By: Christopher A. Parrella, Esq., CPC, CHC, CPCO Parrella Health Law, Boston, Ma. A Health Care Provider Defense and Compliance Firm

A recent decision in Dusterhoft v. OneTouchPoint Corp., from the Eastern District of Wisconsin, sheds light on the critical need for healthcare entities, known as HIPAA “Covered Entities,” to diligently assess and monitor their Business Associates for privacy compliance. The court’s ruling allows the putative class action to proceed, illustrating the potential liability for Covered Entities if their Business Associates fail to secure patient information.

In this case, OneTouchPoint Corp., a brand management and logistics provider for healthcare entities, experienced a breach affecting 2.6 million individuals’ data, including Social Security numbers, health insurance information, and other sensitive data. The breach impacted patients across nearly 40 health insurers and providers, sparking a class action from plaintiffs in multiple states.

Plaintiffs argued that they suffered injuries by spending time and resources to mitigate the breach’s effects. While the court dismissed the plaintiffs’ claims based solely on a reduction in the value of their information, it ruled that the time and effort spent to prevent further harm was sufficient for legal standing. Importantly, the court also allowed the negligence and negligence per se claims to advance, rejecting OneTouchPoint’s argument that HIPAA and the FTC Act do not provide a private right of action. This decision leaves open the possibility of similar claims against other Covered Entities if their Business Associates experience data breaches.

The implications are clear: Covered Entities should rigorously evaluate Business Associates’ data protection measures, consider contractual requirements for security audits, and insist on indemnification for breaches. This case serves as a crucial reminder for healthcare entities to prioritize robust due diligence to protect both their patients and themselves from costly litigation.

At Parrella Health Law, we can assist you with developing and implementing rigorous compliance programs that cover every aspect of Business Associate due diligence. Contact us at 857.328.0382 or reach out to Chris directly at cparrella@parrellahealthlaw.com to learn more.