UPMC’s employment records were hacked by criminals in 2014.  A civil class action lawsuit was filed on behalf of approximately 66,000 employees, and criminal cases were filed by federal prosecutors against a number of individuals and 4 have already pled guilty in connection with the hacking of the UPMC human resources data and using some of the information to commit federal income tax fraud.

In what has been referred to as a landmark opinion, the Pennsylvania Supreme Court declared that employers have a common law duty to use reasonable information security safeguards to protect employee’s personal information.

Under the proposed $2.7 million settlement, UPMC will establish a settlement fund for direct monetary relief to the settlement class members, pay up to $200,000 for administrative costs, $750,000 of Plaintiff’s attorney’s fees and implement significant cybersecurity improvements.

In previous Med Law Blog posts, we have featured examples of increased enforcement in the telehealth area, including the recent creation of the National Rapid Response Strike Force, announced by the Department of Justice on September 30, 2020, and OIG Takedowns in the DME and telehealth arenas.

Now, the OIG work plan includes at least 7 audits targeted at telehealth, identified in the attached PDF.

Commentators are expecting increased activity with respect to:

1. Improper coding for telehealth services,
2. Improper or inappropriate use of telehealth technology, especially when combined with state telehealth laws defining the parameters of the delivery of telehealth services,
3. Evaluation of the appropriate state or billing requirements for the establishment of medically appropriate doctor patient relationships,
4. Increasing cybersecurity activity with respect to HIPAA and data privacy laws, and
5. Audit of appropriate uses of COVID-19 relief funds from multiple programs, i.e. provider relief and paycheck protection, which incidentally was also mentioned in the April 21, 2021 post “Medical Practices Face Liability for COVID Accelerated and Advance Payments and PPP Loans” at the following link: https://www.medlawblog.com/2021/04/articles/articles-1/medical-practices-face-liability-for-covid-accelerated-and-advance-payments-and-ppp-loans/