Opinion ID: 3183121
Heading Depth: 2
Heading Rank: 2

Heading: Relator’s first amended complaint

Text: According to Relator’s first amended complaint, Defendant KHN is a network of hospitals, medical facilities, and physicians that provide medical services. “[D]uring the past several years,” the complaint asserts, KHN certified to the United States that it implemented a system of protecting electronic protected health information (“e-PHI”) in accordance with HITECH Act requirements, and it received meaningful-use payments as a result. (R. 4 at ¶ 5.) KHN would submit this certification to the government by “checking ‘Yes’ to the question ‘Did you conduct or review a security risk analysis per 45 CFR 164.308(a)(1) and implement security No 15-3075 U.S. ex rel. Sheldon v. Kettering Health Network Page 5 updates as necessary and correct identified security deficiencies as part of its [sic] risk management processes.’” (Id. at ¶ 25.)1 Relator alleges, however, that KHN’s attestations of compliance under the Act were false. This allegation stems from two letters she received from KHN informing her that its employees had impermissibly accessed her e-PHI. These letters, which were attached to Relator’s original complaint, state that based on its own internal investigation, KHN discovered Relator’s e-PHI had been accessed on several occasions by Relator’s (now former) husband, Duane Sheldon, and others.2 Relator’s complaint asserts that while Duane Sheldon was serving as a director for KHN, he began an affair with a subordinate employee, and together they accessed Relator’s e-PHI in furtherance of that affair. The letters Relator received from KHN also state that (1) “these instances of access are inappropriate/unauthorized and in violation of [KHN] policy and procedure, as well as law,” (2) KHN was investigating these instances of access “as a breach under the [HITECH Act],” and (3) KHN would be notifying the United States Department of Health and Human Services of the breaches. (R. 1-1, Pg ID # 10–13.) After Relator learned her e-PHI had been impermissibly accessed, she requested (through counsel) that KHN provide her with specific e-PHI access reports generated by a software system called “EPIC.” Relator asserts that KHN bought and implemented the EPIC software system sometime before her e-PHI was breached. The complaint states that when properly utilized, the EPIC system helps KHN to “maintain[] electronic health information,” and allows approved persons to access medical information while protecting such information from unapproved access. (R. 4 at ¶ 7.) With EPIC, health care providers can run a comprehensive series of reports, known as “CLARITY” reports, which help providers monitor improper access to e-PHI. Relator, who apparently has some personal familiarity with the EPIC software, lists several of these reports by name in her complaint and asserts that EPIC’s training materials 1 However, the complaint does not state where or on what form KHN “checked ‘Yes’” to this question. 2 “Although matters outside of the pleadings are not to be considered by a court in ruling on a 12(b)(6) motion to dismiss, documents attached to a motion to dismiss are considered part of the pleadings if they are referred to in the plaintiff’s complaint and are central to the plaintiff’s claim.” Seaton v. TripAdvisor LLC, 728 F.3d 592, 596 (6th Cir. 2013) (internal quotation marks and brackets omitted). No 15-3075 U.S. ex rel. Sheldon v. Kettering Health Network Page 6 suggest providers run such reports on a regular basis to safeguard against unauthorized access to e-PHI. Relator states that when she asked for specific CLARITY reports by name, KHN refused to provide them. Instead, KHN provided her with a series of “homegrown” reports that contained inconsistent information regarding the users who had impermissibly accessed Relator’s e-PHI. At some point, Relator discovered that her daughter and grandson’s e-PHI had also been inappropriately accessed, and that their medical billing information had been manipulated. Finally, Relator alleges that an employee who reported to Duane Sheldon routinely ran an “expired medication report” containing the e-PHI of Relator and numerous other patients. According to Relator, there was no reason for this employee to run that report, and the report sat on an unmonitored printer for hours. Based on these facts, the complaint avers that KHN’s attestation of compliance with the HITECH Act’s security and privacy objective was false.