Health care professionals must exercise extreme caution when selecting 
and working with third party vendors because, as Stanford University Hospital & Clinics (SHC) recently learned, problems can arise when vendors fail to follow the law.
One of SHC’s vendors subcontracted out its services to a third party. The third party then posted patient information online where it sat accessible for nearly a year. Under previous Federal Regulations, the vendor (as the middle-man) could not be held directly liable for the subcontractor’s breach. But under the new 2013 Federal Regulations, health care provider vendors can be held directly liable for breaches of patient privacy.
A class action suit filed against SHC and two of its former vendors alleged violations of California’s Confidentiality of Medical Information Act. Facing statutory damages of up to $20,000,000 for the breach, the three defendant companies instead sought to settle the case for $4.1 Million. As part of the settlement, SHC agreed to contribute $500,000 to fund the creation of an education project to help reinforce the 2013 Federal Regulations.
As this case illustrates, a large number of health care providers and vendors remain unaware of their potential liability for breaches in patient privacy. Health care providers, therefore, will need to be proactive in their approach to ensuring these breaches do not occur by continuing to communicate with their vendors and to update their form agreement contracts to account for the new Federal Regulations.
If you are a health care provider and are unsure if your vendor contracts contain the recommended language (or whether the vendor is aware of the current status of the law), please establish a line of communication with your vendors as soon as possible to avoid potential exposure like that endured by SHC and have your documents reviewed by your attorney.
If you would like additional guidance, please feel free to contact any of our health law attorneys and we would be glad to assist.
Photo: Thinkstock/hanxu1011