STATE OF FLORIDA
DIVISION OF ADMINISTRATIVE HEARINGS
UNIVERSITY OF FLORIDA, BOARD OF TRUSTEES,
Petitioner,
vs.
J. CHRIS SACKELLARES, M.D., Respondent.
)
)
)
)
)
) Case No. 06-3319
)
)
)
)
)
RECOMMENDED ORDER
A formal hearing was conducted in this case on September 26-27, 2007, in Gainesville, Florida, before
Suzanne F. Hood, Administrative Law Judge with the Division of Administrative Hearings.
APPEARANCES
For Petitioner: Susan M. Seigle, Esquire
Dell Graham, P.A. Post Office Box 850
Gainesville, Florida 32602
B. Dianne Farb, Esquire Assistant General Counsel University of Florida Post Office Box 100215
Gainesville, Florida 32610-0215
For Respondent: Carla D. Franklin, Esquire
Haile Professional Center 4809 Southwest 91st Terrace Gainesville, Florida 32608
STATEMENT OF THE ISSUE
The issue is whether Petitioner had just cause to discipline Respondent by suspending his employment without pay as a tenured professor for six months, by prohibiting him from engaging in any activities with outside businesses, and by withdrawing existing outside activities exemptions or approvals.
PRELIMINARY STATEMENT
By letter dated August 2, 2006, Petitioner University of Florida, Board of Trustees (Petitioner/UFBOT), advised Respondent J. Chris Sackellares, M.D. (Respondent) that he was suspended for six months, without pay, from his position as a professor in the University of Florida's College of Engineering, commencing on August 16, 2006. The letter also advised Respondent that he was prohibited from engaging in any outside business activities. The letter stated that Respondent's existing outside activities exemptions or approvals were withdrawn.
On August 23, 2006, Respondent filed a Petition for Administrative Hearing. On September 6, 2006, Petitioner referred the petition to the Division of Administrative Hearings.
A Notice of Hearing, dated September 18, 2006, scheduled the hearing for December 4-7, 2006.
On November 13, 2006, Respondent filed an unopposed Motion for Continuance. On November 14, 2006, the undersigned issued an Order Granting Continuance and Placing Case in Abeyance. At the request of the parties, the undersigned continued the case in abeyance on two occasions.
A Notice of Hearing, dated May 21, 2007, scheduled the case for hearing on September 10-12, 2007. Due to a medical emergency, the case was rescheduled for hearing on September 26- 27, 2007.
During the hearing, Petitioner presented the testimony of six witnesses. Petitioner offered the following exhibits that were admitted as evidence: P-1, P-2, P-3a and P-3b, P-4 through P-9, P-10a through 10d, P-11, P-12a through P-12f, P-13, P-14,
P-15a through P-15e, P-17 through P-21.
Respondent testified on his own behalf and presented the testimony of two additional witnesses. Respondent offered the following exhibits that were admitted as evidence: R-2, R-3,
through R-12. Respondent's Exhibit R-12 is the testimony by deposition in lieu of live testimony of William L. Ditto, Ph.D. On November 1, 2007, Respondent filed the testimony by deposition in lieu of live testimony of Dr. Thomas Walsh, which is hereby identified as Respondent's Exhibit R-13 and accepted as evidence.
The court reporter filed the Transcript on October 16, 2007. On October 18, 2007, Petitioner filed an unopposed Motion for Additional Time to File Findings of Fact. The undersigned granted the motion on October 19, 2007.
The parties timely filed their Proposed Recommended Orders on November 5, 2007.
FINDINGS OF FACT
Respondent is a Board Certified medical doctor.
Respondent specializes in neurology and clinical neurophysiology. He has special expertise in epilepsy and clinical neurophysiology. Respondent has performed research in the area of epilepsy.
At all times material to this case, UFBOT employed Respondent. Respondent also worked for the Malcolm Randall Veterans Administration (VA).
Respondent had a laboratory at the McKnight Brain Institute on the University of Florida campus. He was a tenured professor on the faculty of the Biomedical Engineering Department. He also held joint appointments as Professor of Neurology and Professor of Psychiatry, as well as an affiliate appointment as Professor of Neuroscience. Respondent was a member of the University of Florida's Graduate Faculty.
