CVS Pays $2.25 Million and Toughens Practices to Settle HIPAA Privacy Case

The U.S. Department of Health and Human Services and the Federal Trade Commission today announced that CVS, the nation’s largest retail pharmacy chain, will pay the U.S. government a $2.25 million settlement and take corrective action to ensure it does not violate the privacy of its millions of patients when disposing of patient information such as identifying information on pill bottle labels.  The settlement, which applies to all of CVS’s more than 6,000 retail pharmacies, follows an extensive investigation by the HHS Office for Civil Rights (OCR) for potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.

In a coordinated action, CVS Caremark Corp., the parent company of the pharmacy chain, also signed a consent order with the FTC to settle potential violations of the FTC Act. OCR, which enforces the Privacy Rule, opened its investigation of CVS pharmacy compliance with the Privacy Rule after media reports alleged that patient information maintained by the pharmacy chain was being disposed of in industrial trash containers outside selected stores that were not secure and could be accessed by the public.

At the same time, the FTC opened an investigation of CVS. OCR and the FTC conducted their investigations jointly. This is the first instance in which OCR has coordinated investigation and resolution of a case with the FTC. “OCR is committed to strong enforcement of the HIPAA Privacy Rule to protect patients’ rights to privacy of their health information. We hope that this agreement will spur other health organizations to examine and improve their privacy protections for patient information during the disposal process,” said Robinsue Frohboese, acting director of OCR. “Such safeguards will benefit consumers everywhere.”

The Privacy Rule requires health plans, health care clearinghouses and most health care providers (covered entities), including most pharmacies, to safeguard the privacy of patient information, including such information during its disposal. Among other issues, the reviews by OCR and the FTC indicated that: * CVS failed to implement adequate policies and procedures to appropriately safeguard patient information during the disposal process; and * CVS failed to adequately train employees on how to dispose of such information properly. Under the HHS resolution agreement, CVS agreed to pay a $2.25 million resolution amount and implement a robust corrective action plan that requires Privacy Rule compliant policies and procedures for safeguarding patient information during disposal, employee training and employee sanctions for noncompliance.

HHS and FTC also will require CVS to actively monitor its compliance with the resolution agreement and FTC consent order. The monitoring requirement specifies that CVS must engage a qualified independent third party to conduct assessments of CVS compliance and render reports to the federal agencies. The HHS corrective action plan will be in place for three years; the FTC requires monitoring for 20 years.

The HHS Resolution Agreement and Corrective Action Plan can be found on the OCR Web site at OCR has posted new FAQs that address the HIPAA Privacy Rule requirements for disposal of protected health information.

They can be found on the OCR Web site at

Information about the FTC Consent Order agreement is available at .


Lack of policy adds to e-discovery cost and complexity — Large percentage of companies lack legal holds

IT and legal teams must work together to establish e-discovery policies. In fact, one-third of companies lack formal policies and procedures for legal holds, according to a recent poll of attorneys and executives conducted by Deloitte. A legal hold is the process by which companies preserve evidence subject to discovery for lawsuits and other legal and regulatory matters. In this increasingly litigious society, it’s likely IT will have to hand over e-mails and backup files.

“Given the relatively low cost of establishing a policy framework and processes to address legal hold issues, it is surprising to see such a large percentage of corporate America lacking in this area,” says Jeff Seymour, a principal with Deloitte Financial Advisory Services analytic and forensic technology practice.

Respondents indicated responding to discovery requests has become significantly more complicated and costly. And less than one-third indicated their companies are very or extremely effective in managing the readiness aspect of the discovery process. Worse, 5% said the guidance provided to IT on litigation hold polices was unclear and 35% said it was only somewhat clear.

For more see

Amid scandal, NY archivist calls for better record keeping

Albany Bureau

ALBANY — The state’s archivist warned Tuesday that New York may be entering the “digital dark ages” if it doesn’t better account for electronic records being produced at the state Capitol.

The strong message from Archivist Christine Ward came during a hearing by Senate Republicans on accusations that the Spitzer administration had deleted emails and other records pertaining to the so-called Troopergate scandal.

A Spitzer spokesman said all records have been retained.

The Senate Investigations Committee called witnesses to testify on whether emails and other electronic records could be easily destroyed or retrieved. Experts said that in most cases, records could be recovered through forensic technology.

But Ward gave the most compelling testimony, warning that in the electronic age it’s becoming increasing difficult to file documents in the state archives, which are kept in Albany.

For instance, she said advances have made it difficult to even access old technology, such as using old floppy computer discs. Moreover, information is often deleted inadvertently, she said. She called for new laws to better outline how public electronic records should be kept.

“We are faced with the very real possibility that much of our state’s modern history is in danger of being lost,” she said.

