A recent resolution agreement between the United States Department of Health and Human Services, Office for Civil Rights (HHS) and Idaho State University (ISU) requires payment of $400,000 and implementation of a corrective action program to address the breach of unsecured electronic protected health information (ePHI) of approximately 17,500 patients.  According to public information published by HHS (U.S. Department of Health & Human Services), ISU notified federal regulators of a breach and cooperated with an investigation headed by OCR (HHS Office for Civil Rights).   “Risk analysis, ongoing risk management, and routine information system reviews are the cornerstones of an effective HIPAA security compliance program,” said OCR Director Leon Rodriguez. “Proper security measures and policies help mitigate potential risk to patient information.” HHS Press Release

The key findings of the investigation were as follows:

  1.  ISU did not conduct an analysis of the risk to the confidentiality of ePHI as part of its security management process from April 1, 2007 until November 26, 2012;
  2.  ISU did not adequately implement security measures sufficient to reduce the risks and vulnerabilities to a reasonable and appropriate level from April 1, 2007 until November 26, 2012; and
  3.  ISU did not adequately implement procedures to regularly review records of information system activity to determine if any ePHI was used or disclosed in an inappropriate manner from April 1, 2007 until June 6, 2012.

See Resolution Agreement Here.  It should be noted that ISU admitted no fault.

Seen in a broader context, data breach is increasingly costly for public entities and private companies alike. Regulatory action and potential civil liability are on the increase under HIPAA and across all business sectors. For example the Federal Trade Commission (FTC ) regularly addresses circumstances where private companies engage in unfair or deceptive acts involving customer data or  fail to follow their privacy polices specially where children are concerned.

Click here for a summary of laws and resources for business on data privacy and security including information on:

  • Children’s Online Privacy Protection Act (COPPA)
  • The Gramm-Leach-Bliley Act
  • U.S.-EU Safe Harbor Framework

All businesses should have a risk assessment completed and should implement reasonable practices and procedures for securing data, especially electronic protected health information (ePHI) or other personally identifiable  information (PII). The FTC publication Protecting Personal Information: A Guide for Business . A Privacy and Data Security attorney can work with businesses to reduce the risks associated with potential data breach. Another thing to consider is insurance for cyber liability and data breach which is increasingly available at reasonable prices. Consult your insurance professional for more information on available coverage and costs. 

The SJC recently affirmed the Massachusetts Appeals Court’s  ruling that a commercial landlord whose tenant broke a 12 year lease after only two years has to wait until the lease term expires before collecting damages.

In 275 Washington Street Corp. v. Hudson River International, LLC, the landlord and tenant entered into a 12 year lease for commercial space. The lease required the tenant to occupy and use the premises for a dental office and to pay the landlord monthly rent. The lease contained an indemnity provision which provided that “[t]enant shall indemnify Landlord against all loss of rent and other payments which Landlord may incur by reason of such termination during the remainder of the term.”

After one year the tenant closed its dental office and moved out of the premises but continued making payments for an additional year. At which point the tenant notified the landlord that it would be making no further rental payments and that it would not resume occupation of the premises.  The landlord subsequently re-entered the premises and signed a new ten year lease for the premises with a replacement tenant at a lower rent than was agreed on under the original lease.

In 2008 the landlord filed suit against the tenant and sought to recover all damages arising from the breach. The landlord subsequently prevailed on a motion for summary judgment as to liability. Prior to trial the parties stipulated to a judgment but the defendants reserved their right to appeal.

On appeal, the Appeals Court held that the bright line rule remains that a landlord must wait to collect damages until the end of the original lease term. While the Appeals Court affirmed the finding of liability in favor of the landlord, it vacated the judgment assessing damages and remanded to the trial court to calculate the damages as of the time the landlord recovered possession of the premises.

On subsequent appeal to the Supreme Judicial Court, the SJC held that it is well settled that when a landlord terminates a lease following the default of a tenant, the tenant is obligated to pay the rent due prior to the termination but has no duty to pay any rent that accrues after the termination unless the lease expressly provides.

