Michael Sacopulos, JD

Many physicians practicing in states without professional liability caps are interested in asset protection. The next time you walk through a Wal-Mart or go to your state's bureau of motor vehicles, look around. These are the people that could be "the jury of your peers."  With that thought in mind, asset protection seems prudent.

This summer has seen the release of two court rulings that should be of interest to anyone contemplating asset protection. David Mandell is an attorney specializing in the field of asset protection for OJM Group, an Ohio-based financial consultant.

He came to be an expert on this topic because his father, a radiologist, and his brother, a cardiologist, both practice in a state without professional liability limits. "The goal of asset protection planning is to help clients shield assets before they have a problem," says Mandell.

In June, a Florida court decided the case of Ramos v. Motamed. Motamed was a retired dentist from California who had a multimillion dollar judgment entered against him after driving into Ms. Ramos. Dr. Motamed attempted to take advantage of Florida's asset protection laws when he purchased a $1.6 million condominium in Palm Beach. "Florida's homestead exemption shields an unlimited amount of home equity from creditors, with some geographic limitations" explains Mandell. Motamed, in an effort to demonstrate his residency in the state of Florida, obtained a Florida driver's license, library card, and registered to vote in the Sunshine State. Dr. Motamed claimed to be living in Florida when his deposition was taken.

However, Ms. Ramos' attorney was able to obtain Dr. Motamed's records from the Equinox Gym in California which demonstrated that he worked out there 300 days during the year he claimed to be living in Florida. While this might have helped his physical health, it was not good for Dr. Motamed's financial well-being. The Court found that his asset protection plan failed because he was not truly a resident of the State of Florida. "This case shows that proper asset protection involves more than paperwork and checking boxes," says Mandell.

In late May, a Nevada Federal Judge ruled in the case of TransFirst v. Magliarditi.  Magliarditi, who thankfully was not a physician, had been found liable of fraud to the tune of a $4.5 million judgment in Texas. The successful plaintiffs than came to Nevada, where Magliarditi lived, and attacked various entities, like LLCs and trusts that were supposedly controlled by his wife, to satisfy the judgment.

Specifically, the plaintiff asked for a preliminary injunction against these entities, while the case moved forward. The court granted the injunction, citing numerous problems with the structures the Magliarditi had put in place – from undocumented loans to personal expenses of the husband being paid by entities he supposedly had no connection to, and testimony from the wife which showed she was ignorant to how the structures worked or how to operate them. This is another example of why asset protection planning only works if it is structured and maintained properly.

For those interested in asset protection Mandell offers a three step approach:

•Start asset protection before you have any liability concerns.

•Use a multidisciplinary approach – insurances, legal tools, and state exempt assets all play important roles in a proper plan.

•Once you have a plan in place, you are not done. Asset protection requires proper execution and annual maintenance with all formalities, so that it meets your expectations for protection if it is ever tested.

Physicians practicing in states that do not have professional liability caps need to give consideration to an asset protection plan. 

Articles

Two recently settled cases can serve as important lessons for physicians on the proper methods of successful asset protection. 

Physician Lessons on Asset Protection

Actions before a Medical Licensing Board can be a scary thing for a physician. From how complaints originate, to how the process works, these are situations that physicians do not wish to experience. What follows are questions and answers with Deputy Attorney General, Tim Weber of Indiana. Mr. Weber routinely brings physicians before the Indiana Medical Licensing Board, and was gracious enough to sit down and share some of his experiences.

How many physician complaints does your office receive in a year?

The average number of consumer complaints received by the Office of the Attorney General (OAG) that pertained to the Medical Licensing Board over the last five full calendar year was 585.

Can you estimate the percentage of physicians/practices that retain counsel to assist with their initial response to a complaint?

I cannot give an exact or even approximate percentage of physicians/practices that retain counsel to assist with their initial response to a consumer complaint as this is not a statistic kept by the OAG. As indicated above, the OAG receives hundreds of these complaints a year. Most consumer complaints are closed after investigation. If charges are filed against a physician with the Medical Licensing Board, most physicians do retain counsel.

