64 replies to this topic

[jas77]

I want to send a letter out to a CA to whom I sent out a DV to. They are trying to collect from both my wife and I for a couple of hospital/MD office bills. I received from them the following in response to my DV:

an itemized list of procedures, billing info, etc with dates, prices, copays paid. They also sent me my patient registration form with contact info and a blurb on the bottom for medicare/commercial insurance and that I authorize release of information necessary to file a claim with my insurance company.

Now, for my wifes DV, they sent a whole bunch of stuff including her consent for treatment at the hospital, what procedures she had done, consent for anaesthetia, patient agreement forms for consent for treatment, authorization to release med records to any third party payor (insurance company), release of liability for personal valuables and receipt of patients bill of rights.
they also sent an itemized list of all the costs and procedures she had done to her (medications used, procedures listed, and insurance adjustments.
That is all that we received from them for my DV requests. My DV requests also had a limited Cease and desist which they have ignored at least once a week for the past 1 1/2 months.

It seems to me they have violated our florida privacy rights, correct? I believe that in Florida, I would have needed to sign a waiver giving the OC or CA the right to send out my personal medical history. We never signed anything like that, or if we did, we dont remember. Here is the letter I wrote to them. Please critique it, let me know if I should add anything, take something out, etc. I'm not sure if I really worded all the paragraphs in the correct manner, so I would greatly appreciate any input

Dear Scumbag CA:

On 01/31/05 I sent you a validation request in regards to the above captioned account. My validation request was signed by your employee, mr. RAT. The certified letter tracking number is xxxx xxxx xxxx xxxx. This letter you received included a cease and desist demand for you to
stop harassing me with phone calls and for any communication to be done via mail only. You have obviously decided to ignore this as you continue to telephone my
residence. I have the caller ID on my phone with your company’s ID/Phone number for the following dates: 3/16/05 at 10:41AM; 3/23/05 at 12:45 pm;3/30/05 at 11:53 AM; 4/6/05 at 12:02 pm; 4/13/05 at 3:14 PM; 4/20/05 at 2:19 PM; and 4/27/05 at 1:35 PM. Please be advised that I consider this harassment and that your actions constitute a violation of the FDCPA and if I decide to pursue this it will be punishable by a $1000.00 fine.

Furthermore, On 02/18/05, 02/25/05, and 03/01/05 I received from you packets of documents that consisted of some very private medical records for both mr. and mrs JAS.

In accordance with current Florida law, you need my written consent to obtain and view this information. Please provide me a copy of that form. Please be advised that under Florida Statutes 456.057 Ownership and control of patient records; report or copies of records to be furnished:

Section 10 states:

10) Records owners are responsible for maintaining a record of all disclosures of information contained in the medical record to a third party, including the purpose of the disclosure request. The record of disclosure may be maintained in the medical record. The third party to whom information is disclosed is prohibited from further disclosing any information in the medical record without the expressed written consent of the patient or the patient's legal representative.

Although the Privacy Rule may permit the disclosure of PHI without the patient's authorization for purposes of payment, Florida law does not. Medical records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient. No exception is provided for disclosure of PHI to insurance companies for purposes of payment. (Fla. Stat. 456.057(5)(a)).

Please provide me with the specific written consent for you to have this private medical information. The act of me sending you a validation request is by no means written consent for you to have my private medical information.

Should I find that you did not have proper authorization to obtain my private medical records, I demand that you instruct any and all CRA that you report to, to remove your TL, destroy all copies in accordance with Florida law of any medical records you may have in your files including but not limited to any and all electronic records and back up copies.

Furthermore, in order to compensate me for your egregious intrusion into my private medical files, I demand payment of $2,000.

I will be filing complaints with the State attorney generals office, the BBB, and the ACA if you do not promptly remove all information from both xxxxxxx credit reports. We have been denied credit due to this.


Please be governed accordingly.

Sincerely,

Mr and mrs JAS\\




Ok, thats it...any thoughts? Thanks so much!

[hurricanesfans27]

I like it and unlike federal HIPAA Florida Law is much stronger and provides penalties for idiots like these OCs and CAs

[Why Chat]

The problem, as I see it, is that even in Florida, with it's stricter privacy statutes, there is STILL a provision exception for "business purposes", that means billing, or collecting on a bill.