The landlord’s argument regarding the indemnification clause in the lease also failed because the SJC said an indemnification clause only reimburses a landlord for actual losses and the precise amount of those losses would not be known until the end of the period specified in the lease.  The landlord argued the damages could be calculated because it had obtained a replacement tenant.

The SJC ruling underscores the importance of incorporating a clause in a commercial lease which explicitly describes the landlord’s remedies in the event of a default.  The decision makes clear that the law will not change to accommodate a landlord that failed to include a rent acceleration clause in its lease. To protect against a default landlords should insist on a rent acceleration clause to be part of the remedy provided for in the lease.  Otherwise, as in 275 Washington St, the landlord will have to wait until the end of the lease to collect damages. 

A scientific or technological advantage is something to be protected. A case in the Business Litigation Session of Suffolk Superior Court demonstrates how cutthroat competition can be in the medical device industry and how the law deals with companies that disregard fair trade practices to gain an unfair advantage.

In 2007, Lightlab Imaging, a company that provides OCT medical imaging for human coronary arteries, had developed the most powerful laser in the industry. Lightlab had a cooperative relationship with Axsun to convert Axsun’s basic laser into one that could be used by Lightlab. Volcano, a competitor of Lightlab, desired a foothold in OCT technology and was well behind in the research and development of a laser with similar capabilities.

 In 2008, Volcano acquired Axsun and viewed the acquisition as a means to both advance its entry into the OCT market and impede the growth of Lightlab. However, the contract between Lightlab and Axsun contained a confidentiality and exclusivity provision which prevented Axsun from selling high performance lasers to Volcano. In connection with Volcano’s indemnification of Axsun as part of the acquisition, Axsun breached its duty of confidentiality and provided Volcano with the specifications for the high performance laser.

In 2009, Lightlab filed suit in Suffolk Superior Court and its application for a preliminary injunction was granted. A subsequent jury trial on liability returned a verdict in favor of Lightlab finding that Axsun had violated the confidentiality provision of the contract with Lightlab. The jury also found that Volcano had misappropriated Lightlab’s trade secrets and interfered with Lightlab’s contract with Axsun.

Instead of trial on damages, the parties stipulated to damages of $200,000. Subsequently, after two jury waived trials, the Court granted Defendant’s summary judgment motion finding that Lightlab had not shown “use” of the trade secrets by Axsun and Volcano other than the due diligence use evidenced during the jury trial and therefore Lightlab had not proven misappropriation of those trade secrets.

On the 93A count, the court found that Lightlab was entitled to $200,000 in damages and because the defendant’s conduct was found to be knowing and willful, Lightlab received another $200,000 in punitive damages plus attorney fees which totaled $4,500,000.

The Supreme Judicial Court recently granted direct appellate review on whether the trial judge correctly excluded expert testimony on future lost profits on the grounds that the methodology used by the expert failed Daubert and was speculative and whether the trial judge correctly ruled that permanent injunctions may protect only specific trade secrets a defendant has already used.  The SJC is soliciting amicus briefs with argument scheduled for Fall of 2013. 

In business, a company or professional’s reputation is paramount. If your reputation is damaged you can suffer lost clients, customers and revenue. Social media has provided a new way for companies and individuals to have their reputation unfairly tarnished.

Social media provides an individual the almost instantaneous ability to broadcast a defamatory statement and reach a large audience. The law has begun to catch up. Recently, a Massachusetts court allowed a $1.5 million attachment of assets in a social media defamation case.  In Clay Corporation v. Colter a car dealership terminated an employee for cause as a result of inappropriate interactions with employees and customers. The employee had cancer and her brother started a social media campaign to disparage the car dealership.

The social media campaign was launched by the employee’s brother who claimed she was fired because she had cancer. The Facebook page created by the defendant garnered tens of thousands of likes and claimed the car dealership had discriminated against other employees with cancer and urged people to boycott the car dealership. The car dealership estimated that it lost over $100,000 in revenue as a result of the social media campaign.  