An Institutional Review Board (IRB) is an internal review board that has the obligation to provide oversight for all research activities involving human subjects. IRB-01 is one of four review boards affiliated with the University of Florida. IRB-01 is responsible for oversight of research at the Health Science Center.
IRBs are charged with the responsibility of complying with federal regulation for the protection of human subjects found in 45 C.F.R. Part 46, Protection of Human Subjects. This regulation is known as the "Common Rule."
Beginning in 1993, Respondent was the principal investigator (PI) on a research protocol entitled "Dynamical Studies in Temporal Lobe Epilepsy," hereinafter referred to as Protocol 447-1993. IRB-01 approved Protocol 447-1993.
Pursuant to Protocol 447-1993, data in the form of video-taped EEGs and clinical records were collected from 18 patients with intractable epilepsy. Some of the data was called "scalp" data, because it was collected via electrodes attached to the patients' scalps. The rest of the data was called "depth" data, because it was collected during surgical procedures.
The informed consents in Protocol 447-1993 informed the subjects that researchers would be reviewing their medical records to gather information about their epilepsy. According
to the informed consents, researchers would analyze brain wave recordings that were performed on the patients as part of the diagnostic evaluation, store the recordings on a computer, and analyze the recordings with new mathematical techniques. The informed consents also advised the subjects that their personal information would not appear in print or be presented in a manner that could identify them.
The informed consents for subjects enrolled in Protocol 447-1993 provided that the University of Florida and the VA Medical Center would protect the confidentiality of the subjects' records to the extent provided by law. Subjects were also informed that the National Institutes of Health (NIH) as the Study Sponsor, the Food and Drug Administration (FDA), and IRB-01 had the right to review the records.
Protocol 447-1993 continued with IRB-01 approval for several years. The protocol expired in May 2002. It is not permissible for a researcher to use data from an expired protocol in a later protocol without additional approval from the IRB.
In 2001, Respondent applied for and received approval from IRB-01 for a research protocol entitled "Bioengineering Research Partnership," identified as Protocol 430-2001 (BRP Protocol). Respondent was the PI for the new protocol. The proposal for the protocol described the research procedures as a
plan to develop and test automated computer-based algorithms for analyzing the spatiotemporal dynamical properties of multi- channel EEG recordings to determine the probability of an epileptic seizure. The computer algorithms were to be tested and evaluated on three (3) data sets. The first dataset was comprised of a group of long-term EEG recordings that were obtained for clinical purposes in patients with medically intractable epilepsy.
By memorandum dated September 18, 2001, Respondent informed the IRB-01 Vice Chairman that the study under which the EEGs were collected for the BRP Protocol was another IRB-01 approved protocol, identified as Protocol 22-2000. Protocol 22- 2000 did not include data from Protocol 447-1993. Respondent did not reference data from Protocol 447-1993 in his
September 18, 2001, memorandum. Further, there is nothing in the BRP Protocol that informs the IRB-01 that data from Protocol 447-1993 would be included in the new research project.
If there is a change in a protocol, no matter how slight, the change must be approved by the IRB. If Respondent wished to include data from Protocol 447-1993 in the BRP Protocol, he needed to make a request to include that specific data.
The IRB never gave Respondent approval to use the data from Protocol 447-1993 in the BRP Protocol. The IRB approved the BRP Protocol as an exempt Category IV study pursuant to the Common Rule. An exempt Category IV study is "[r]esearch involving the collection or study of existing data, documents, records, pathological or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects." See 45 C.F.R. § 46.101(b)(4).
NIH grants funded the BRP Protocol and Protocol 447- 1993.
In 2003, the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) were implemented at the University of Florida. In order to enforce those provisions, the University of Florida created the Privacy Office at the Health Science Center. Respondent and all of his staff were required to take privacy training provided by the Privacy Office.
According to HIPAA, protected health information (PHI) about a patient may be used or disclosed to others only in certain circumstances or under certain conditions. Information about a patient can be de-identified under two alternative procedures set forth at 45 C.F.R. Section 164.514(b).
