The Stuff of Nightmares: EMR Vendor Cuts Off Access to Medical Records, Leaves Health Center in Very Bad Place
August 1, 2013
Harsh Lessons for Any Business that Outsources Hosting of Critical Data
This is the stuff of nightmares.
Milwaukee Health Services, Inc. (the “Center”), a Federally Qualified Community Health Center, lost access to some 40,000 patient records due to a fee dispute with its medical records vendor. Now the Center is in Federal Court fighting to gain access, but it has already lost a request for a temporary restraining order to force the vendor to hand over the records.
This situation is avoidable, but you have to pay attention to your agreement with the electronic medical records (“EMR”) vendor.
In this case, the Center apparently entered into a contract with Business Computer Applications, Inc., an EMR vendor which would also host the Center’s EMRs on the vendor’s computer server. This is a very common model and is widely used by physician groups across the country. The problem is that if a dispute develops, you run the risk that the vendor will hold your patient records hostage until you pay the disputed amount.
Here, the Center and the vendor had a falling out. The vendor claimed Center owed vendor $300,000 for past services, which the Center disputed. The Center terminated the contract and moved to a new EMR system with a new host. Then the vendor cut off the connection to its servers and the Center belatedly realized that although it had a new host for the EMR records, the old vendor still had the patient records.
Things went rapidly downhill from there.
The Center “engaged in discussions” with the old vendor to ensure “a smooth transition” to the new vendor, but the old vendor wasn’t having it. The old vendor demanded that the Center pay $300,000 in back fees. The Center disputed the fees and demanded that the vendor release the patient records. The vendor told them to pound sand. No money, no records.
The Center promptly filed an action in Federal Court, seeking a temporary restraining order to force the vendor to hand over the patient records. The Center’s court papers noted that the vendor’s refusal to provide access to the records “has caused a disruption in MHSI’s ability to deliver safe and effective patient treatment…” (Just as an aside, how would you like to make that public admission to your community? Would your Board be happy? Would your medical malpractice insurer?)
But, to the Center’s surprise, the Federal Court Judge denied its application for a temporary restraining order, so now the Center has to either settle or wait for the outcome of its lawsuit. For a medical facility trying to see patients on a daily basis, these are not happy alternatives. (In our experience, companies caught in that situation soon cave in and pay the disputed fees.)
There Are Contract Protections, If You Negotiate Them…
The risk of being held hostage by a hosting vendor can be minimized by your contract. You should try to negotiate a couple of different provisions:
1. Include a provision which requires the vendor to hand over the records within two days of termination of the contract for any reason whatsoever, even if the Health Facility is in breach.
2. Try to negotiate a liquidated damage provision in the event the vendor does not timely release the medical records. The liquidated damages have to be reasonable in view of the Health Facility’s anticipated damages if the vendor holds the records hostage. However, considering the catastrophic consequences of not having access to the records, it should not be difficult for the Health Facility to come up with a liquidated damage figure that is both enforceable and will make it very, very risky for the vendor to hold the records hostage. The vendor will strongly resist this provision, but it is worth getting even if you have to fight for it.
3. Perhaps the most prudent approach is to require the vendor to give you a weekly backup of all of your records, which you would keep in your possession. Sometimes the data can be configured so that you can perform the backup yourself, in which case you should back it up frequently.
Essentially, in any sort of outsourcing or hosting arrangement, you should assume there is a reasonable chance your vendor will try to extort you in exchange for getting your data back. It is your job to make sure your contract has protections against this.
If your vendor simply won’t agree to any of these protections, perhaps you have the wrong vendor.
For more information on contract issues involved in hosting agreements, call your attorney or feel free to call H. Kennedy Hudner at 860.240.6029, David A. Menard at 860.240.6047, or Stephanie Sprague Sobkowiak at 203.772.7782.