The car dealership filed suit. To prove a claim of defamation under Massachusetts law a plaintiff must prove that the defendant was at fault for the publication of a false statement regarding the plaintiff, capable of damaging the plaintiff’s reputation in the community, which either caused economic loss or is actionable without proof of economic loss.

In Clay, the Court found that the defendant’s statements on the Facebook page had no factual support. Further, the Court found that the car dealership had suffered a significant loss in business as a result of the social media defamation. Since the Court found that the statements made during the social media campaign were defamatory and the plaintiff had a reasonable likelihood of success on the merits the Court granted a $1.5 million attachment of the defendant’s assets.  

The ease with which a disgruntled individual can publish a new Facebook page or blast their false accusations across social media makes it very easy for a company to be significantly damaged in a short period of time. Cases such as Clay show that the law is catching up with these individuals and there is a remedy available if you or your company has been defamed through social media. 

A recent unpublished decision by the Massachusetts Appeals Court highlights the treatment of the at-will employment doctrine in Massachusetts.  See Nelson v. Anika Therapeutics, Inc., et al., 2012-P-0361 (memorandum and order pursuant to Rule 1:28, April 22, 2013).

Plaintiff was a quality control manager at a medical device company and claimed she had been wrongfully terminated. A routine inspection by the FDA resulted in a warning letter which stated the company was in violation of several federal regulations which required corrective action.  Employer alleged Plaintiff was fired as a direct response to the failures identified in the FDA inspection, many of which were attributable to plaintiff.

Plaintiff was an at-will employee. Under Massachusetts law, employment at-will can be terminated for any reason or for no reason. There are several recognized exceptions to this rule including when employment is terminated contrary to a well defined public policy. Firing an employee for enforcing safety regulations for which she was responsible has been held to meet that exception.

In response to the FDA warning letter, plaintiff stated she requested additional staffing in addition to communications aimed at fixing the violations found by the FDA. Plaintiff argued these actions should fall into the public policy exception described above.

The trial court held that plaintiff’s request for additional staff was merely a disagreement with company policy. The trial court then granted summary judgment for the employer because plaintiff’s conduct did not implicate public policy and thus was not within the realm of the public policy exception regarding whistleblowers.

The Appeals Court agreed with the trial court’s ruling. Massachusetts law does not protect at-will employees who claim to be fired for their complaints about internal company policies or the violation of company rules. There is a distinction between actions taken to enforce safety regulations and actions taken as a result of a disagreement with company policy, even if the employee’s actions may be considered appropriate and socially desirable. 

On Patriot’s Day, April 15, 2013, shortly before 3:00 p.m., two bombs went off on Boylston Street near the finish line of the Boston Marathon.  In addition to three deaths and 150+ injured, nearby property was damaged and businesses were closed up to a week for the investigation.  This was a grand scale calamity, the reason why people and businesses buy insurance:  so they are protected when the unexpected happens.  

Unfortunately, that insurance coverage might not be there.  In the wake of the attacks of September 11, 2001, Congress passed the Terrorism Risk Insurance Act (Pub. L. 107–297, 116 Stat. 2322) ,  reauthorized in 2007, creating the Terrorism Risk Insurance Program, administered by the U.S. Department of the Treasury.  In order to trigger the program, which would have the Federal government cover 85% of insured losses, there must be at least $5 million in property damage from a single event, plus over $100 million in damage from terrorism through the year.  In addition, the Secretary of the Treasury, Jack Lew,  along with the U.S. Attorney General Eric Holder and Secretary of State John Kerry, must certify that it is an “act of terrorism”.  This has a special meaning:  it must have been committed to affect U.S. policy or coerce citizens.  As the motives of the alleged bombers are not clear, such certification may never happen.