The first procedure requires that a qualified person applying accepted statistical and scientific principals determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The qualified person must document the methods and results of the analysis that justify such a determination.
The second procedure is the removal of all identifiers set forth in 45 C.F.R. Section 164.514(b)(2)(i) from a given patient data set. The identifiers include any unique identifying number, characteristic, or code. Additionally, the covered entity may not have actual knowledge that the remaining information can be used alone or in combination with other information to identify the patient.
If a data set is properly de-identified, it is not PHI and is not governed by HIPAA. Furthermore, it does not fall within the definition of human subject research under the Common Rule. Properly de-identified data does not require subject consent or IRB approval for disclosure.
Pursuant to the policies and procedures of the IRB-01, only the IRB can make the determination that the research does not include human subjects.
BioNeuronics (formerly Neurobionics) is a start-up medical technology company that Respondent and others formed for the purpose of translating an invention developed by Respondent and his colleagues at the University of Florida and Arizona State University into medical devices for the treatment of patients with epilepsy. The University of Florida Research Foundation (UFRF) and Arizona State University owned the patent. BioNeuronics entered into a licensing agreement with the two institutions, permitting the company to develop the patented technology.
The University of Florida's Office of Technology Licensing (OTL) was established to work with inventors to facilitate the transfer of technologies created at the university to the commercial sector for public benefit. It is not uncommon for both inventors and the UFRF to be given stock in start-up companies. The OTL encourages inventors to maintain an advisory relationship with the licensee.
Pursuant to the licensing agreement, the UFRF was to provide "test data" to BioNeuronics. The licensing agreement does not identify the test data to be provided. The licensing agreement did not contain any provision that test data from Protocol 447-1993 was to be provided to BioNeuronics.
At all times material to this case, Respondent owned stock in BioNeuronics, as does the UFRF. Respondent was paid
$2000 per month as a consultant for the company. The University of Florida approved the terms of Respondent's participation in BioNeuronics.
The UFBOT employs Michael Mahoney as the IRB-01 Coordinator. He is responsible for management of the IRB-01 office. He sits as an alternate member of the IRB-01 Board. The IRB-01 Executive Committee is composed of the Chairman, the Vice-Chairman, the QA Coordinator, the Assistant Director for IRBs, and Mr. Mahoney.
Mr. Mahoney's duties involve more than just office management. He also acts as a resource for investigators and research team members on general regulatory information. He provides guidance with IRB-01 forms and assistance with the preparation of submissions for IRB review.
In January 2006, Respondent sent an e-mail to
Mr. Mahoney, informing him that Respondent had been acquiring and storing long-term EEG and video records of patients with medically intractable seizures. Respondent's e-mail stated that there was an international effort to establish a shared database so that researchers in participating institutions could share datasets. Respondent requested information as to the
requirements to share this data with persons outside the university.
On February 1, 2006, Mr. Mahoney responded to Respondent, informing him that he needed IRB approval before doing anything new with the data, including releasing it to others. Mr. Mahoney concluded his message by stating that Respondent would have to submit something to the IRB before using or sharing old datasets for different research purposes.
At all times material here, Deng Shan Shiau, Ph.D., held a faculty position as a Research Assistant Professor of Biomedical Engineering. Dr. Shiau was in charge of Respondent's laboratory.
Dr. Shiau and another research assistant,
Dr. Iasemidis, supervised the work of graduate engineering students who recorded, stored, and analyzed data in Respondent's laboratory. Drs. Iasemidis and Shiau brought technical experience and engineering expertise to Respondent's research projects.
Daniel J. DiLorenzo, M.D., Ph.D., M.B.A, is an official with BioNeuronics. On February 8, 2006, Respondent forwarded to Dr. DiLorenzo a copy of Respondent's January 2006 e-mail and Mr. Mahoney's February 1, 2006, response. In his transmittal, Respondent stated that he would ask a new assistant, Jessica Martin, to work with Dr. Shiau to obtain
copies of consents signed by patients in the depth electrode database to see if the consents would allow the sharing of the de-identified data. Respondent stated that if the consents were inadequate, he would request permission from IRB.
