MEDEFENSE CYBER LIABILITY EPLI MEDICAL DIRECTOR

MEDEFENSE CYBER LIABILITY EPLI MEDICAL DIRECTOR

LONE STAR ALLIANCE RRG P.O. Box 160140 Austin, TX 78716-0140 844-595-8866 www.lonestara.com Published 2015 Understanding Your Coverage is published by Lone Star Alliance Inc., a Risk Retention Group (Lone Star), as an informational piece. The information and opinions in this publication should not be used or referred to as primary legal sources or construed as establishing medical standards of care for the purposes of litigation, including expert testimony. The standard of care is dependent upon the particular facts and circumstances of each individual case and no generalizations can be made that would apply to all cases. The information in this publication is not a binding statement of coverage. It does not amend, vary, extend, or waive any of the terms, agreements, conditions, definitions, and/or exclusions in Lone Star s policy or endorsements. The information presented should be used only as a resource, selected and adapted with the advice of your attorney. It is distributed with the understanding that Lone Star Alliance is not engaged in rendering legal services. Copyright 2015 Lone Star Alliance

TABLE OF CONTENTS MEDEFENSE Understanding your Medefense coverage 2 How to report 4 CYBER LIABILITY Understanding your Cyber liability coverage 6 Case study 8 EPLI Understanding your EPLI coverage 12 MEDICAL DIRECTOR Understanding your Medical Director coverage 16

MEDEFENSE

UNDERSTANDING YOUR MEDEFENSE COVERAGE LIMITS Medefense pays legal expenses for disciplinary proceedings and tax expenses for tax audits. Coverage will either reimburse or pay directly the legal expenses incurred by a physician or entity from a disciplinary proceeding. Fines and penalties arising out of a disciplinary proceeding are also covered (on a reimbursement basis only). Many policyholders do not realize they have coverage that will pay the majority of their legal fees to defend a board complaint and other types of disciplinary proceedings, as defined in the endorsement. The covered disciplinary proceedings include: A review instituted by any state medical licensing authority. A professional review action instituted by a review body of a hospital, HMO, PPO, or managed care organization, which could adversely affect a physician s clinical privileges. A proceeding to impose sanctions under the Quality Improvement Organization (QIO) program. A proceeding instituted by a state department of insurance, state workers compensation commission, state department of health and human services, the U.S. Department of Health and Human Services, or Centers for Medicare and Medicaid Services alleging medical services were performed in violation of guidelines. A proceeding by a state or federal agency such as a Medicare billing audit conducted by Recovery Audit Contractors (RAC) or other private contractors, as well as allegations of noncompliance with Medicare/Medicaid regulations or procedures. A violation of the Emergency Medical Treatment and Active Labor Act (EMTALA), also known as the anti-dumping statute. A violation of the Health Insurance Portability and Accountability Act (HIPAA). A violation of the Stark Law (anti-kickback statute). The Medefense endorsement also provides limited coverage for a tax practitioner s fees to assist in an IRS audit of a federal tax return. Maximum Legal Expense: $50,000 per insured event up to $100,000 per policy period. Maximum Tax Expense: $5,000 per policy period (included in the Maximum Legal Expense). Deductible: $1,000 per insured event.* *Policyholders have free choice of counsel. However, we will waive the deductible and pay their legal expenses directly if they hire an attorney from a panel provided by Lone Star. Higher limits are available for purchase. 2

COVERAGE CONDITIONS AND CAVEATS Under the Medefense endorsement, there is a 60-day reporting condition. The policyholder must notify Lone Star within 60 days from the date he or she receives written notice that a disciplinary proceeding or tax audit has been instituted. When referring to the commencement of any disciplinary proceeding, instituted means the time formal written notice of a disciplinary proceeding is served upon the policyholder, including written notice of an investigation that could result in a disciplinary proceeding. Instituted, when referring to a tax audit, means the time formal written notice of the tax audit is served upon the policyholder. Coverage under the Medefense endorsement expires 60 days after the expiration of the policy or 60 days after its earlier cancellation date or non-renewal date. The Extended Reporting Endorsement (tail coverage) does not apply to the Medefense endorsement. The coverage for tax audits is limited to a maximum of $5,000 per insured event per policy period and is included in the maximum reimbursement limit. The deductible applies only to Medefense and does not apply to your medical professional liability coverage. Fines and penalties mean civil fines and civil administrative penalties assessed against the policyholder in a disciplinary proceeding, and are paid on a reimbursement basis only. Medical boards can impose a range of disciplinary actions or sanctions, which can include license revocation and suspension, probation, monitoring or other limitation/restriction on your practice, counseling or treatment, required educational or counseling programs, public service, and an administrative fine. However, Medefense does not reimburse the costs for any CME, monitoring, or counseling imposed by the medical boards (e.g., in an Agreed Order) or the policyholder s travel expenses. 3