In addition, as reported in the Boston Globe, many insurance policies contain a rider specifically exempting coverage for property losses and business interruption where a certified act of terrorism has occurred.  Only 60% of businesses have purchased insurance that covers certified acts of terrorism, according to the Congressional Research Service

Thus, a dichotomy.  If the bombing is certified as an act of terrorism, the Federal government will pay 85% of insured losses for the 60% of businesses purchasing such coverage.  But, if it is not certified, then the exclusion affecting 40% of businesses will not be triggered.  Whichever occurs, the Raymond Law Group can help a business understand its rights and pursue all available insurance coverage, government programs, and those who caused this tragedy to occur.

A recent decision by the Supreme Judicial Court declared that sellers of shares in a closely held corporation did not breach their fiduciary duty when the sale imperiled the corporation’s favorable S corporation status. See Merriam, et al. v. Demoulas Super Markets, Inc., et al., SJC-11098 (slip op., March 27, 2013)

A closely held corporation sought a judgment that minority shareholders had a fiduciary duty not to sell their shares if the sale would terminate the corporation’s favorable S corporation status.

The corporation’s articles of organization restricted stockholders from freely transferring their stock by putting in place a familiar procedure whereby the stockholder must first offer his shares to the corporation, but thereafter describes a discrete process of valuation and subsequent offer at a price to be determined by arbitrators.

The SJC held that such a clause in the articles of organization be treated as a contract between shareholders and the corporation. The clause restricting free sale of shares was a bargained for procedure for disposing of interests in the corporation. If the corporation had wished the procedure to reflect the importance of S corporation status then it should have included that in the articles or bylaws.

A shareholder in a close corporation always owes a fiduciary duty to fellow shareholders, however good faith compliance with the terms of an agreement entered into by the shareholders will satisfy that duty. The corporation cannot later require a shareholder who wishes to sell to be bound by additional substantive restrictions on the sale of their shares based on an asserted fiduciary duty that goes beyond a restriction imposed in the original articles or bylaws.

The SJC therefore rejected the corporation’s argument that selling the shares, which could terminate its S corporation status, constituted a breach of contract or fiduciary duty. Further, the SJC rejected the corporation’s argument that the sellers were required to reoffer their shares to the corporation should the sellers decide to offer the shares to a third party at a price lower than the value determined by arbitrators.

Click Here to contact Raymond Law Group for assistance with shareholder issues involving closely held corporations.

The Supreme Judicial Court of Massachusetts ruled last week that a city cannot recharacterize vacation pay from a recently-terminated administrator.  The case centered on the 2007 termination of Gary Dixon, administrator of the McFadden Memorial Manor nursing home in 2007.   Dixon brought suit against the city of Malden, which operated the nursing home, seeking $13,700 in unused vacation pay.

Despite high quality evaluations, McFadden had proven unable to fill to capacity, and the cost of repair was estimated at $1 million.  Dixon was terminated while the city was deliberating whether or not to put public money toward renovation of the nursing home. 

The Superior Court dismissed the suit due to the city’s continued payment of additional pay and benefits, the Supreme Judicial Court reversed the decision.  The SJC instruced the Superior Court to award Dixon vacation pay, attorneys’ fees, and court costs.  The Supreme Judicial Court noted that payment of salary and benefits post-termination does not substitute for payment of unused vacation time, which was shown to be 50 days.  Under the Massachusetts Wage Act, a terminated employee is explicitly entitled to payment of unused vacation upon termination.

Massachusetts employers and employees alike should take heed of this ruling.  Raymond Law Group can help make sure clients are advised of the requirements of way payment laws. 

iphone.jpgIn October 2012, the Librarian of Congress, James H. Billington, decided to remove the unlocking of cell phones exemption from the Digital Millennium Copyright Act (DMCA). The act went into effect on January 26, 2013, and it made clear that consumers would not be able to unlock their cell phones on a different network without carrier permission, regardless of whether or not the user contract had expired.

The practical implication of this act is that individuals who travel abroad on business will be forced to pay expensive roaming fees in order to activate their cell phones instead of simply unlocking their phones for use on a local carrier network. Essentially, if you are abroad and you want to make a phone call, this act makes it impossible to do so cheaply, as the roaming fees will rack up substantially.