Respondent contends that his January e-mail to
Mr. Mahoney and Mr. Mahoney's response was not intended to refer to the release of data to BioNeuronics. Instead, he claims that he was inquiring about the release of data to an international symposium of scientists. Respondent's February 8, 2006, e-mail to Dr. DiLorenzo is persuasive evidence to the contrary.
On March 7, 2006, Jessica Stevens, an employee in Respondent's laboratory also wrote an e-mail to Mr. Mahoney. Ms. Stevens wanted to know what needed to be done to hand over pre-existing data to others. Ms Stevens wrote a subsequent
e-mail to Mr. Mahoney, clarifying that the data Respondent would be handing over was gathered from 1994 to 1997, and that the data would be furnished to BioNeuronics.
Mr. Mahoney responded to Ms. Stevens the next day.
Mr. Mahoney stated that Ms. Stevens' question was fairly similar to the one he had previously answered directly to Respondent.
Mr. Mahoney informed Ms. Stevens that releasing data originally obtained for research purposes is a tricky proposition at best. Mr. Mahoney wanted to know whether the subjects originally consented to share their data, regardless of whether it was
de-identified. Mr. Mahoney questioned whether Respondent wanted to release identifiable data and whether Respondent had any conflict of interest issues with the receiving entity.
Mr. Mahoney informed Ms. Stevens that her e-mail did not give him enough details to assist her, and that she might want to meet with him to ensure that nothing inappropriate occurred.
Ms. Stevens read Mr. Mahoney's response to Respondent, who responded, "Don't listen to him." Respondent told
Ms. Stevens that Mr. Mahoney did not know what he was talking about.
Mr. Mahoney's advice to Respondent about the release of old data to persons outside the University of Florida was not an official directive of the IRB. However, if Respondent did not believe Mr. Mahoney was qualified to give advice regarding the release of data, there would have been no reason for Respondent to contact Mr. Mahoney in the first place.
On March 8, 2006, Dr. DiLorenzo sent an e-mail to Respondent. The message thanked Respondent for agreeing to transfer de-identified continuous EEG data to BioNeuronics. Dr. DiLorenzo stated that all were in agreement that de- identified data would not require IRB approval. Dr. DiLorenzo also related that Dr. Shiau mentioned that he could provide copies of Epilepsy Monitoring Unit (EMU) reports and a
spreadsheet with the timing of seizure events for each patient. Respondent did not respond to this message from Dr. DiLorenzo.
Respondent subsequently asked Dr. Shiau to put data from Protocol 447-1993 on an external hard drive to send to BioNeuronics. Dr. Shiau sent the external hard drive to BioNeuronics on or about March 14, 2006.
On March 16, 2006, Respondent sent an e-mail to Dr. DiLorenzo, asking whether he had any questions about the data format, location of seizures, seizure types, et cetera.
Respondent admits that Dr. DiLorenzo would not have been able to determine the seizure type with just the EEG data. Respondent's testimony that he did not intend to send BioNeuronics the patients' clinical records or Excel spreadsheets is not persuasive.
The patient information from Protocol 447-1993 consisted of the following computer files: (a) an EEG file with an associated "tag" file; (b) and EMU report consisting of a clinical encounter record, saved in .pdf format; and (c)an Excel spreadsheet with the timing of seizure events for each patient. Respondent knew or should have known that BioNeuronics needed this information to test its algorithm and that the company could not succeed using just the EEG files.
Each patient from Protocol 447-1993 was identified by a research subject number such as P171 or P267. Dr. Shiau kept a list of the codes with the associated patient name in a locked file cabinet to which only he had access.
Each of the computer files on a given patient included the research subject number as part of the file name. For example, one of the EEG files for P171 was named P17101.eeg. The associated tag file for that EEG file was named P17101.tag. The EMU clinical record for that patient was named P171.pdf. The corresponding Excel spreadsheet was named P171.xls.
