Partner Scott McBride was quoted in a Law360 article on the unprecedented result he and a Morgan Lewis team recently secured on behalf of The University of Texas MD Anderson Cancer Center in the US Court of Appeals for the Fifth Circuit.
The court ruled that a $4.3 million penalty against MD Anderson by the US Department of Health and Human Services’ Office for Civil Rights in response to the theft of an unencrypted laptop and losses of two unencrypted USB drives was arbitrary and capricious. “The Fifth Circuit found the agency had too broadly read HIPAA's encryption and disclosure rules and had failed to follow the ‘bedrock principle of administrative law’ to ‘treat like cases alike,’” Scott said in the piece. “The case is not about avoiding patient privacy and security requirements, which is something supported and promoted by the healthcare industry.” He added that the panel's opinion is poised to "impact OCR enforcement actions going forward across the healthcare industry.”