HIPAA Alert: Judge Upholds $4.3 Million in Penalties against a Medical Center for Failing to Secure Laptops and USB Drives

On June 1, 2018, a Judge granted summary judgment in favor of the government and against a medical center, upholding over $4.3 million in civil monetary penalties for alleged HIPAA violations.

In Director of the Office for Civil Rights v. The University of Texas MD Anderson Cancer Center, the Department of Health and Human Services Office of Civil Rights (OCR) alleged the medical center failed to comply with HIPAA by (1) failing to secure electronic devices and data storage equipment, and (2) allowing electronic protected health information (ePHI) to be disclosed for over 30,000 patients.  The OCR investigated the medical center after the theft of an unsecured laptop and loss of two USB thumb drives. The laptop and USB drives were neither password-protected nor encrypted.

The medical center denied that HIPAA requires the encryption of devices and denied that there was an “unlawful disclosure” as there was no evidence that the lost or stolen information was received or viewed by anyone.  The Judge reasoned that a covered entity is not required to guarantee the safety of ePHI, but must reasonably safeguard PHI from unlawful disclosure. 45 C.F.R. Section 164.312(a)(1). While covered entities have flexibility to decide how the information is protected, it must be effective. By failing to encrypt or password protect the lost or stolen devices, the medical center failed to ensure its systems and devices containing ePHI were inaccessible to unauthorized users. The Judge also reasoned that the purpose of HIPAA is to protect against failures and omissions by covered entities that might result in such consequences as identity theft or other invasions of privacy, and that it would be impossible in most instances to determine whether the information contained on the lost and stolen devices resulted in an individual’s identity theft. The judge distinguished this case from a private suit for damages, in which courts have held there is no cause of action absent proof that an unauthorized individual or entity received the information and proof of damages.

In summary, the U.S. Department of Health and Human Services Departmental Appeals Board Judge ruled that the medical center violated HIPAA privacy and security rules, granted summary judgment in favor of the OCR, and upheld the OCR’s civil monetary penalties in the amount of $4,348,000.

A copy of the 17-page decision can be found here. Please do not hesitate to contact Lowis & Gellen’s HIPAA Compliance Officer, Kristin Ahmadian, or any of the attorneys at Lowis & Gellen, LLP should you have any questions.

Hold the Mayo: Vanda Ruling Reviews Patent Subject Matter Eligibility

By: Michael J. Weil

In the spring of 2018 a significant decision by the Federal Circuit, Vanda v. West-Ward , cut a distinct path though the controversial Mayo and Alice rules for evaluating subject matter eligibility of patents.

Relevant Case Background

The case is multifaceted; this article will focus on the Vanda court’s interpretation of Patent Subject Matter eligibility under 35 U.S.C. § 101. The suit revolved around Vanda’s schizophrenia drug Fanapt® (iloperidone). Vanda owned a patent which utilized a method of treating schizophrenia patients with iloperidone. Specifically, Vanda’s method employed a dosage range based on a patient’s genotype. West-Ward pharmaceuticals manufactured a generic version of Fanapt® and utilized a similar method—West-Ward’s “proposed generic drug label recommended that physicians perform genotyping tests on iloperidone patients.” West-Ward claimed that because Vanda used a person’s genotype (a natural phenomenon) in its method, Vanda’s patent was invalid. West-Ward used precedents known in patent law as the Mayo test and the Alice test, discussed below, to make its argument. Based on its invalidity contention West-Ward filed an Abbreviated New Drug Application (ANDA); if granted the ANDA would allow West-Ward to market its generic product before expiration of Vanda’s original patent. Vanda responded by suing for infringement, claiming that their patent was valid because it transformed the natural process into an inventive concept.