HOW TO REPORT Physicians are strongly urged to do the following as soon as they are notified of any disciplinary action: 1. Notify Lone Star as soon as you receive the initial letter from the board or other disciplinary authority. The policy states that a policyholder has 60 days to report an insured event to receive reimbursement for covered expenses. Please call the Claim Department at 844-595-8866 to report a Medefense claim. 2. Consider retaining an attorney to help draft your initial response to the board. Upon request, Lone Star can provide you with the contact information of attorneys who have experience handling disciplinary proceedings. 3. If you do not choose an attorney from Lone Star s panel of attorneys, promptly send the following information to Lone Star to expedite the payment process under Medefense: copies of all legal expense invoices pertaining to the defense of the claim the legal or audit expenses should be itemized on an hourly basis showing the services provided, the time incurred, and the hourly rate; copies of all payments made to the attorney or law firm representing the policyholder in the matter; and a copy of the dispositive letter describing the final outcome so the claim can be closed. 4

CYBER LIABILITY

UNDERSTANDING YOUR CYBER LIABILITY COVERAGE Because physicians hold sensitive patient and employee information on their networks and in their medical and billing records, they are at great risk for network security and privacy-related exposures. Due to the potential for high costs from these exposures, Lone Star has added a cyber liability endorsement to all policies. COVERAGE SPECIFICS Cyber liability policy limits are $100,000 per claim subject to a $100,000 aggregate per policy period and there is no deductible. The policy aggregate for entities is $500,000 annually. (For details, please refer to your endorsement. New limits went into effect January 1, 2015, and will be added as policies renew in 2015.) Higher limits of $1 million are available to purchase. The endorsement provides payments directly to you (first party claims for direct losses to your computer systems as a result of a data breach) and certain payments to others (third party claims made against you as a result of a privacy breach): Security and privacy liability covers third party claims arising out of the failure to prevent unauthorized access of the use of private information, including identity theft and breach of privacy for both online and off-line information. Examples include the inadvertent transmission of malicious code or a virus to another s computer system or potential lawsuits from credit card or health insurance companies. Privacy regulatory defense and penalties insurance covers defense costs, fines, and penalties incurred defending regulatory investigations of privacy or security breaches. Examples include HIPAA and HITECH violations, or a state attorney general or Federal Trade Commission action regarding the breach of security and privacy of information. Privacy breach response costs, patient notification expenses, and patient support and credit monitoring expenses insurance covers payment of all reasonable and necessary costs to notify third parties (e.g., patients) that their private medical information has been breached or compromised. This coverage includes legal fees, notification costs, public relations expenses, IT forensic costs, call center, advertising, and postage costs. The costs for credit monitoring services are limited to 12 months from the date of enrollment in such services. Network asset protection covers all reasonable and necessary sums required to recover and/ or replace data that is compromised, damaged, lost, erased, or corrupted. Coverage also includes business interruption and extra expense coverage for income loss as a result of the total or partial interruption of the policyholder s computer system. Multimedia liability provides coverage for both online and off-line claims alleging copyright or trademark infringement, libel or slander, advertising injuries, and plagiarism. 6