Last year, Spitzer aides were accused of compiling travel documents on Senate Republican Majority Leader Joseph Bruno’s use of a state helicopter, claiming he used the aircraft for political purposes.

While state Attorney General Andrew Cuomo and the Albany County District Attorney’s office found no criminal wrongdoing, Bruno and other critics have blasted the Democratic administration, and Spitzer suspended then-communications director, Darren Dopp, for his role in the scandal.

For more on this story, see

Football player files missing – Fingers point to Rodriguez

By Dave Hickman
Staff writer

MORGANTOWN ­- West Virginia officials are wondering if assistant coaches aren’t all that Rich Rodriguez took with him to Michigan. They believe he may also have destroyed all or most of the paperwork files relating to every player on the current Mountaineer roster and virtually all of the activities conducted by the program over the past seven years.

Soon after returning to work after the Fiesta Bowl a little more than a week ago, the staff at the Puskar Center found that most of the files ­ including all of the player files ­ that had been stored in Rodriguez’s private office were missing. In addition, all of the players’ strength and conditioning files in the weight room were gone.

“It’s unbelievable. Everything is gone, like it never existed,” said a source within the athletic department, who spoke on the condition of anonymity. “Good, bad or indifferent, we don’t have a record of anything that has happened.”

According to the source, the files in Rodriguez’s office that are now missing included everything from records regarding summer camps ­ financial and otherwise ­ to data on boosters, recruiting and most everything related to activities within the program during Rodriguez’s seven years at WVU.

Most disturbing, though, is the absence of all of the players’ personal files, which included, among other things, contact information, scholarship money awarded, class attendance records and records on personal conduct and community service, be it positive or negative.

“If a player spoke to a school or did public service, we don’t have a record of it,” said the source. “If he broke a rule or missed class, we don’t have a record of that, either. We don’t have anything. All the good things these kids have done over the years, there’s nothing ­ not a picture of somebody speaking to a class, nothing. Why would somebody do that?”

West Virginia athletic director Ed Pastilong did not return a message seeking comment Monday night. Neither could Rodriguez be reached for comment.

The files went missing sometime between when Rodriguez resigned on Dec. 16 and the time the team and staff returned from the Fiesta Bowl on Jan. 3. It could have happened as early as the first days following Rodriguez’s resignation because his old office was largely ignored by the support staff and the coaching staff between the time he left and Dec. 26, when the team and support staff all went to Arizona for the Fiesta Bowl.

According to multiple sources, several people in the Puskar Center reported seeing Rodriguez and at least one member of his inner circle, video coordinator Dusty Rutledge, in Rodriguez’s private office shredding paperwork on Dec. 18.

That’s the day he returned to clean out his office after being introduced as the Michigan coach at a press conference in Ann Arbor the day before. At the time, those who say they witnessed it either did not know what was being destroyed or paid it little attention to it until the files were discovered missing more than two weeks later.

While the files in Rodriguez’s office held a wide range of information, those that were discovered missing from the weight room office were more specific.

Those included every aspect of strength and conditioning progress made by players under former strength and conditioning coordinator Mike Barwis, who along with most of his immediate staff followed Rodriguez to Michigan after the Fiesta Bowl. Those files included the progression made by each player in every specific area, from bench-press totals to 40-yard dash times. The files even included pictures of the players at different points in their careers.

While a source within the athletic department said the department itself wasn’t launching any type of investigation into the missing files ­ “Our plate is pretty full right now with trying to put together a staff and everything else,” the source said, “and we don’t have time to deal with [stuff] like this right now.” ­ it has apparently drawn the interest of the university’s legal counsel.

WVU lawyers are in the process of trying to recover $4 million from Rodriguez as a condition of breaking his contract with six years remaining to become the coach at Michigan. While Rodriguez has maintained that West Virginia breached the contract by not fulfilling all of its terms ­ an argument the university denies ­ the school filed suit in Monongalia County Circuit Court last month detailing what it claims are breaches by Rodriguez above and beyond simply breaking the contract. Those include calling recruits to tell them of his decision to switch schools before he told his own team. It certainly would not help Rodriguez’s case if the school can prove that he also destroyed what WVU officials consider state files on his way out.

Companies Still Struggling To Find Way on E-Discovery

By Beth Bar
December 20, 2007

One year after revisions to the Federal Rules of Civil Procedure (FRCP) were put in place to address confusion and increased costs associated with electronic discovery, corporations are still struggling to comply with the new guidelines.

“Companies are taking a pro-active approach to electronic discovery,” said Allison L. Brecher, who is litigation counsel and e-discovery coordinator at Marsh & McLennan Companies. “The burdens of compliance, though, remain very difficult.”