Mayo and Alice Tests

The Mayo Test consists of two steps. The first step states that when evaluating the validity of patent, courts must find whether the contested patent claims are “directed to a patent-ineligible concept.” If the concept is patent eligible, the test is satisfied. However, if the concept is not patent eligible the courts must next evaluate whether the elements of each claim, both individually and in combination, transform the law of nature into a patentable application. “To transform an un-patentable law of nature into a patent-eligible application of such law, one must do more than simply state the law of nature, while adding the words ‘apply it’…it must limit its reach to a particular, inventive application of the law.”

From the precedent set in Mayo, courts have inferred that if a patent employs natural phenomena—such as a method which utilizes a natural process—the patent must limit its reach to a particular concept. Under the Mayo Test an inventor should demonstrate that he or she has staked a claim to a particular aspect of nature, and developed that aspect in a unique way–thereby converting it into a human-made invention. Like the Vanda case, the concept specifically discussed in Mayo related to the concentration of certain metabolites in the bloodstream. In Mayo, the court ruled that the process of deciding whether to increase or decrease the dosage of a drug based on the measurement of metabolites failed both prongs of the court’s test, and thus, was not eligible for patent protection.

Ultimately, the Mayo court urged caution in granting patents that employed natural phenomena out of concern that “patent law not inhibit future discovery by improperly tying up the use of laws of nature and the like.”

Similarly, the Alice Test uses a two-step framework that is influenced by the Mayo Test. The Alice test states that to determine patentability, the court must: determine whether the claims at issue are directed to a patent-ineligible concept, and if the concept is ineligible search for the ‘inventive concept’ —i.e., “an element or combination of elements that is “sufficient to ensure that the patent in practice amounts to significantly more than a patent upon the [ineligible concept] itself.” In Alice the patent in question related to a computer-implemented, electronic escrow service which helped facilitate financial transactions. The court in Alice ruled that the financial facilitator was an abstract idea, and therefore fell out of the realm of patent protection. Regarding the second step, “The mere recitation of a generic computer cannot “transform” a patent ineligible abstract idea into a patent eligible invention.”

The decisions have been controversial. Critics have pointed out that the decisions significantly hamper the ability to obtain new patents in fields such as software and medicine. Gene Quinn, a well-known patent practitioner, has voiced major concern over the rulings—particularly Alice. Quinn critiques three aspects of Alice: 1) There is no objective standard for judging patent-eligibility; the test is completely subjective; 2) Other than by resort to analogy to specific patented inventions in prior cases, there is no definition of what “abstract idea” or “something more” means in the Alice test; and 3) Alice fails to provide any guidance for “reaching the patent eligibility zone.” Additionally, in the wake of the rulings, many previously granted patents have been challenged and invalidated. The judicial trend has largely been to cast a wide net and strike down most patents that invoke natural phenomena.

Applying the Tests

In Vanda, the court laid out the tests for patent eligibility articulated in Mayo and Alice. Next, in a relatively surprising move (given the precedent set in the Mayo case) the court ruled that Vanda’s process was a new way to treat a disease–not merely a solicitation of an existing natural process. The court ruled that the process was patentable, fulfilling step one of both the Mayo and Alice tests: “Unlike the claim at issue in Mayo, the claims here require a treating doctor to administer iloperidone…depending on the results of the genotyping assay. The specification further highlights the significance of specific dosages and how certain ranges (of dosage) correlate with risk…thus, the claims are ‘a new way of using an existing drug’ that is safer for patients because it reduces risk.” Furthermore, in the Mayo case a doctor could violate the patent, even if he did not actually alter his treatment decision in light of the genetic tests. To paraphrase, the court in Mayo ruled that the patent in question was invalid because the patent impermissibly covered the metabolic process itself without a sufficient man-made application. In contrast, the Vanda court held that Vanda’s patent was tied specifically to the dosage or treatment regiment based on the results of the genetic testing, and was specifically tailored to cover the relationship between the genotype of the patient and the dosage. This limited the application of the natural phenomenon in a patentable way: “These are treatment steps. In contrast, the claim in Mayo stated that the metabolite level in blood simply “indicates” a need to (alter) dosage, without prescribing a specific dosage regiment…” Hence, the court ruled that treatment steps are patentable, even if they utilize a natural phenomenon; therefore, step one of both the Mayo Test and the Alice Test is satisfied and there is no need to move onto step two– seeing if there is an inventive concept involved.

