Insurance Company sending possible PHI to the wrong mailing address I'm wondering if sending snail mail to the wrong address could ever be a violation of HIPAA? Obviously, due to people moving and not updating their account information, this likely happens all the time However, what if an insurance member has requested an address change from the insurance company (multiple times) but the company fails to update their address in the system and continues to send documents (Explanations of Benefits) to the wrong address?
Under 45 CFR 164.402 a "breach" is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is not a breach. If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also file a complaint with HHS.
There are two separate questions here, cancellation and adding stuff. As for cancellation, you have to look at the applicable laws. In Washington state, for example, there is a law governing insurer cancellation of insurance. For insurance other than fire and medical malpractice insurance, The insurer must deliver or mail written notice of cancellation to the named insured at least forty-five days before the effective date of the cancellation and for medical malpractice, the timing is 90 days; or 5 days for fire insurance. The net result is that all forms of insurance require written notice of cancellation. The terms of an insurance policy can be changed by the insurer: they must tell you of these changes, and you do not have to &quot;ask for&quot; them. If you don't like the changes, you can attempt to persuade them to not make the change, or you can cancel the insurance. Whether or not an insurance broker is authorized by the insurer to act in a particular way depends on the broker's actual relationship to the insurer. In Washington state, agents and brokers are subsumed under one concept &quot;insurance provider&quot;. Agents and brokers are generally not empowered by the insurer to do wholesale re-writings of policies (e.g. adding coverage for seismic damage for all customers). An agent or broker cannot, however, unilaterally add &quot;medical malpractice insurance&quot; specific to your homeowner's policy without your approval.
The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) may apply to you and provide certain rights. HIPAA does seem to cover part of this, though if it covers you particularly and the lab that performed the test is a separate question. On the Department of Health and Human Services website discussing HIPAA, they outline requirements discussing pre-employment drug tests. Basically, your authorization is required in order to release the results of the drug test to your employer and there is nothing prohibiting the employer from conditioning employment on your provision of that authorization. This seems to indicate that the drug test is a medical record. In another section on the same web site concerning your medical records, it outlines that the Privacy Rule gives you the general right to inspect, review and receive a copy of your medical records if the health care provider is covered by the Privacy Rule. You can read about the privacy rule on yet another section of that web site. Generally speaking, the privacy rule applies to any health care provider that transmits health records electronically. Certain exceptions to the rule apply, however determining what those exceptions happen to be is a more difficult task. You will notice from the hhs.gov web site that any entity that is covered by the privacy act is required to give you a privacy practices notice (with certain exceptions). If you didn't receive a privacy practices notice then the entity conducting the drug test is probably not covered by HIPAA. If you did receive a privacy practices notice then the entity conducting the test is covered by HIPAA and you have a right to review your records.
There might be some relevant state law. Michigan has a Social Security Number Privacy Act, which limits use of SS numbers, such as publically displaying an amount of a number, use it as an account number, require it to be transmitted insecurely over the internet, mail it etc. However, it is allowed under 3(a) to mail a number in a document if the purpose is to identify an individual, especially 3(a)(iv), to Lawfully pursue or enforce a person's legal rights, including, but not limited to, an audit, collection, investigation, or transfer of a tax, employee benefit, debt, claim, receivable, or account or an interest in a receivable or account. It would depends on your state, but it is highly likely that debt collection is an allowed purpose (even if it not a real debt, just a good-faith mistake). This gives a brief overview of state laws.
Does posting a letter create any 'legal' agreement between myself and the postal service? Is there any obligation to deliver a letter? Assuming that an agreement is formed, at what point in the process? When the letter entered a post-box, when it was picked up from the postbox, or later - perhaps when a post-mark is added by the postal service? Posting a letter in Germany does not create a contractual agreement between you and the postal service (and so your follow up question above does not apply). Instead, German postal service activities are governed by the Postal Act and regulations adopted by the postal service. The Postal Act creates a system in which independent contractors licensed by the government carry out parts of the process of delivering the mail and are given quasi-governmental status in connection with these activities. Since it is quasi-governmental it has immunity from legal liability, except as set forth expressly by statute. The postal service and its contractors and employees are required to follow the Postal Act and related regulations, and the people and entities involved in doing so may have legal liability for compensatory damages caused to someone as a result of their intentional or negligent violation of the regulations. In contrast, contactual liability is generally imposed without regard to fault and any failure to perform as expected by the parties is actionable. So, in Germany, you can't prevail in suing the postal service or a contractor or postal employee simply by showing that a letter wasn't delivered in a timely fashion, or wasn't forwarded appropriately. You also have to show a court why this happened and demonstrate that the conduct that caused this to happen was intentional or negligent compared to the standard of care for postal workers in the situation in which the alleged misconduct occurred. German law, generally speaking, interprets compensatory damages rather narrowly compared to U.S. courts, for example, generally excluding damages for inconvenience and emotional distress, and favors orders compelling someone to carry out a duty in lieu of a damages award for failure to perform a duty, when possible. Some of the obligations of contractors and employees, such as delivery deadlines, are overall performance standards which are not enforceable in individual cases because not every letter must meet those standards, only a certain percentage of a letters in the system. What commitments beyond the happy-path described above