Respondent originally recorded the Protocol 447-1993 data on VHS tapes. In a second study, the pre-recorded data was transferred from VHS to a digitized form using a proprietary Nicolet Biomedical software program utilized to read the EEGs. The tag files were also generated by the Nicolet reader. The contents of the tag file did not appear on the computer screen when viewing the EEG files, but they could be opened using a word processing program such as WordPad.
Neither Respondent nor Dr. Shiau was aware that six of the tag files had patient last names imbedded within the binary codes.
The data sent to BioNeuronics was gathered prior to the implementation of HIPAA. At some point in time, an effort had been made to de-identify the clinical records by removing
the patients' names, birthdates, and other personal information on the top half of the first page. There is no evidence that anyone specifically checked the data to determine if the records were de-identified pursuant to the new HIPAA standards.
Therefore, Respondent's testimony that he did not seek IRB approval prior to sending the data to BioNeuronics because he had a reasonable belief that the data from Protocol 447-1993 was de-identified and related to the BRP Protocol is not credible.
On March 18, 2006, an anonymous letter was sent to various entities, including the Office of Civil Rights, the Department of Veteran Affairs, the FDA, the Florida Board of Medicine, the Office of the Attorney General of Florida, the Office for Human Research Protections, the College of Medicine of the University of Florida, the Office of Research Affairs of the University of Florida School [sic] of Medicine, and the NIH. The letter alleged that Respondent had committed an intentional and willful HIPPA [sic] research protocol violation. The letter alleged that the violation involved the release of PHI to BioNeuronics on external hard drives.
On March 21, 2006, Linda Dance, an assistant in Respondent's laboratory, wrote a letter to Susan Blair, the Privacy Officer for the University of Florida. In the letter, Ms. Dance reported what she believed was a HIPPA [sic] violation. Ms. Dance identified the violation as the release of
patient data to BioNeuronics, a company in which Respondent owned stock and from which he received monthly consulting fees.
The Office of Human Research Protections (OHRP) is a federal agency of the United States Department of Health and Human Services. The OHRP wrote to the University of Florida and the VA based on the anonymous letter. The OHRP requested both institutions to investigate the alleged non-compliance, and forward to OHRP a written report. The OHRP also required the university and the VA to provide a description of any corrective actions taken to prevent noncompliance in the future.
Ms. Blair undertook an investigation of the matter, interviewing all of the persons involved. She also contacted BioNeuronics to inform the company of a potential disclosure of PHI. The University of Florida Police Department was also involved in the investigation.
BioNeuronics immediately returned the external hard drive. The company's president, John Harris, attested that BioNeuronics had erased any data from the hard drive that had been put onto their computer systems. He also attested that to his knowledge, no one at the company had viewed any PHI.
The Security Office of the Health Science Center received the hard drive. The office then made a forensic copy of the drive, which contained 18 patient files, including EEG files, tag files, clinical records, and Excel spreadsheets.
The Privacy Office made hard copies of the computer files to determine whether they contained any PHI. An employee of Shands Hospitals, who was not connected with the Privacy Office, but who had full access to confidential hospital patient records, was able to identify all 18 patients within a very short time.
For at least one of the patients, the clinical record reflects that it is a record of Shands Hospital at the University of Florida. It also contains a room number, a date of service, the name and signature of the doctor, the medications prescribed, the types of procedures involved, and a diagnosis and detailed description of the patient's seizure activity. In the body of the narrative, the clinical record contains the last name of the patient.
Access to patient records at Shands Hospitals and Clinics is restricted to persons having a verified and legitimate need to know. Unauthorized access for the purpose of identifying a patient is a violation of law. However, it makes no difference whether an average citizen has access to the information necessary to re-identify a patient. Rather, if identification is possible, the information is PHI.
Respondent and Dr. Shiau were placed on administrative leave as of March 31, 2006, pending the outcome of the investigation.
Ms. Blair concluded her investigation and issued a report dated April 30, 2006. William Ditto, Ph.D., the Chairman of the Department of Biomedical Engineering, in consultation with the Dean of the College of Engineering and the Provost of the University of Florida, determined that in lieu of dismissal, Respondent would be suspended without pay for six months, commencing August 16, 2006, through February 7, 2007. Dr. Shiau was given a written reprimand.