Impact

The court’s ruling in Vanda may potentially pave the way for a re-interpretation of the rules set forth in Mayo and Alice. In theory, Vanda may even turn the tide back toward a more “expansive” and “broadly inclusive” interpretation of patent eligibility as set forth in Diamond v. Chakrabarty. The ruling also could also be a first salvo in the push to loosen the strictures on patents relating to abstract ideas or natural phenomena. Finally, given that the court did not elaborate on the second step of the Alice and Mayo tests, it remains to be seen if the second step is altered. Overall it will be fascinating to track the courts use of Vanda—will it become a new precedent regarding patent subject matter eligibility or merely an outlier?

If you have questions about the article, email mweil@lowis-gellen.com

Bryan Larsen wins a “Not Guilty” verdict for a L&G client in a case where the co-defendants had a $1.9 Million judgment entered against them

Congratulations to Bryan Larsen (with Local Counsel Lynne Nahmani). Bryan’s client, a physician and medical group, received a not guilty verdict this afternoon in a case where his co-defendants were found guilty. The case was on trial for 5 weeks in Ocean County (Toms River), New Jersey, and closing arguments were Friday. The case was transferred to the firm in April and was extremely complex in both the substantive medicine and in having to learn New Jersey law. Bryan did a fantastic job, as always.

Cahill and Pietras Present “Creditor Boot Camp” webinar to the Business Credit Management Association and Wisconsin Credit Association

On May 22, 2018, Allison Pietras and Christopher Cahill presented “Creditor Boot Camp,” an on-line webinar in the Legal Tuesdays Series sponsored by the Wisconsin Credit Association (see wcacredit.org). There are five remaining webinars in the Legal Tuesdays Series, covering, respectively: proofs of claim and claims trading (Sept. 11), dismissal and conversion of bankruptcy cases (Oct. 9), preference litigation (Nov. 13), fraudulent transfer litigation (Dec. 19), and equipment leasing (Feb. 12, 2019).

Jim Bream Presents on “Pitfalls, Perils and Promising Possibilities of Current Communications Outside the Chart”

On Saturday, April 28, Lowis & Gellen’s Managing Partner, Jim Bream, was the closing speaker at the Internal Medicine Update Symposium held at Silver Cross Hospital in New Lenox. Jim’s presentation addressed “Pitfalls, Perils and Promising Possibilities of Current Communications Outside the Chart” for medical professionals. This engaging and highly relevant presentation is ideal for nursing staffs and medical staffs engaged in communications with colleagues and patients regarding patient care. If you or your organization might find this presentation of interest to your staff, please contact us at Lowis & Gellen.

Andrea Kott and Patrick Viktora Present “Avoiding Harassment Claims in Your Practice”

L&G’s Andrea Kott and Patrick Viktora presented “Avoiding Harassment Claims in Your Practice” yesterday to a major Chicago hospital system. The presentation was designed to educate and remind healthcare providers of the importance of knowing what constitutes harassment in the work place, as well as provide guidance on how to avoid and protect from claims brought by patients and co-workers.

Stop the music? Spotify sued for $1.6 billion

By Michael J. Weil

(Originally published in ISBA March 2018 Intellectual Property Newsletter)

On December 29, 2017 Wixen Music Publishing Inc. filed a lawsuit in California Federal Court which could impact millions of music fans in the U.S. and around the world. The complaint, lodged against the popular music service Spotify, alleges that Spotify has been streaming thousands of Wixen’s songs without permission. In response, Wixen seeks a staggering $1.6 Billion in monetary damages, in addition to injunctive relief. This is a significant development because Wixen is the exclusive licensee of several popular Spotify tracks including: “Free Fallin’” by Tom Petty, “Light My Fire” by the Doors, and “(Girl We Got a) Good Thing” by Weezer. Furthermore, Wixen also owns rights to songs by Steely Dan, Stevie Nicks and Neil Young, and administers “more than 50,000 songs written and/or owned by its more than 2,000 clients”. The publisher alleges that its songs were downloaded and streamed “billions of times” through Spotify’s Service.