If this is an OWED bill, you need to be considering why it wasn't paid-- was it an Insurance Co. error? Deductibles? Not covered?

The standard form for any HC provider when filling out your insurance info includes a section that you must sign accepting liability for any charges that your insurance doesn't pay.

I personally do not think that your letter could be considered a valid cease and desist, (except for the part about telephone calling), and certainly threatening to file suit is, in my opinion, not a good idea IF you owe the bill, as Fl. Courts (and all other States) are probably not friendly towards debtors suing the collector of a medical bill.

[hurricanesfans27]

I looked for the provision excepting business purposes ... you still have to get a written authorization from the patient to those records to that specific party..

[cotterpin]

Nodding with WhyChat, but agree that Florida's a funky state. I still haven't really dug deep into it since Enigma posted the statute. The reason I believe that Enigma's case was different was that there was NOTHING at all regarding payment etc in the paperwork, but I'd have to go back and look.

You'd have to look REALLY closely at ALL of the paperwork you signed at the time of admission. And don't go just by what they sent for the validation, get the full medical records to make sure.

The language may be vague, but more than likely DOES include a provision which allows for the transfer of information to obtain payment, most likely buried in your agreement to pay or in the assignment of benefits. Since you signed a form authorizing release of information to insurance, your line about releasing information to insurance and quoting said statute makes absolutely no sense.

Demanding deletion is one thing, but before you go demanding payment, make sure you know what you're doing. (can you REALLY prove damages in court? I hope you've consulted an attorney or really intend to pursue that!)

What exactly are you pursuing at this point? Violating the C&D portion of the FDCPA or the POSSIBLE gray areas of the FL privacy laws that you *may* have signed a form for? Why go after that when you have the violations of the FDCPA?

[Why Chat]

I looked for the provision excepting business purposes ... you still have to get a written authorization from the patient to those records to that specific party..

<{POST_SNAPBACK}>

If the standard HIPAA release forms were signed, (and given the dates of service they would have to be signed) they would have included the Fl. waiver.
Plus the insurance forms signed are an authorization to release records to the insurance co. and any other entity for billing purposes.

[hurricanesfans27]

what if they were pre hipaa ...

[BigD_Sofl]

I looked for the provision excepting business purposes ... you still have to get a written authorization from the patient to those records to that specific party..

<{POST_SNAPBACK}>

OP says they DV'd the CA.

That's written authorization.

[jas77]

Thanks for all the replies!

Lets see...

I guess I was under the impression that in Florida, I needed to have signed a specific authorization of some sort for an OC to send out my personal medical info. Florida statute 395.3025 section 4 states:

http://www.leg.state...03025#0395.3025

(4) Patient records are confidential and must not be disclosed without the consent of the person to whom they pertain, but appropriate disclosure may be made without such consent to:

(a) Licensed facility personnel and attending physicians for use in connection with the treatment of the patient.

( Licensed facility personnel only for administrative purposes or risk management and quality assurance functions.

© The agency, for purposes of health care cost containment.

(d) In any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice by the party seeking such records to the patient or his or her legal representative.

(e) The agency upon subpoena issued pursuant to s. 456.071, but the records obtained thereby must be used solely for the purpose of the agency and the appropriate professional board in its investigation, prosecution, and appeal of disciplinary proceedings. If the agency requests copies of the records, the facility shall charge no more than its actual copying costs, including reasonable staff time. The records must be sealed and must not be available to the public pursuant to s. 119.07(1) or any other statute providing access to records, nor may they be available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the agency or the appropriate regulatory board. However, the agency must make available, upon written request by a practitioner against whom probable cause has been found, any such records that form the basis of the determination of probable cause.

(f) The Department of Health or its agent, for the purpose of establishing and maintaining a trauma registry and for the purpose of ensuring that hospitals and trauma centers are in compliance with the standards and rules established under ss. 395.401, 395.4015, 395.4025, 395.404, 395.4045, and 395.405, and for the purpose of monitoring patient outcome at hospitals and trauma centers that provide trauma care services.

(g) The Department of Children and Family Services or its agent, for the purpose of investigations of cases of abuse, neglect, or exploitation of children or vulnerable adults.