What are the major categories that the complaints fall into?  (Money disputes, patient harm, inappropriate personal behavior, etc.)

Some of the major categories of consumer complaints include inappropriate prescribing practices, drug or alcohol use by the physician, criminal convictions, rudeness, billing disputes, failure to meet standard of care, and receiving discipline in another jurisdiction. Consumer complaints that fall into some of these categories may overwhelmingly come from certain types of complainants. For example, many consumer complaints regarding criminal convictions come from the Professional Licensing Agency, and most complaints alleging that a physician was rude or abrupt come from patients.

Has your office had any complaints that relate to misuse of social media, websites or other online technology?  If so, can you provide some general thoughts/reaction?

The OAG regularly receives consumer complaints regarding misuse of social media. Typically, these consumer complaints involve disclosure of protected health information. The important thing to realize with regard to social media is that you will be held accountable for your actions on social media as a physician whether or not you were acting in your capacity as a physician when you posted the information or not. Simply put, you are always a physician, whether you are at work or not.

Are there any trends your office is seeing that medical providers should be aware of?

The major issue that pervades the work of every Case Analyst and every Deputy Attorney General in the Medical Licensing Section is the opioid crisis and prescription drug abuse generally. Physicians are in the middle of this crisis. Some members of the medical profession are part of the problem, due to over-prescribing or prescribing dangerous drug combinations. Many physicians are part of the solution, prescribing appropriately and providing insight to the OAG and other agencies and organizations combatting the epidemic. Physicians need to speak out when they see colleagues who are engaging in unsafe or outdated prescribing practices. Every investigation at the OAG must start with a consumer compliant being filed.

Physicians are uniquely situated to help combat the opioid crisis. They can help stem the tide of prescriptions reaching individuals who will abuse them. They can also help the regulatory entities react to the ever-evolving nature of the crisis. The OAG welcomes the help of the physician community to that end. 

A Deputy Attorney General shares experiences and offers advice for physicians who face a Medial Licensing Board. 

Facing the Medical Licensing Board

Michael J. Sacopulous, JD, founder and president of Medical Risk Institute, grew up the son of a medical malpractice defense attorney and later worked at an organization aimed at deterring such claims.He’s had a front-row seat to hundreds of malpractice actions over the years and offers the following common mistakes he has seen physician make that got them sued.To download the PDF version of this slideshow, click here.

Slideshows

A lot of things can lead to a malpractice lawsuit. Here are 10 mistakes seen by an attorney with experience in helping docs avoid suits in the first place. 

10 Mistakes That Can Lead to Lawsuits

A sequela of the virus that compromised your network may be a lawsuit from Edelson PC. Edelson PC is a recognized leader in plaintiffs' class and mass action litigation with a special emphasis on technology and privacy cases. Jay Edelson made national news last month by filing suit against MDLive, a telehealth provider focused on digital delivery of medical care. This Chicago-based attorney is smart and representative of a growing number of plaintiff lawyers focused on privacy issues.

To property understand litigation risks faced by healthcare providers, it is useful to learn from those on the other side. Recently, I had the opportunity to speak with Jay Edelson and his partner, Christopher Dore. Below are excerpts from my discussion with Edelson and Dore.

 Some people would argue that the general public's privacy expectations have lowered in recent years. Do you agree?

 No, I think that is wrong. I think there has been some major shift in privacy and how people view privacy in the last decade, starting from the Snowden revelations which really changed the debate to more recently Russian hacking of the election which made people extremely aware of the threats of hacking and then even more recently in the Trump administration, the gutting of FCC Rules which protected search histories. What we have been seeing is that states are really scrambling trying to step in where the federal government hasn't and are really pushing very positive consumer friendly privacy laws. 

 Medical practices share patient information with third parties that are referred to as business associates under HIPAA. Are you aware of claims against medical providers for the negligent selecting or monitoring these business associates when a privacy breach occurs?

 I think that is going to be the next wave. So, the way that we think about it is almost from the eyes of a hacker. Where is the weak link? Often the weak link isn't with the institution itself, it may not be with the hospital. Although hospitals tend not to have very good cyber security, it may be someone down the chain. When a hospital chooses a vendor, including a law firm, and they are not doing their due diligence, they can easily have liability.

