Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Greenway Health, LLC v. Southeast Alabama Rural Health Associatess

Supreme Court of Alabama

May 17, 2019

Greenway Health, LLC, and Greenway EHS, Inc.
v.
Southeast Alabama Rural Health Associates Sunrise Technology Consultants, LLC, and Lee Investment Consultants, LLC
v.
Southeast Alabama Rural Health Associates

          Appeals from Pike Circuit Court (CV-17-900018)

          BOLIN, Justice.

         Greenway Health, LLC, and Greenway EHS, Inc. (formerly EHS, Inc.) (hereinafter referred to collectively as "the Greenway defendants"), and Sunrise Technology Consultants, LLC, and Lee Investment Consultants, LLC (hereinafter referred to collectively as "the Sunrise defendants"), appeal separately from the Pike Circuit Court's order denying their motion to compel the arbitration of certain claims asserted against them by Southeast Alabama Rural Health Associates ("SARHA").

         Facts and Procedural History

         The Greenway defendants specialize in practice-management software for the medical industry. SARHA is a private nonprofit corporation that provides medical services to the residents of rural southeast Alabama. SARHA operates 10 facilities across southeast Alabama and provides medical care to approximately 70, 000 patients. SARHA alleged in its complaint that, since 2009, all of its patient records --including contact information, billing information, and treatment records -- had been housed in its medical-records database. SARHA is required by federal law to maintain electronically medical records for each patient receiving health-care services eligible for reimbursement under a federally funded program. SARHA is further required to provide adequate safeguards against the loss, destruction, or unauthorized use of patient medical records pursuant to Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Those requirements include a data backup plan with procedures to create and maintain retrievable copies of all electronically protected health information and a disaster-recovery plan to restore any loss of data that may occur.

         1. SARHA's Relationship with the Greenway Defendants

         On March 18, 2008, SARHA entered into a master license agreement with EHS, Inc., an Alabama corporation, in which SARHA obtained a nonexclusive and nontransferable right to install and use electronic medical-records software for the management of SARHA's patient records ("the license agreement"). The license agreement expressly states that it "sets forth the terms and conditions under which the parties agree that [SARHA] may ... obtain licenses to use EHS['s] proprietary software" (EHS's proprietary software is hereinafter referred to as "the software"). Section 1 of the license agreement, entitled "License Grant and Right of Use," provides that EHS grants SARHA a nonexclusive and nontransferable license to install the software. Section 1 also prohibits SARHA from applying any procedure or process to the software to ascertain any source code or any trade-secret information or process contained in the software.

         Section 3 of the license agreement, entitled "Maintenance, Support and Other Services," provides that EHS shall provide SARHA with certain maintenance and support services relating to the software, including updates to the software, Web-based support consisting of information on the current software, telephone support in the form of advice and counsel regarding SARHA's use of the software, and training and consulting services for SARHA's employees relating to the use and operation of the software.

         Section 9(a) of the license agreement contains the following arbitration agreement:

"Arbitration. Except for actions to protect Proprietary Rights and to enforce an arbitrator's decision hereunder, all disputes, controversies, or claims arising out of or relating to this Agreement or a breach thereof shall be submitted to and finally resolved by arbitration under the rules of the American Arbitration Association ('AAA') then in effect. There shall be one arbitrator, and such arbitrator shall be chosen by mutual agreement of the parties in accordance with AAA rules. The arbitration shall take place in Birmingham, Alabama, if proceedings are initiated by Licensee, and in Licensee's choice of venue, if initiated by EHS. The arbitrator shall apply the laws of the State of Alabama to all issues in dispute. The findings of the arbitrator shall be final and binding on the parties, and may be entered in any court of competent jurisdiction for enforcement. Legal fees shall be awarded to the party prevailing in the arbitration."

On July 25, 2013, EHS was acquired by Greenway Health and became a wholly owned subsidiary of Greenway Health. Subsequently, EHS was renamed Greenway EHS, Inc.

         Both SARHA and the Greenway defendants have certain obligations under the United States Department of Health and Human Services ("HHS") privacy and security rules set forth at 45 C.F.R. parts 160 and 164, implementing HIPAA. Those privacy and security rules require health-care providers to "ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits" and to "protect against any reasonably anticipated threats or hazards to the security or integrity of such information." 45 C.F.R. § 164.306(a)(1) and (2). In an effort to meet their HIPAA obligations, SARHA and the Greenway defendants, in 2014, entered into a business associate agreement ("BAA") for the express purpose of setting forth the "terms and conditions pursuant to which Protected Health Information[1] that is received from, or received, maintained, created, or transmitted on behalf of, [SARHA] by [the Greenway defendants] will be handled between themselves and third parties."