(h) The State Long-Term Care Ombudsman Council and the local long-term care ombudsman councils, with respect to the records of a patient who has been admitted from a nursing home or long-term care facility, when the councils are conducting an investigation involving the patient as authorized under part II of chapter 400, upon presentation of identification as a council member by the person making the request. Disclosure under this paragraph shall only be made after a competent patient or the patient's representative has been advised that disclosure may be made and the patient has not objected.

(i) A local trauma agency or a regional trauma agency that performs quality assurance activities, or a panel or committee assembled to assist a local trauma agency or a regional trauma agency in performing quality assurance activities. Patient records obtained under this paragraph are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution.

(j) Organ procurement organizations, tissue banks, and eye banks required to conduct death records reviews pursuant to s. 395.2050.

(k) The Medicaid Fraud Control Unit in the Department of Legal Affairs pursuant to s. 409.920.

(l) The Department of Financial Services, or an agent, employee, or independent contractor of the department who is auditing for unclaimed property pursuant to chapter 717.

see statute 456.057 for cases other than hospitals

http://www.leg.state..... 057#0456.057


I dont see my case in any of these scenarios. I certainly dont remember signing any authorization. So should I take out the part about demanding 2000.00 and just word the letter saying I want proof of me authorizing release of my records? If they cant prove this then they must delete?
Ive read that in Florida, a medical release form must contain:

patient’s name and date of birth or social security number
*
patient’s telephone number
*
name, address, and telephone number where the records are to be sent
*
purpose of the request
*
specific items or dates of service needed
*
any restrictions on the request
*
date of the request
*
date this authorization expires (authorizations must be less than one year old)
*
a statement in writing indicating that the patient knows that he/she has a right to revoke this authorization at any time
*
a statement indicating that the patient knows that signing this authorization is not a condition of obtaining treatment
*
a statement indicating that the patient understands the potential for the protected health information to be re-disclosed by the recipient and no longer protected
*
the signature of the patient or, if the patient is a child, the parent or guardian
*
if signed by a personal representative, a description of his/her authority to act for the individual and a copy of the document giving that authority .


AS for the Cease and desist, Im a little fuzzy on this. I have heard that this is kind of a gray area, and not really cut and dry for a violation if they continue to call me. Here is how I worded it on my DV:

"I would also like to request, in writing, that no further telephone contact be made by your offices to my home or to my place of employment. If your offices continue to attempt telephone communication with me it will be considered harassment and I will have no choice but to file suit. All future communications with me MUST be done in writing and sent to the address noted in this letter."

I have the green card signed and all, plus they have done this for both my wife and I, so 2 fdcpa violations here??

So.....should I just "remind" them that they are violating the C&D and demand that they show my authorization, without any threat of a lawsuit? I think I am leaning more towards that point now...

I am so confused by all of this

[jas77]

I looked for the provision excepting business purposes ... you still have to get a written authorization from the patient to those records to that specific party..

<{POST_SNAPBACK}>

OP says they DV'd the CA.

That's written authorization.

<{POST_SNAPBACK}>

I dont believe it is under florida statutes. The medical release form is very specific. Much more than the DV.

[jas77]

You'd have to look REALLY closely at ALL of the paperwork you signed at the time of admission. And don't go just by what they sent for the validation, get the full medical records to make sure.

<{POST_SNAPBACK}>

How would I do this, would I have to get it directly from the Doctors office, or hospital. would they even give me this?

[Why Chat]

Yes -your revised letter sounds MUCH better.

I posted a link under "Hospital BIlls" that has some additional information you might find helpful.

[jas77]

Thanks whychat..I'll start off slow with them and see where it gets me!

[jas77]

Ok, how does this one sound..its toned down a bit now:

Dear Scumbag CA:

On 01/31/05 I sent you a validation request in regards to the above captioned account. My validation request was signed by your employee, mr. RAT. The certified letter tracking number is xxxx xxxx xxxx xxxx. This letter you received included a cease and desist demand for you to
stop harassing me with phone calls and for any communication to be done via mail only. You have obviously decided to ignore this as you continue to telephone my
residence. I have the caller ID on my phone with your company’s ID/Phone number for the following dates: 3/16/05 at 10:41AM; 3/23/05 at 12:45 pm;3/30/05 at 11:53 AM; 4/6/05 at 12:02 pm; 4/13/05 at 3:14 PM; 4/20/05 at 2:19 PM; and 4/27/05 at 1:35 PM. Please be advised that I consider this harassment and that your actions constitute a violation of the FDCPA.