Cyber extortion pays for a cyber extortion threat. This would involve a party demanding cyber extortion monies or else it will: release confidential information of a third party; introduce malicious code; corrupt, damage or destroy the policyholder s system; restrict or hinder access to system, including a denial of service attack; or electronically communicate with patients or customers claiming to be the physician or entity to obtain personal confidential information. This coverage pays cyber extortion expenses, but such expenses can only be incurred with the Trust s consent (funds paid with Trust s consent to terminate the threat). Cyber terrorism coverage pays for acts of terrorism, meaning a use of force or violence for political, religious, ideological, or similar purposes, including the intent to influence a government or put the public in fear. This coverage pays for income loss, interruption expenses and/or special expenses. COVERAGE CONDITIONS AND CAVEATS Lone Star s Cyber liability coverage is offered in addition to your medical professional liability policy limits and there are no binding arbitration or hammer clauses. Lone Star will pay on behalf of the policyholder except under Regulatory Fines and Penalties, which will be reimbursed. Defense costs are paid within the limits of insurance, unlike your Lone Star medical liability policy, where defense costs are paid outside the limits of insurance. If an Extended Reporting Endorsement (tail coverage) is provided on your Lone Star medical liability policy, cyber coverage is extended for up to one year following the termination of the policy. In the event of any cyber claim, you must notify Lone Star within 60 days from the date a claim is first made to receive any benefit under this endorsement. 7

CASE STUDY The need to protect the privacy of patients from hackers and cyber-thieves mandates the need for adequate security. Physicians who fail to adequately protect their patients right to privacy from unauthorized use may be held legally responsible and be in violation of state and federal regulations. Physicians may also fail to follow state or federal notification requirements in the event of a data breach. It is imperative that physicians and affiliated organizations know what laws require when a data breach occurs and that employees follow these rules. The following scenario highlights security and unauthorized access exposures. A laptop with unencrypted data containing patient files was stolen from a physician s unattended vehicle. The data included the employer s network passwords and 550 patient records consisting of protected health information and sensitive personal information. The physician immediately called her group s practice manager to report the loss. The practice manager had never developed any structured employee training on privacy and security compliance for employees. The thief was able to uncover the network passwords and all of the confidential patient information. He also tried to hack into the practice s network server and, in the process, corrupted their computer system, shutting it down for three days. The practice learned the thief was trying to sell their medical identification information for $50 per patient record. Predictably, the practice received a demand threatening to disseminate the patients confidential information to other criminals unless the practice paid them $20,000 within the next five days. The practice hired an attorney to determine the applicable state and federal notification requirements and to manage the response process. A vendor was hired to handle the notification process to the affected patients at a cost of $100 per patient record contact. This included credit monitoring for those who requested it. Twenty patients were so upset over the practice s weak privacy and security protocols they hired an attorney who demanded $200,000 for the breach of his clients confidentiality and right to privacy. After investigating the incident, the practice sent written notification to the affected patients; put a notice of the breach on the website and on HHS.gov (required if the breach affects more than 500 individuals); and made local media aware of the breach. Additionally, the practice notified the state attorney general s office and the Office of Civil Rights (OCR), which subsequently led to two separate investigations and requests for information. When the OCR requested a copy of the practice s risk analysis and management plan and privacy and security policies and procedures manual to ensure compliance with HIPAA, the practice reported that no such manuals existed. 8

Because the practice was a covered entity, the state attorney general s office filed a civil lawsuit for HIPAA violations under HITECH. The state attorney general sought civil fines and penalties and the recovery of attorneys fees and costs totaling $100,000. Because this was the practice s first public breach, their defense counsel was able to negotiate a compromise settlement with the attorney general for reduced fines and penalties of $5,000. After considerable discussions, their attorney was also able to settle the patients claims for $10,000. Unfortunately, the practice had to pay the identity-theft ring their extortion demand of $20,000 to terminate the imminent release of their patient records. Expense costs for the incident totaled $95,000, as detailed below. Legal expenses and fees: $17,000 Notification vendor expenses: $38,000 Regulatory penalty settlement: $5,000 Data recovery costs: $5,000 Third party compensation: $10,000 Cyber extortion payment: $20,000 This matter triggered the practice s cyber liability coverage and would be covered up to $100,000 per claim up to a maximum of $100,000 per policy period. 9