         Section 3.1 of the BAA sets forth the Greenway defendants' responsibilities regarding the protected health information. Section 3.1(a) requires the Greenway defendants, when providing services to SARHA, to "comply with the requirements of the Privacy rule that apply to [SARHA] in the performance of those obligations." Section 3.1(b) of the BAA requires the Greenway defendants to "implement and use appropriate administrative, physical, and technical safeguards and ... comply with applicable Security Rule requirements with respect to Electronic Protected Health Information to prevent use or disclosure of Protected Health Information other than as provided for by this Agreement." Section 3.1(c) requires the Greenway defendants to notify SARHA of (1) any use and/or disclosure of protected health information not permitted by the BAA or (2) any security incident the Greenwood defendants become aware of. Section 3.1(d) requires the Greenwood defendants to notify SARHA, without unreasonable delay, of any breach of protected health information. Section 3.1(h) of the BAA requires the Greenway defendants to, "within fifteen (15) days of receiving a written request from [SARHA], make available (in accordance with the requirements of 45 C.F.R. § 164.524) Protected Health Information necessary for [SARHA] to respond to individuals' requests for access to Protected Health Information about them."

         Section 3.2 sets forth the Greenway defendants' responsibilities with respect to privacy of and safeguards for financial data and requires the Greenway defendants to, among other things, implement proper administrative, technical, and physical safeguards designed to ensure the security and confidentiality of the protected health information.

         The BAA also addresses dispute resolution. Section 5.8 of the BAA provides that, "[i]f any controversy, dispute or claim arises between the Parties with respect to this Agreement, the Parties shall make good faith efforts to resolve such matters informally." Finally, section 5.1 of the BAA provides:

"Entire Agreement. This Agreement, and all attachments, schedules and exhibits hereto, constitutes the entire agreement and understanding between the Parties with respect to the subject matter hereof and supersedes any prior or contemporaneous written or oral memoranda, negotiations, arrangements, contracts, or understandings of any nature or kind between the Parties with respect to the subject matter hereof."

         2. SARHA's Relationship with the Sunrise Defendants

         The Sunrise defendants specialize in providing technical computer-hardware installation, service, and maintenance. In August 2008, SARHA entered into a service agreement with the Sunrise defendants for the installation and maintenance of the computer servers and hardware necessary to "run" the software. In October 2010, SARHA and the Sunrise defendants entered into a second service agreement whereby the parties agreed that Sunrise Technology would continue to provide services to SARHA consisting of support and maintenance of SARHA's information- technology infrastructure, servers, and personal-computer workstations. In January 2014, SARHA and the Sunrise defendants entered into a BAA in which the Sunrise defendants agreed to, among other things, "implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Electronic Protected Health Information." Neither the service agreements nor the BAA entered into between SARHA and the Sunrise defendants contained an arbitration provision.

         Although the BAA did not contain an arbitration provision, it did contain a jurisdiction provision, which provides:

"This agreement shall be deemed executed in the State of Alabama, U.S.A., and is to be governed and construed by Alabama law, without regard to its choice of law provisions. The parties agree that jurisdiction and venue for any action to enforce this Agreement are properly in the applicable federal or state courts encompassing Barbour, Coffee, Crenshaw, Dale, Geneva, Henry, Houston and Pike Counties, Alabama."

         3. SARHA's Claims

         SARHA states that, after the BAAs were executed, the Greenway defendants and the Sunrise defendants were directly involved in monitoring, maintaining, and supporting SARHA's computer servers and database. However, between May 2016 and August 2016, SARHA's primary and secondary hard-disc drives in the servers containing protected health information for SARHA's patients failed. SARHA was unable to access any of its patients' medical information, including scheduling information, medical-record histories, and patient billing information. SARHA asserts that it requested that the Greenway defendants and the Sunrise defendants restore the medical information and that the Greenway defendants and the Sunrise defendants have been unable to do so. SARHA states that the Greenway defendants and the Sunrise defendants have disclosed that they do not have a viable backup of the database that would allow the database be restored and the medical information recovered.

         On January 25, 2017, SARHA sued the Greenway defendants and the Sunrise defendants (hereinafter referred to collectively as ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.