Furthermore, On 02/18/05, 02/25/05, and 03/01/05 I received from you packets of documents that consisted of some very private medical records for both mr. and mrs JAS.

In accordance with current Florida law, you need my written consent to obtain and view this information. Please provide me a copy of that form. Please be advised that under Florida Statutes 456.057 Ownership and control of patient records; report or copies of records to be furnished:

Section 10 states:

10) Records owners are responsible for maintaining a record of all disclosures of information contained in the medical record to a third party, including the purpose of the disclosure request. The record of disclosure may be maintained in the medical record. The third party to whom information is disclosed is prohibited from further disclosing any information in the medical record without the expressed written consent of the patient or the patient's legal representative.

Although the Privacy Rule may permit the disclosure of PHI without the patient's authorization for purposes of payment, Florida law does not. Medical records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient. No exception is provided for disclosure of PHI to insurance companies for purposes of payment. (Fla. Stat. 456.057(5)(a)).

Please provide me with the specific written consent for you to have this private medical information. The act of me sending you a validation request is by no means written consent for you to have my private medical information.

Should I find that you did not have proper authorization to obtain my private medical records, I demand that you instruct any and all CRA that you report to, to remove your TL, destroy all copies in accordance with Florida law of any medical records you may have in your files including but not limited to any and all electronic records and back up copies.

I will be filing complaints with the State attorney generals office, the BBB, and the ACA if you do not promptly remove all information from both xxxxxxx credit reports from the 3 major credit bureaus (Transunion, Equifax, and Experian). We have been denied credit due to this.


Please be governed accordingly.

Sincerely,

Mr and mrs JAS\\


I didnt change too much on it, basically just took out the part about demanding 2000.00 and a little bit about the FDCPA fine being 1000.00.
Should I take more out? Thanks everyone!

[Why Chat]

Ok, how does this one sound..its toned down a bit now:

Dear Scumbag CA:

On 01/31/05 I sent you a validation request in regards to the above captioned account. My validation request was signed by your employee, mr. RAT. The certified letter tracking number is xxxx xxxx xxxx xxxx. This letter you received included a cease and desist demand for you to
stop harassing me with phone calls and for any communication to be done via mail only. You have obviously decided to ignore this as you continue to telephone my
residence. I have the caller ID on my phone with your company’s ID/Phone number for the following dates: 3/16/05 at 10:41AM; 3/23/05 at 12:45 pm;3/30/05 at 11:53 AM; 4/6/05 at 12:02 pm; 4/13/05 at 3:14 PM; 4/20/05 at 2:19 PM; and 4/27/05 at 1:35 PM. Please be advised that I consider this harassment and that your actions constitute a violation of the FDCPA.

Furthermore, On 02/18/05, 02/25/05, and 03/01/05 I received from you packets of documents that consisted of some very private medical records for both mr. and mrs JAS.

In accordance with current Florida law, you need my written consent to obtain and view this information. Please provide me a copy of that form. Please be advised that under Florida Statutes 456.057 Ownership and control of patient records; report or copies of records to be furnished:

Section 10 states:

10) Records owners are responsible for maintaining a record of all disclosures of information contained in the medical record to a third party, including the purpose of the disclosure request. The record of disclosure may be maintained in the medical record. The third party to whom information is disclosed is prohibited from further disclosing any information in the medical record without the expressed written consent of the patient or the patient's legal representative.

Although the Privacy Rule may permit the disclosure of PHI without the patient's authorization for purposes of payment, Florida law does not. Medical records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient. No exception is provided for disclosure of PHI to insurance companies for purposes of payment. (Fla. Stat. 456.057(5)(a)).

Please provide me with the specific written consent for you to have this private medical information. The act of me sending you a validation request is by no means written consent for you to have my private medical information,nor a waiver of my rights under Florida statutes or HIPAA.