exist? Is there any commitment to attempt to deliver a letter with a less than perfect address (e.g. missing out the postal-code)? Or to offer the recipient the chance to pay the additional postage owed on a letter without enough postage? The highlighted language in subparagraph 4 of the portion of the Postal Universal Service Ordinance quoted at length below governs what should be done in this situation. (There may be additional requirements set forth in other regulations or in individual subcontractor license agreements; this answer is not comprehensive.) The pertinent provisions of the Postal Act provide that: Chapter VII Service of Documents under Public Law Regulations §33 Service of Documents Requirement (1) Any licensee providing letter post delivery services shall undertake to serve documents, irrespective of their weight, in accordance with the provisions of the relevant rules of procedure and legislation on the rules of service in administrative procedure. Sovereign powers commensurate with this obligation shall be vested in the licensee (entrepreneur charged with specific functions in the public interest). (2) The Regulatory Authority shall exempt from the obligation according to (1) above a licensee thus obliged, upon its request, provided the licensee does not have a dominant position in the market. Exemption is ruled out if there is reason to believe that service of documents according to (1) above would no longer be ensured across the Federal Republic of Germany as a result. Exemption may be revoked if the licensee becomes dominant in the market or if the condition set forth in sentence 2 above becomes applicable. A request for exemption may be linked to an application for licence grant. §35 Liability in the Performance of Service of Documents Liable for any damage caused by neglect of duty in the performance of service of documents shall be the licensee obliged, in accordance with the regulations governing a civil service employer’s liability for damages in the territorial area. . . . §38 Liability for Damages Whosoever intentionally or negligently violates this Act, an ordinance having the force of law issued by virtue of this Act, any obligation arising from a licence or any other Regulatory Authority order shall, to the extent that the legal provision, obligation or order aims to protect another party, be obliged to compensate that party for any damage arising from such violation. So, the postal service's obligations with regard to delivering mail are a matter of postal service regulations rather than being in the nature of contracts. And, if an employee or contractor of the postal service causes harm by intentionally or negligently disregarding the regulations, that employee or contractor is obligated to pay compensatory damages to someone harmed by that violation. The primary postal service regulation in Germany, is called the Postal Universal Service Ordinance. Some pertinent provisions of this regulation state: There shall be sufficient letter boxes that customers in urban areas will not need, as a rule, to travel more than 1,000 metres to reach one. Letter boxes shall be emptied every working day and, depending on requirements, on Sundays and bank holidays, as frequently as is needed to comply with the quality standards cited in subpara 3. Letter box clearances shall be based on the dictates of business life; clearance times are to be indicated on the letter boxes. Letter boxes within the meaning of sentences 1 and 2 above may also be other receptacles that are suitable for posting letters. Of the inland letter items mailed on a working day, at least 80 per cent on average, over the year, must be delivered on the working day following the day of mailing and 95 per cent by the second working day following mailing – with the exception of items subject to the requirement of a minimum 50 items per mailing. In respect of intra-Community cross-border mail the quality standards laid down in the Annex to Directive 97/67/EC of the European Parliament and of the Council of 15 December 1997 on common rules for the development of the internal market of Community postal services and the improvement of quality of service (OJ 1998 No. L 15/14) shall apply. If the Annex to the Directive is amended the quality standards in the amended version shall apply as from the first day of the third month following publication of the amendment. Letter items shall be delivered, unless the addressee – by establishing a PO box or in any other way – has declared that he intends to collect the items. Delivery shall be made to the residence or business premises stated in the address, by placing the items in a receptacle specifically for the addressee and large enough to be provided with the items, or by handing the items over in person. Any items that cannot be delivered in accordance with sentence 2 shall be handed over to an alternative recipient, where possible, unless there are instructions to the contrary from the sender or addressee. Where the addressee’s residential or business address can only be reached with undue difficulty or in the absence of a suitable or accessible receptacle for the letter items, the addressee may be excluded from delivery. The person so affected shall be informed of this intended exclusion. There shall be a minimum of one delivery per working day. The structure of postal service law in Germany, as a question of administrative law regarding the functioning of a government agency, rather than as a contract between the person sending a letter than the postal service, would be typical of most countries (although in many countries there would not be the added complication of providing postal services through independent contractors).
I see lots of possible issues here, including: Will the Apprendi decision be given retroactive effect? Were the constitutional issues raised at the time of trial, and if not will a court permit them to be raised later? Will a court agree with the law review publication? Will the facts in your case be sufficiently similar to the cited case? Beyond those, in a section 1983 suit many public employees have qualified immunity unless the legal point was already "well established" when the violation occurred. To pursue this you will need to work with a lawyer skilled in this area. No one on this forum can possibly given you a reliable answer as to whether you have a reasonable case.
Treat all email addresses as if they are personal data. All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address. If your list contains the email addresses of data protection officers then all of them are personal data. The only exception I could see would be email addresses that clearly belong to a corporation that is they are addresses of a legal person which is not a natural person.
While not categorically illegal, there is a risk that using a trademark in an email name is something that is being done with a purpose to defraud people into thinking that you are affiliated with that company (and indeed, such emails are frequently used for that purpose as are misleading domain names). So, while it isn't outright forbidden, it is generally unwise.