce have completed the initial training required by this CAP and have executed the training certifications required by section V.D; 4. An attestation signed by an owner or officer of Covered Entity attesting that Covered Entity has complied with the obligations ofthis CAP; and 5. An attestation signed by an owner or officer of Covered Entity stating that he or she has reviewed the Implementation Report, has made a reasonable inquiry regarding its content and believes that, upon such inquiry, the information is accurate and truthful. B. Annual Reports. The one-year period begirming on the Effective Date and each subsequent one-year period during the course ofthe period of compliance obligations shall be referred to as "the Reporting Peiidds" Covered Entity also shall submit to HHS Armual Reports with respect to the status of and fmdings regarding Covered Entity's compliance with this CAP for each ofthe two (2) Reporting Periods. Covered Entity shall submit each Annual Report to HHS no later than 20 calendar days after the end of each corresponding Reporting Period. The Annual Report shall include the following items: 1. A schedule, topic outline, and copies ofthe training materials for the training programs attended in accordance with this CAP during the Reporting Period that is the subject ofthe report; 2. An attestation signed by an owner or officer of Covered Entity attesting that it is obtaining and maintaining written or electronic training certifications fi*om all persons that require training that they received training pursuant to the requirements set forth in this CAP; 3. A summary of Reportable Events (defined in section V.C.6.) identified during the Reporting Period and the status of any corrective and preventative action relating to all such Reportable Events; and 4. An attestation signed by an owner or officer of Covered Entity attesting that he or she has reviewed the Annual Report, has made a reasonable inquiry regarding its content and believes that, upon such inquiry, the information is accurate and truthful. VH. Document Retention Covered Entity shall maintain for inspection and copying all documents and records relating to compliance with this CAP for six (6) years. VIH. CAP Breach Provisions Covered Entity is expected to fully and timely comply with all provisions of its CAP obligations. A. Timely Written Rgquests for Extensions Covered Entity may, in advance of any due date set forth in this CAP, submit a timely written request for an extension oftime to perform any act or file any notification or report required by this CAP. A "timely written request" is defined as a request in writing received by HHS at least five business days prior to the date by which any act is due to be performed or any notification or report is due to be filed. B. Notice of Breach and Intent to Impose CMP. The parties agree that a breach of this CAP by Covered Entity constitutes a breach ofthe Resolution Agreement. Upon a determination by HHS that Covered Entity has breached this CAP, HHS may notify Covered Entity of ia) Covered Entity's breach and ib) HHS' intent to impose a civil money 9 penalty (CMP) pursuant to 45 C.F.R. Part 160 for the Covered Conduct set forth in paragraph 2 ofthe Resolution Agreement and any other conduct that constitutes a violation ; ofthe HIPAA Privacy and Security Rules (this notification is hereinafter referred to as the "Notice ofBreach and Intent to Impose CMP"). C. Covered Entity's Response. Covered Entity shall have 30 calendar days from the date ofreceipt ofthe Notice of Breach and Intent to Impose CMP to demonstrate to HHS' satisfaction that one ofthe following conditions have been met: 1. Covered Entity is in compliance with the obligations ofthe CAP cited by HHS as being the basis for the breach; 2. The alleged breach has been cured; or 3. The alleged breach cannot be cured within the 30 calendar day period, but that iii Covered Entity has begun to take action to cure the breach; iii) Covered Entity is pursuing such action with due diligence; and (iii) Covered Entity has provided to HHS a reasonable timetable for curing the breach. D. Imposition of Civil Money Penalty. If at the conclusion ofthe 30 calendar day period, Covered Entity fails to meet the requirements of section VIII.C. to HHS' satisfaction, HHS may proceed with the imposition of a CMP against Covered Entity pursuant to 45 C.F.R. Part 160 for the Covered Conduct set forth in paragraph 2 ofthe Resolution Agreement and any other conduct that constitutes a vic lation ofthe Health insurance Portability and Accountability Act of 1 996 (HIPAA) Privacy and Security Rules. HHS shall notify Covered Entity in writing of its determination to proceed with the imposition of a CMP. ? For Covered Entity " ,? I ll7 ,'lo iQ s "'nktt, Owner Date Management Services Organization Washington, Inc. For United States Department of Health and Human Services ~ . Li , &0 / 0 Linda u Cormor Date Regional Manager, Region X Office for Civil Rights I F jo