Dr. Ditto sent Respondent a letter dated August 2, 2006. The letter advised Respondent of the six-month suspension. The letter also noted that Respondent was prohibited from engaging in any outside activities with businesses outside the university. The letter stated that Respondent's current outside activities, exemptions, or approvals were withdrawn, including those with BioNeuronics, Inc. and Optima Neuroscience, Inc.
The revocation of Respondent's waiver to participate in outside activities would have required him to abandon investors who licensed his technology at Optima Neuroscience and give up hope of ever seeing his work come to fruition. Therefore, Respondent did not divest himself of his interest in BioNeuronics or Optima Neuroscience. Respondent did discontinue all outside activities with those companies during this period and his stock in Optima Neuroscience was held in escrow.
Respondent appealed the disciplinary action. The UFBOT referred the appeal to the Division of Administrative Hearings. UFBOT denied Respondent's request to be reinstated to his position with the university during the appeal in accordance with Florida Administrative Code Rule 6C1-7.048(2)(c).
UFBOT stopped paying Respondent at the end of the spring semester 2006. Ordinarily, UFBOT would have paid him during the summer from funds generated by this grants. Due to his involuntary administrative leave, Respondent could not do any work under his grant during the summer because the UFBOT refused to continue Respondent in pay status pending his appeal.
Prior to the end of his disciplinary suspension, the university relinquished Respondent's major funding source, the On Line, Real Time Seizure Prediction Grant, worth 2.4 million dollars to the NHI.
Since research was the primary basis of Respondent's employment, Respondent assumed there was no job for him to return to after his defacto suspension was over. On February 16, 2007, Respondent voluntarily resigned from his tenured professorship at the University of Florida.
CONCLUSIONS OF LAW
The Division of Administrative Hearings has jurisdiction over the parties and the subject matter pursuant to
Sections 120.569 and 120.57(1), Florida Statutes (2006), and its contract to hear such cases.
The parties have agreed that Petitioner has the burden of proving by a preponderance of the evidence that it had just cause to discipline Respondent.
The parties have also agreed that the following federal and state statutes and/or regulations apply here:
the provisions of HIPAA as set forth in 42 U.S.C. Sections 1320d et seq.; (b) 45 C.F.R. Part 46, Protection of Human Subjects known as the "Common Rule"; (c) 45 C.F.R. Section 164.514, Other Requirements Relating to Uses and Disclosures of Protected Health Information; (d) 45 C.F.R. 164.530, Security and Privacy, Administrative Requirements; and (e) rules governing the University of Florida as set forth in Florida Administrative Code Chapter 6C1.
Petitioner is entitled adopt rules and to administer standards of conduct for faculty and other personnel, imposing discipline that can range from reprimand to dismissal. See
Sections 1001.74(4), 1001.74(19), and 1012.92, Florida Statutes
(2006).
The University of Florida is a "covered entity" that "must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information." See 45 C.F.R. § 164.530(c)(1). This requirement
means it "must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of this subpart." See 45 C.F.R.
§ 164.530(c)(2)(i).
As a "covered entity", the University of Florida must comply with the requirement set forth in 45 C.F.R. Section 164.530(e)(1), which states that "[a] covered entity must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity or the requirements of this subpart."
The University of Florida is required to designate IRBs to review and approve research involving human subjects in accordance with the constraints set forth by the IRBs and by other institutional and federal requirements. See 45 C.F.R. Part 46. The IRBs' approval process must ensure that "there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data." See 45 C.F.R.
§ 46.111(a)(7).
The standard for de-identification of PHI is found in
45 C.F.R. Section 164.514(b), which provides as follows in relevant part:
Implementation specifications: requirement for de-identification of protected health information. A covered
entity may determine that health information is not individually identifiable health information only if:
A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:
Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and
Documents the methods and results of the analysis that justify such determination; or
(2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:
(A) Names;
* * *
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
* * *
(R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section .
. . .
Research data involving human subjects is exempt from IRB review and approval in certain circumstances. The only
exemption relevant here is found in 45 C.F.R. Section 46.101(b)(4), which states as follows:
(4) Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is records by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.