Should I find that you did not have proper authorization to obtain my private medical records, I demand that you instruct any and all CRA that you report to, to remove your TL, destroy all copies in accordance with Florida law of any medical records you may have in your files including but not limited to any and all electronic records and back up copies.

I will be filing complaints with the State attorney generals office, the BBB, the ACA and all other appropriate agencies if you do not promptly delete and expunge all information from both xxxxxxx credit reports from the 3 major credit bureaus (Transunion, Equifax, and Experian). {color=green}Because we have been denied credit due to your violations, we reserve the right to take civil action to recover damages, failing your immediate compliance with the above demands[/color]

Please be governed accordingly.

Sincerely,

Mr and mrs JAS\\


I didnt change too much on it, basically just took out the part about demanding 2000.00 and a little bit about the FDCPA fine being 1000.00.
Should I take more out?  Thanks everyone!

<{POST_SNAPBACK}>

Make sure you address this to their LEGAL department, and send a copy to the OC LEGAL DEPT. with a cover letter stating simply that under Florida & Federal statutes,they are responsible for the actions of their agents.

[jas77]

sounds good!! thanks so much whychat, I appreciate your help.

[pryan67]

also, instead of "signed by Mr. RAT" change it to "Signed for by Mr. Rat"

[BigD_Sofl]

I looked for the provision excepting business purposes ... you still have to get a written authorization from the patient to those records to that specific party..

<{POST_SNAPBACK}>

OP says they DV'd the CA.

That's written authorization.

<{POST_SNAPBACK}>

I dont believe it is under florida statutes. The medical release form is very specific. Much more than the DV.

<{POST_SNAPBACK}>

"except upon written authorization of the patient. No exception is provided for disclosure of PHI to insurance companies for purposes of payment. (Fla. Stat. 456.057(5)(a))"

I was assuming that you DV'd in writing.

[jas77]

I looked for the provision excepting business purposes ... you still have to get a written authorization from the patient to those records to that specific party..

<{POST_SNAPBACK}>

OP says they DV'd the CA.

That's written authorization.

<{POST_SNAPBACK}>

I dont believe it is under florida statutes. The medical release form is very specific. Much more than the DV.

<{POST_SNAPBACK}>

"except upon written authorization of the patient. No exception is provided for disclosure of PHI to insurance companies for purposes of payment. (Fla. Stat. 456.057(5)(a))"

I was assuming that you DV'd in writing.

<{POST_SNAPBACK}>

I believe for authorization, it has to be a specific form, not me asking for Validation..Not 100% sure though. Anyone have any input on this?

[cotterpin]

jas, all depends how a JUDGE looks at it, but I don't believe there is a "state issued" form that is required, nor is there a "state required" verbage

Edited by cotterpin, 16 May 2005 - 06:01 PM.

[jas77]

Thanks cotter..
I think I saw a post from enigma somewhere that says that the DV isnt enough, that the medical release form is very specific. I'll see if I can find that post somewhere.
Thanks for everyones help!!!!

[angeleyeskkhr]

jas, all depends how a JUDGE looks at it, but I don't believe there is a "state issued" form that is required, nor is there a "state required" verbage

<{POST_SNAPBACK}>

Either way, without his signature, couldn't it be ruled that it wasn't written authorization? He *could* argue that his -[parents or someone else sent this letter without his authorization?

[cotterpin]

it also could be ruled that it WAS authorization, along with the original forms from admission, it's dependant upon the judge's interpretation of the laws

[BigD_Sofl]

jas, all depends how a JUDGE looks at it, but I don't believe there is a "state issued" form that is required, nor is there a "state required" verbage

<{POST_SNAPBACK}>

Either way, without his signature, couldn't it be ruled that it wasn't written authorization? He *could* argue that his -[parents or someone else sent this letter without his authorization?

<{POST_SNAPBACK}>

Again it goes back to what would a judge believe?

How can you stand up there before the judge trying to collect on FDCPA violations but turn around and say you didn't send out the DV?

[hurricanesfans27]

actually you dont need to sue. if you have a hipaa violation all you have to do is complain to the AG and the agency controlling the provider they are the ones who impose the fines and they dont discount them from what Ive seen in Florida. IN Florida for a provider the fine is 50k for each offense whereas the CA could be imposed a fine of 5k just for having the information