 What has been your experience with cyber insurance in litigation?

 My view is a lot of people are buying policies. Whether they are covered or not ends up being a huge debate. Often that can lead to secondary issues.

 Part of the issue with cyber insurance is that it is limited in what it covers. For example, the type of litigation that we bring may not fall under that coverage. It is often put out there more often to respond to a data breach where you have all sorts of internal costs and outside vendors to help clean up the mess. Another issue is a lot of people are going out and buying these policies and then are not following the rules that are put upon them when buying the policies. For example, you must have "X" number of audits within a certain amount of period. Or you must do a certain type of testing. If they don't have a good agent or broker informing them of that, and they are not following those constraints coverage could be voided. When a breach does occur and the insurance company shows up and says you didn't follow any of our rules so you don't get any of our coverage, people are upset. I think that is a pretty rude awakening to a lot of people that think "I didn't think I had to actually step up my game since I had this special insurance." It works opposite of that.

 Physicians must provide privacy notices to their patients. Have you seen anyone use those privacy notices as a basis for a claim?

 Yes. HIPAA is not a great statute for a consumer because there is no private right of action. Meaning an individual can't sue. So, if there is some sort of data breach or misuse of data the theories that inspire plaintiffs before suing tend to be something of a breach of contract theory. "I thought I was paying for something and I got less. I went to you as a doctor and I gave you $500 and part of my expectation was that you would protect my medical records and you did not do that."  Consumer facing statement saying we are going to protect your information tends to be very irrelevant to establishing a claim. 

 The first thing they need to understand it that they are a prime target for hackers. They've got such valuable information and hospitals tend to be really bad, and doctors' office are even worse, about protecting information. Even if someone puts in a type of fancy security system, individuals are going to places like Starbucks and accessing patient records on a free Wi-Fi that is a disaster. 

Sadly, Edelson is correct. Healthcare providers are a prime target for cyber criminals. Many practices do have poor cyber hygiene. Business associates are rarely vetted for IT privacy and security. In short, the healthcare community as a whole needs to do a better job protecting patient data. Hopeful, Edelson's comments will serve as motivation for some to exercise greater caution in handling patient data.  

Healthcare organizations are perfect candidates for cyber-attacks, practices need to step-up and meet protection challenges. 

Data Protection at Small Practices

It happens every once in a while, researchers working on one problem find something that opens a new world of possibilities in a totally different arena. Physicians working on a medication, isoniazid, for tuberculosis discovered what led to the first antidepressant. I have a feeling that we may be preparing for the information technology equivalent of isoniazid.

Blockchain is an information technology that was developed to create a virtual financial ledger for transactions. You will recognize its most famous application: Bitcoin. Here is how Professor John Halamka of Harvard University explains the concept of blockchain:

"Every financial institution creates a cryptographically secured list of all deposits and withdrawals. The blockchain uses public key cryptographic techniques to create an append-only, immutable timestamped chain of content. Copies of blockchain are distributed on each participating node in the network."

Put aside financial applications of blockchain for a moment. Let's focus upon what this technology can do for healthcare.

Professor Halamka identifies three ways that patient data is shared today. "Push," "pull," and "view" are our options.

"Push" is the term for medical information sent from one provider to another. Often this is done via unencrypted email or text. (I won't mention the obvious HITECH Act problems with this.) A specialist sends an email to a referring physician about a patient, data is "pushed" from one provider to another.  This transaction does not guarantee data integrity and does not provide a standardized audit trail.

"Pull" is the term for the process whereby one provider can query information from another. Think of a cardiologist querying information from a primary care physician. As with "push," all consent and permission is informal, ad hoc, and done without a standardized audit trail.

"View" is the concept that one provider can see information inside another provider's records. Since information is transferred from provider to provider, this method is of limited use in healthcare.

Blockchain offers a new, more secure, and flexible alternative to these three methods of healthcare data transfer. Instead of multiple sets of records for each patient, imagine one chart. As a patient's different providers prescribe medication, the prescriptions would become part of the blockchain ledger for the patient. Efficiency and accuracy would be dramatically increased.