Wixen’s complaint invokes parts of the United States Copyright Act. Under the Copyright Act, there are two separate copyrights inherent in every recorded song. First, there is a copyright in the sound recording (the original or “master recording”). Second, there is a copyright in the musical composition–for example, a song’s words and musical notes. Moreover, streaming services like Spotify are required to pay “mechanical royalties”. The mechanical royalties are covered through a mechanical license, which grants streaming services a broad license for a set rate. When applying for a mechanical license, the licensee is obligated to file a formal “notice of intent” or “NOI” with the Copyright Office. In this case, Wixen contends that Spotify did not obtain the required composition and mechanical licenses. Furthermore, Wixen states that Spotify did not publish a Notice of Intent.

The Wixen case is the latest in a recent line of lawsuits against Spotify. In the summer of 2017, a settlement in the class action case of Ferrick et.al. v. Spotify USA Inc. awarded over $43 million to song owners for past unauthorized uses. Additionally, Spotify had to pay the National Music Publishers’ Association roughly $25 million in a private settlement for similar infringement allegations. However, both of the settlement amounts fall well below the $1.6 Billion being requested by Wixen.

In addition to the money involved, the Wixen case is significant because it could be the last of its kind. Congress currently is evaluating a new law called the Music Modernization Act (“MMA”). Some music licensors fear that the Act will make it much harder to obtain restitution for copyright infringement:  “If the Music Modernization Act passes the bill ‘would eliminate important legal remedies’ for any music publishing company’s lawsuits…filed after January 1st, 2018.”  Conversely, proponents of the MMA say that the Act would create a much needed blanket license, along with a new agency and song database, aimed at modernizing America’s outdated music laws. For example, many of the laws governing United States music copyright were drafted in an era when phonographs were the predominant “music streaming” device. Accordingly, many legislators argue that the U.S.’s music laws are not suited to contemporary methods of music consumption—especially digital streaming services; as a result the bill has bipartisan support in Congress.

Finally, in addition to updating the copyright laws, the Music Modernization Act would require a change in controversial royalty rate setting practices. Currently, there is a labyrinthine method for calculating music royalty rates taking into account “service type”, like terrestrial radio, satellite radio, etc. as well as “type of copy” (ranging from a physical record to a ringtone). The result of this process is that digital forms of music cost the licensee multiple times more than physical forms. For example, a ringtone recently has been valued at 24 cents per song fragment in royalties while a record is $.091 per song or $.0175 per minute of playing time.  The MMA’s supporters say that instead of having rigid rate setting based on copy and service type, the Act will open rates up to a “willing buyer/seller marketplace”.

Given these recent developments, 2018 looks to be a watershed year for music law. By the end of the year, music streaming services will likely have a clearer sense of the regulatory framework they must navigate. Moreover, if the MMA gets passed, the U.S. musical copyright laws will receive a long-overdue revamping. Overall, it will be intriguing to keep an eye on both Wixen and the MMA’s development in the months ahead.

Michael J. Weil is an associate and licensed patent attorney at Lowis & Gelien LLP in Chicago. Michael can be reached at mweil@lowis-gellen.com.

Chris Cahill Appears on his 33d Financial Poise Webinar

Christopher Cahill appeared on March 13, 2018 as a panelist on the live webinar Credit Insurance – 101, co-produced by Financial Poise and West LegalEdCenter. Chris spoke on how trade credit insurance interacts with bankruptcy law when non-paying United States customers become debtors.