Consistent with federal requirements, the University of Florida has published its "Information Privacy Policy and Procedures Operational Guidelines" (Guidelines). The Guidelines set forth examples of privacy violations, including but not limited to, the "[u]nauthorized disclosure of private data to persons without a 'Need to Know' either deliberately or accidentally . . ." See Guidelines, Examples of Violations, Number 7, Page 2.
Regarding non-compliance with privacy requirements, the Guidelines, Non-Compliance, Number 3, Page 2, state as follows:
Members of the UF's workforce who fail to comply with the University of Florida's privacy policies and procedures or with the requirements of the state and federal privacy regulations will be disciplined in accordance with the University of Florida's normal disciplinary procedures, up to and including termination of employment. [Emphasis included]
The Guidelines, Types of Disclosures, Pages 5 and 6, describe incidental, accidental and intentional disclosures as follows in relevant part:
Incidental Disclosures: Unintentional disclosures of private data that occur as a result of the normal course of business, and which are incidental to an otherwise permitted use of disclosure of the information.
* * *
Accidental Disclosures: Unintentional disclosures of private data that occur as a result of carelessness and/or failure to follow established policies and procedures, but without malicious or premeditated intent.
* * *
Intentional Disclosures: Disclosures of private data that occur as a result of deliberate and/or pre-meditated disregard of established policies and procedures, with or without malicious intent. (Emphasis included)
According to the Guidelines, Recommended Corrective Actions and Sanctions for Violations of Privacy, Page 10, a Level I violation includes carelessness in handling PHI, resulting in discipline up to and including a Letter of Reprimand. A Level II violation consists in part of a breach of policies that address use and disclosure of PHI, resulting in discipline up to and including suspension without pay. Id.
A Level III violation consists in part of a breach in policies
that address the use and disclosure of PHI for personal gain or to affect harm on another person, resulting in discipline up to and including termination. Id.
The IRB-01 has published a "Policies & Procedures Manual" (Manual) to implement the "Common Rule" as required by federal law. The Manual at page 27 discusses revisions to research, stating that "[t]he IRB must consider and approve all changes to previously approved research, no matter how minor, before they are implemented." (Emphasis included). At page 42, the Manual states as follows in relevant part:
Some types of research may be undertaken without definite plans to include human subjects (as defined in 45 C.F.R.
46.102(f)). In the event that the research does not include human subjects, federal regulations do not apply and IRB review may not be required (this determination however may only be made by the IRB).
In this case, Respondent unilaterally authorized the disclosure of the 447-1993 Protocol data, including the clinical records containing PHI. As the PI for the 447-1993 Protocol, Petitioner knew or should have known that the released data had not been de-identified pursuant to the new HIPAA standards and that it contained PHI. Respondent took this action contrary to Mr. Mahoney's advice to get IRB approval before using the data from the expired protocol for any additional use. Additionally, Respondent could not have had a reasonable belief that he could
send the data to BioNeuronics as part of the exempt BRP Protocol.
Respondent may not have intended to send PHI to BioNeuronics. However, his carelessness and/or failure to follow established policies and procedures resulted in an unintentional disclosure of PHI that constitutes a Level II violation of the Guidelines.
Florida Administrative Code Rule 6C1-7.048 discusses disciplinary actions for faculty as follows in relevant part:
Just cause for termination, suspension, and/or other disciplinary action imposed on a faculty member shall be defined as incompetence or misconduct, which shall include, but not be limited to, the following:
Neglect of duty or responsibilities which impairs teaching, research, or other normal and expected services to the University;
Failure to perform the terms of employment;
Willful violation of a rule or regulation of the University;
Failure to discharge assigned duties;
* * *
Termination and Suspension.
(a) The appointment of any faculty member can be suspended or terminated with or without pay during the term of the faculty member's employment contract for just cause.
* * *
(c) Termination or suspension imposed under this section shall take effect on the date set forth in the notice of termination or suspension, except that if the faculty member timely files a grievance concerning the termination or suspension as set forth in subsection 6C1-7.041(3), F.A.C., the faculty member shall not be deprived of pay and benefits until the grievance process ends with an outcome that allows the discipline.