With blockchain technology it is also possible to imagine benefits to researchers. Patients could allow access to certain portions of their charts while excluding access to other areas. Instead of manually removing portions of a chart to keep a patient's identity secret, certain blocks would be restricted, thus allowing access to a real time, dynamic patient chart, containing no personally identifiable information. The mind reels with possible applications.

Blockchain technology promises to be disruptive in areas outside of healthcare too. Douglas Park, an attorney and national expert on corporate governance issues, forecasts blockchain's future.

"Boards of directors need to understand how blockchain might impact their company's business model.  For some companies, blockchain will make the business model obsolete and force the company to transform its business. Further, blockchain will change governance by altering how financial and operational information is accessed, verified, and audited. Boards that are on the forefront of understanding and using blockchain will have a huge advantage over those that do not."

Blockchain technology offers opportunities that may not fit within current legal infrastructures, explains Professor Reza Dibadj of University of San Francisco School of Law. 

"Blockchain could redefine the concept of a patient's medical record. State laws focus on provider's responsibility to store and maintain patient records for a fixed time period. Medical providers are under legal duties to produce records to patients. These legal duties may not match the realities of blockchain technology in action.  The shift will be from medical records to medical data, and the law is ill prepared for this transformation."

The healthcare sector may have a powerful new tool in the form of blockchain technology. When and how this technology will become common place in clinical settings is hard to predict. We should anticipate that the early uses of blockchain will not produce the full benefits of the technology. 

Remember, the introduction of electricity to manufacturing did not increase productivity for almost a decade. However, over time healthcare providers will develop the intellectual capital necessary to deploy blockchain technology in new and spectacular beneficial ways for patients.

An information technology developed for financial transactions could one day improve patient privacy in healthcare.

Blockchain: The Future of Health Data

In this digital age, every business needs two social media policies: one for material posted in the organization's official social media communications, and one for employees' mentions of work-related matters in their personal social media communications.

The unique nature of a medical practice makes such policies essential, as HIPAA regulations require all providers have policies, procedures, and systems to protect patient privacy. Here are some tips for creating and implementing an effective social media plan at your practice.

 Employees need know that you are not trying to run their personal lives, online or off, and your policy only applies to work-related matters.

 List the most popular social media sites and apps, including Facebook, Twitter, LinkedIn, Instagram, YouTube, etc. Include business and healthcare-related review sites like Angie's List, Yelp, RateMDs, HealthGrades, and others. Note that the rapid growth of social media creates new apps and platforms, and the policy will apply to new/future social media entities as well.

 This section informs employees that online activities such as posting personal health information (PHI), giving medical opinions or advice, revealing confidential business information, breaking any laws, impersonating others, making intentionally malicious comments, and other behaviors detailed are unacceptable.

Makes employees aware that violations will have consequences, and defines the scope of those consequences. This section should also include language that indemnifies the practice against liabilities for actions in violation of the policy.

 Informs employees that social media polices are subject to changes and updates, and that revisions will require employee review and sign-off.

 This makes employees aware that to protect patient privacy and business confidentiality, the life of the policy extends beyond their term of employment.

 and decisions issued by the National Labor Relations Board (NLRB) deal with specific cases. They have not resulted in a one-size-fits-all set of employee social media rules, nor is it likely they will. A review of the Board's memos and opinions points toward some guidelines your practice can use to help create a reasonable policy.

• Make sure your policy stays within the bounds of the law.

• Avoid vague terminology and sweeping statements. Deal in specifics, not generalities.

• Define terms, unacceptable behaviors, and potential disciplinary actions. Use examples when appropriate.

• Cover the policy in your staff HIPAA training and annual compliance review.

• Update your policy when necessary. This is an extremely dynamic area. Social media entities, labor law and              HIPAA regulations are all subject to change.

• Make sure all employees receive, read, understand, and sign off on the policy and any updates.

• Enforce the policy in a reasonable and fair manner. Thoroughly document violations and disciplinary actions.

Creating, implementing, and enforcing a social media policy at your medical practice is a must in 2017.