One justification offered for the non-renewal on the exemption for unlocking cell phones in the DMCA is that phones are now sold unlocked, including some versions of the iPhone and the Google Android Nexus 4. As Marguerite Reardon has observed however, these phones are much more expensive than ordinary phones as they are not subsidized by the carriers. In response to the act, a whitehouse.gov petition was immediately circulated, which got over 100,000 signatures and attracted the attention of the White House itself. The petition asked the White House to overturn the act, noting that this would result in heavy roaming fees, a reduction in consumer choice, and a decrease in the market for used phones.

Through R. David Edelman, the White House Senior Advisor for Internet, Innovation, & Privacy, the White House recently expressed support for the signatories of the petition. Edelman agreed with the signatories that those who pay full price for a mobile device and are not tied to a service agreement should be able to use the mobile device on another network. In addition to protecting consumer choice and freedom, Edelman noted that there is an obligation to support a vibrant and competitive wireless market, which would be inhibited by such a law.

Edelman offered three potential solutions that the Obama administration supports in order to ameliorate the situation. First, Edelman tasked the legislature to enact laws that will allow consumers not bound by service agreements to switch carriers without fear of criminal penalties. Also, Edelman made it clear that the FCC also plays a role here, as it is responsible for promoting mobile innovation and telecommunications. Edelman noted that Chairman Genachowski has expressed his concern for the effects the act will have on competition and innovation. Finally, Edelman put the burden on mobile phone providers themselves to work together with their customers to establish service plans as consumer-friendly as possible.

It should be noted that the renewal did not omit the exception allowing consumers to jailbreak their phones. Consumers will still be able to jailbreak in order to add software and apps; they simply won’t have the ability to unlock their phones for use in another network. Also, it is quite difficult to unlock a device without getting an unlock code from your carrier, so as long as you are careful, you should not be facing charges for unlocking your mobile device even under the new law.

Overall, the decision made by the Librarian of Congress does not place people in as much danger of criminal penalties as it does place them in danger of excessive fees, but the backlash from the cyber community to the White House itself has still been significant.

gavel.jpgA recent decision by the U.S. Bankruptcy Court held that a 93A judgment was not subject to a bankruptcy discharge pursuant to 11 U.S.C. §523(a)(6) even though the 93A judgment included a finding that the debtor’s conduct was willful. In its holding, the Court noted that M.G.L. c. 93A and 11 U.S.C. §523(a)(6) have different standards for willfulness.

The plaintiff had previously filed a lawsuit against the defendant in the U.S. District Court alleging the defendant committed fraud and breach of contract. The plaintiff contracted with defendant to provide reinsurance in connection with an employer’s liability insurance program. As part of this agreement, the defendant agreed to a contract in which another one of his companies would assume a percentage of the risk however this agreement was not in writing. The plaintiff prevailed in a bench trial and the court found that a contract did in fact exist. Further, the District Court found the defendant’s misconduct was willful and thus awarded double damages along with attorneys’ fees and expenses.

The defendant subsequently filed bankruptcy and sought to discharge the judgment.  The plaintiff then sought a declaration that their injury was not dischargeable under §523(a)(6).  Chapter 523 (a) (6) provides an exception to discharge  in cases for willful and malicious injury by the debtor to another entity or the property of another entity.  Under this section, willful requires the actor to intend the injury, not just the act that leads to the injury. Therefore, judgments from recklessness or negligence are not subject to the exception under 523(a)(6).

In the bankruptcy action, the debtor argued that plaintiff’s conduct met the willful and malicious conduct standard required of §523(a)(6). The bankruptcy court disagreed and held that 523(a)(6) requires an intentional tort. An award of damages under M.G.L. c. 93A for a breach of contract action, even one involving bad faith, does not involve an intentional tort. While an award for multiple damages under 93A may stem from intentional conduct, the exception under 523(a)(6) requires a deliberate intent to injure. A deliberate act that leads to an injury will not suffice.  To protect against such a result moving forward, parties would be well advised to seek the trial court to make specific findings that the conduct by a defendant specifically sought to harm the plaintiff.