EPLI

UNDERSTANDING YOUR EPLI COVERAGE As employers, physicians and entities are at risk for exposures that can arise from wrongful employment practices such as discrimination, harassment, and retaliation. The area of law that deals with employment issues is called employment practices liability. The insurance that covers this area is called Employment Practices Liability Insurance (EPLI). COVERAGE SPECIFICS EPLI covers several kinds of wrongful employment practices including: violation of any federal, state, local, or common law, prohibiting any kind of employmentrelated discrimination; harassment, including any type of sexual or gender harassment as well as racial, religious, sexual orientation, pregnancy, disability, age, or national origin-based harassment and including workplace harassment by non-employees; abusive or hostile work environment; wrongful discharge or termination of employment, whether actual or constructive; breach of an implied employment contract or promissory estoppel (an understanding based on a previous action or statement); breach of an actual or written employment contract as long as another wrongful employment practice is also alleged; wrongful failure or refusal to hire or promote, or wrongful demotion; wrongful failure or refusal to provide equal treatment or opportunities; employment termination, disciplinary action, demotion, or other employment decision that violates public policy or the Family Medical Leave Act or similar state or local law; defamation, libel, slander, disparagement, false imprisonment, misrepresentation, malicious prosecution, or invasion of privacy; wrongful failure or refusal to adopt or enforce adequate workplace or employment practices, policies, or procedures; wrongful, excessive, or unfair discipline; wrongful infliction of emotional distress, mental anguish, or humiliation; retaliation, including retaliation for exercising protected rights, supporting in any way another s exercise of protected rights, or threatening or actually reporting wrongful activity of an insured such as violation of any federal, state, or local whistleblower law; wrongful deprivation of career opportunity, negligent evaluation, or failure to grant tenure; violation of the Uniformed Services Employment and Reemployment Rights Act; or negligent hiring or negligent supervision of others, including wrongful failure to provide adequate training, in connection with training. Covered losses include damages, judgments, settlements, verdicts, and awards (including compensatory damages), back pay, future pay, statutory attorneys fees, pre-judgment and post-judgment interest, statutory liquidated damages, and defense costs in excess of the self-insured retention. 12

LIMITS $50,000 per claim (including both defense costs and indemnity payments) with a $5,000 deductible. The yearly aggregate limit is also $50,000. Higher limits are available for purchase. COVERAGE CONDITIONS AND CAVEATS A claim must be reported to Lone Star as soon as practicable, but no later than 60 days from the date the policyholder becomes aware of the claim. Policyholders can also report circumstances they believe might lead to a claim. What is a claim? A written demand for monetary damages or non-monetary relief, including injunctive relief, or for mediation, arbitration or the tolling or waiver of a statute of limitations. A charge, complaint or other notice of commencement of federal, state, or local administrative proceedings by or before any agency with authority over employment practices. The filing of a civil lawsuit or arbitration proceeding. A claim is deemed first made when it is received by an insured. EPLI CLAIM STATISTICS Approximately 90,000 employment-related claims were made through the Equal Employment Opportunity Commission (EEOC) in 2014. Retaliation was alleged in 42.8% of all charges, the highest percentage ever and the twelfth year that percentage has increased. Disability discrimination was alleged in 28.6% of all charges, an increase from 27.7% in 2013 and the sixth year that percentage has increased. Race discrimination was alleged in 35% of all charges and sex discrimination in 29.3% fairly consistent during the past several years. Approximately 30% of all charges alleged harassment 26,820 charges. California, Florida and Texas accounted for 24.8% of all EEOC charges nationally and 26.5% of all EEOC retaliation charges nationally. HELP WITH EMPLOYMENT-RELATED ISSUES As part of Lone Star s EPLI coverage, policyholders also have access to unlimited HR support by phone or email. Please call 800-387-4468 to receive advice from an HR specialist. 13

14

MEDICAL DIRECTOR

UNDERSTANDING YOUR MEDICAL DIRECTOR COVERAGE Because bodily injury claims can occur as the result of administrative decisions, Lone Star now provides medical liability coverage at a cost of $250 per policy period for physicians who also serve in an administrative capacity as head of an organized medical staff. DEFINITION OF MEDICAL DIRECTOR Medical Director means a physician who serves in an administrative capacity as head of an organized medical staff and whose duties include training and supervision of medical staff (both physician and non-physician); drafting and implementation of appropriate policies and procedures; and/or assuring the facility s compliance with federal, state, and local laws. Medical director services do not include employment related practices. COVERAGE SPECIFICS The basic coverage will defend any physician who is named in a claim as a medical director. Limits provided are $100,000 at a cost of $250 per policy period. Limits are inclusive of the existing limits provided on the declarations page/schedule of insureds. Higher limits are available for purchase. Please contact your underwriter to discuss. Policyholders can opt out of Medical Director coverage when they renew their policies. NOT COVERED UNDER THE POLICY Per patient policies, scheduled physician policies, and those with a moonlighting or fellowship policy are not covered. 16