Transparency and contrition are two qualities that HIPAA officials at covered entities (CEs) and business associates (BAs) might want to think about expressing should they ever get a call from a state attorney general (AG) investigating a breach.
That’s according to Jonathan Skrmetti, Tennessee’s chief deputy AG, who spoke recently at the 2020 Healthcare Enforcement Compliance Conference, sponsored by the Health Care Compliance Association, which publishes RPP.[1]
Skrmetti addressed the growing interest that state AGs have in pursuing multistate settlements and the structure that supports these enforcement actions (see related story, p. 1).[2]
Of particular interest to compliance officials may be Skrmetti’s insights into what AGs are looking for from CEs and BAs during the investigative and settlement process, what might win them points and what they shouldn’t do.
‘Fix What You Can’
By the time states start looking into a breach, the CE or BA should already have taken a number of actions, said Skrmetti.
“You want your case to be as uninteresting as possible” to authorities, he said. “You want to remediate upfront as much as you can. Obviously, you have to preserve some evidence, for forensic review. We’re not saying the day you discover the breach you should be flying into a frenzy to get ahead of yourself and fix everything. But you need to be proactive about it, from our perspective, to make the case less interesting. Fix what you can, as soon as you can. Don’t wait for the government to tell you what you need to do on that front.”
He advised that for CEs and BAs that “want to move past the case quickly and get back onto the post-litigation world, transparency and contrition are your best route.”
To begin, start talking early. “You really want to raise your arguments in the context of talking with the multistate negotiators at the outset of a settlement conversation,” he said.
Skrmetti added that “litigating the merits with the states is a particularly rough path to go down because there are a lot of states, and so you’re not just talking about a couple suits,” but there may be “20, 30, 40 suits in state courts,” and individuals from each state will need to be involved.