Florida Administrative Code Rule 6C-7.041(3) describes the grievance procedures available to a faculty member who is subject to discipline. One of the procedures is the opportunity to elect an administrative proceeding pursuant to Section 120.57(1), Florida Statutes, for matters involving the faculty member's substantial interests and disputed issues of fact.
Petitioner had just cause to suspend Respondent without pay for misconduct involving his Level II Guidelines violation. Petitioner also was entitled to
prohibit Respondent from engaging in any activities with outside businesses and to withdraw his existing outside activities, exemptions, or approvals.
However, Respondent's request for an administrative proceeding to challenge the imposition of discipline, required Petitioner to continue Respondent's salary and to provide him with other employment benefits until the issuance of a final order in this case that affirms Petitioner's decision. See Fla. Admin. Code R. 6C1-7.048(2)(c). Florida Administrative Code
Rule 6C1-7.048(2)(c) does not require continuing other privileges associated with Respondent's research position.
There is no evidence that Petitioner deprived Respondent of employment benefits until he voluntarily resigned his position on February 16, 2007. Petitioner did fail to follow the rule requirement to pay Respondent his salary during this appeal.
Petitioner stopped paying Respondent's salary effective August 16, 2006. Respondent is therefore entitled to back pay from August 16, 2006, to February 16, 2007. Respondent's resignation on the latter date relieved Petitioner of the requirement to pay salary and/or benefits beyond that time. It also moots the need for Petitioner, upon the issuance of a final order finding just cause, to impose a prospective six-month suspension from employment without pay.
Based on the foregoing Findings of Fact and Conclusions of Law, it is
RECOMMENDED:
That Petitioner enters a final order finding just cause to discipline Respondent, who is entitled to back pay from
August 16, 2006, to February 16, 2007.
DONE AND ENTERED this 6th day of December, 2007, in Tallahassee, Leon County, Florida.
S
SUZANNE F. HOOD
Administrative Law Judge
Division of Administrative Hearings The DeSoto Building
1230 Apalachee Parkway
Tallahassee, Florida 32399-3060
(850) 488-9675 SUNCOM 278-9675
Fax Filing (850) 921-6847 www.doah.state.fl.us
Filed with the Clerk of the Division of Administrative Hearings this 6th day of December, 2007.
COPIES FURNISHED:
Carla D. Franklin, Esquire Carla D. Franklin, P.A.
4809 Southwest 91st Terrace Gainesville, Florida 32608
Susan M. Seigle, Esquire Dell Graham, P.A.
Post Office Box 850 Gainesville, Florida 32602
B. Dianne Farb, Esquire Assistant General Counsel University of Florida Post Office Box 100215
Gainesville, Florida 32610-0215
Deborah K. Kearney, Esquire General Counsel
Department of Education Turlington Building, Suite 1214
325 West Gaines Street Tallahassee, Florida 32399-0400
Jeanine Blomberg
Interim Commissioner of Education Department of Education Turlington Building, Suite 1514
325 West Gaines Street Tallahassee, Florida 32399-0400
NOTICE OF RIGHT TO SUBMIT EXCEPTIONS
All parties have the right to submit written exceptions within
15 days from the date of this Recommended Order. Any exceptions to this Recommended Order should be filed with the agency that will issue the Final Order in this case.
| Issue Date | Document | Summary |
|---|---|---|
| May 20, 2008 | Agency Final Order | |
| Dec. 06, 2007 | Recommended Order | Petitioner had just cause to suspend Respondent without pay for releasing health information without authorization. |
AGENCY FOR HEALTH CARE ADMINISTRATION vs GOLDEN HAVEN, LLC, D/B/A GOLDEN HAVEN, 06-003319 (2006)
DIAGNOSTIC CYTOLOGY, LLC vs AGENCY FOR HEALTH CARE ADMINISTRATION, 06-003319 (2006)
DELLA CHRISTIE vs DEPARTMENT OF CORRECTIONS, 06-003319 (2006)
AGENCY FOR HEALTH CARE ADMINISTRATION vs SUNRISE MEDICAL CLINIC, INC., 06-003319 (2006)