Although it may be too early to gauge the ultimate impact of the rules, which went into effect on Dec. 1, 2006, attorneys agree that businesses are spending more money and time on electronic discovery.

The stakes are high. Companies that neglect the new obligations may face sanctions if they cannot produce evidence sought in litigation.

The short-term burdens of complying are reflected in several recent surveys.  Some of the findings:

  • Almost 55 percent of the 140 in-house counsel surveyed by the e-discovery consultant Lexakos said their companies needed to spend more time developing e-discovery and litigation readiness plans.
  • Fifty two percent agreed that they had to improve their litigation hold procedures, which require companies to preserve all data that may relate to a legal action involving the company. And almost half expressed the need to develop a process to segregate privileged communications and thus avoid high document review costs.
  • Of the 76 people surveyed by Lexis Nexis at the Association of Corporate Counsel’s annual meeting, 44 percent said that their companies had not been prepared for the new rules. Although 61 percent said they were now very or somewhat confident that they were fully compliant, 30 percent still said that they were not very confident and 5 percent not at all confident.
  • Twenty seven percent of respondents to a litigation trends survey released earlier this year by Fulbright & Jaworski said that the rules have made handling of e-discovery issues in federal litigation more difficult. Eighteen percent said they have made the process at least somewhat easier. The remainder detected no change.

The amendments includes revisions and additions to Rules 16, 26, 33, 34, 37 and 45, as well as Form 35. Among the matters addressed were the definition of discoverable material, the procedure for asserting privilege or work product after production and the early attention to electronic discovery issues.

The new protocols have made e-discovery compliance a prime litigation issue. H. Christopher Boehning of Paul, Weiss, Rifkind, Wharton & Garrison said that cases are increasingly being dismissed or companies heavily sanctioned based on the loss of electronic evidence.

“Cases are being derailed as a result of discovery issues,” Mr. Boehning said. “You want cases to be decided based on the merits, not on an e-discovery sideshow.”

So far, Mr. Boehning said, the rules have not improved the situation.

“Everybody is still trying to find their way,” he said.

Under the revised rules, parties have no initial duty to produce electronic data that is reasonably identified as inaccessible. A judge, however, can still order the evidence to be produced if she or he deems that there is good cause.

The rules also allow for a subpoena to be served to “permit inspection, copying, testing, or sampling” of electronically stored information.

This occurred in the recent Southern District case, Bridgeport Music v. UMG Recordings, 05 Civ. 6430. In this copyright infringement dispute, defendants UMG Recordings, Napster, Apple Computer and Yahoo! deposed attorney Stewart L. Levy, a nonparty, during discovery and subsequently issued a subpoena seeking production of certain licencing agreements for “new media.”

Bridgeport Music and Southfield Music argued that production of these documents would be unduly burdensome. But Magistrate Judge James C. Francis IV disagreed. In a decision that will be published in the Law Journal on Dec. 27, he ruled that the burden of production was “not so great as to justify quashing the subpoena, even if it is imposed upon a nonparty such as Mr. Levy.”

Costs for complying with the new discovery rules can run into hundreds of thousands of dollars.

High Cost of Preservation

Courtney Ingraffia Barton, an attorney who is vice president of industry relations for LexisNexis Applied Discovery, and Deborah House, Association of Corporate Counsel’s vice president and deputy general counsel, said that one of the biggest challenges companies are facing is securing the resources to implement a system that addresses electronic discovery issues.

David J. Lender, a partner at Weil, Gotshal & Manges, acknowledged that creating an electronic document preservation system is costly, but said that companies save money in the long run because they save on litigation expenses by having a system already in place.

And Adam I. Cohen, co-chair of the New York State Bar Association’s e-discovery committee, said that a documented process for handling information is beneficial in litigation.

“If mistakes are made you can defend your good faith by showing that you have devoted resources and developed methods” for dealing with this type of data, Mr. Cohen said.

Ms. Brecher of Marsh & McLennan, said her company was using a “team-based” approach.

“We are partnering with the IT department, and educating each other,” Ms. Brecher said.

She said that sometimes this education takes the form of training sessions and may involve bringing an information technology colleague to an e-discovery seminar.

Patrick Oot, director of electronic discovery and senior counsel in Verizon’s legal department, said that his company has developed a litigation manual that identifies the company’s policies with regards to electronic document preservation. It also identifies the specific actions that information technology and in-house legal counsel must take.

He said that having some type of efficient and uniform process for dealing with data requests is “invaluable.”

However, Robert D. Owen, a partner at Fulbright who is co-head of the firm’s e-discovery and information management practice group, said that rather than instituting e-discovery policies, many companies have decided to play “the e-discovery lottery.”

“They have decided to take the chance that they won’t be hit,” Mr. Owen said. “It’s a gamble.”