OCR Announces a Settlement … Again; HHS Eases Restrictions on Mental Health Information Sharing to Facilitate Gun Control Efforts; Facebook: Users Lack Standing in Cookie MDL; Plaintiffs Argue for Summary Judgment in $5 Million Twitter TCPA Suit

OCR Announces a Settlement … Again

For the second time this week, OCR announced another huge settlement. The basis for the settlement arose in 2012, when one of the Feinstein Institute for Medical Research’s laptops was stolen from the backseat of an employee’s car.  The unencrypted, password-protected laptop contained electronic health information for patients and research participants, including their names, social security numbers, and medical information.  During the investigation of the incident, OCR found that the institution had insufficient and incomplete policies to address potential risks to the confidentiality, integrity, and availability of the electronic health records it held.  Like other recent settlements, this settlement relates to an incident that occurred many years ago – which may be a sign that OCR is continuing to clear out its backlog in the face of recent criticism that OCR has done too little to enforce HIPAA.

HHS Eases Restrictions on Mental Health Information Sharing to Facilitate Gun Control Efforts

On March 9, 2016 HHS issued a final rule creating an express permission allowing certain entities to report some mental health information to the National Instant Criminal Background System (NICS). In most cases, federally licensed firearms dealers must conduct a search in the NICS to determine whether a potential buyer has a “mental health prohibitor,” such as being involuntarily committed.  However, before HHS passed this new rule, some entities faced challenges reporting mental health prohibitor information to the NICS.

Under the new rule, however, covered entities may report protected health information (PHI) to NICS, subject to some restrictions. First, treating providers may not disclose PHI regarding their own patients and only entities that order involuntary commitments, act as state repositories for mental health prohibitor information, or conduct mental health adjudications may disclose.  Secondly, those entities may only disclose limited demographic information and other information necessary for NICS reporting.  The rule does not allow the reporting of diagnostic or clinical information.  This new rule is part of a larger effort on behalf of the Obama administration to curb gun violence through executive action and may be a sign of further changes to come.

Facebook: Users Lack Standing in Cookie MDL

On Thursday, Facebook argued that the Northern District of California should dismiss plaintiffs’ second amended complaint based on users’ allegations that the social media service tracked their internet activity after being logged out of the service.  The suit alleges that Facebook used cookies to monitor when users viewed webpages with Facebook “like” or “share” buttons even if they had logged out of the service.  Facebook argued that the users could not show concrete and particularized harm without identifying which specific communications or URLs the service improperly obtained.  Establishing standing is often a significant hurdle for plaintiffs in privacy suits and remains a hot issue in light of the Supreme Court’s pending Spokeo ruling.

Plaintiffs Argue for Summary Judgment in $5 Million Twitter TCPA Suit

Plaintiffs in Twitter’s $5 million TCPA suit moved for summary judgment on Thursday.  Lead plaintiff Beverly Nunes filed suit against the social media giant in the Northern District of California in June 2014, alleging that Twitter sent her unwanted text messages en masse.  Earlier this year, Judge Chhabria denied Twitter’s Motion to Dismiss, holding that the TCPA applied to the texting technology at issue holding that the Act applied to “any equipment that stores telephone numbers in a database and dials them without human intervention.”  This suit continues the trend of TCPA suits targeting unwanted texts, such as $15 Million Life Time Fitness suit which settled last year.