Counseling Through An In-House Crisis

Here's a cautionary tale of how NOT to act in a crisis.

Dont PanicEarly in my in-house career for a hospital organization, I was approached by an entry-level manager who informed me her laptop had gone missing. Worse yet, given her position in the organization, her laptop contained thousands of patient medical records.

By way of brief explanation for those not familiar with the health care industry or HIPAA (the Health Insurance Portability and Accountability Act), misplacing patient information is bad. As in, a Dallas hospital was fined $3.2 million by the federal government earlier this year for losing a single laptop bad. Every industry has their unique deadly sins; losing patient information is certainly one for the health care industry.

So with that context in mind, I admittedly had a rather severe panic attack, then sprang into action. I fired off a series of emails to my relevant in-house colleagues, to my boss, to my boss’s boss, to our communications team, and to anyone else I thought should know about the case of the missing laptop.

Not only was I “wise” enough to state the facts of our present situation, I also let them know just how massive of a penalty we could be levied for our actions. And it should come as no surprise that my e-mails, to use a legal term of art, scared the bejesus out of most of the recipients.

As the frenzy I had created was beginning to reach a full boil, a much more senior member of our in-house team entered my office, calmly sat down, and asked me to recite the facts as I knew them.

After patiently listening, she explained we could do little to change those facts, and our job was to take the appropriate steps to mitigate future risk to our patients’ information. Not remind our company’s leadership how bad a HIPAA breach could be — after all, if they were running the organization, they were already acutely aware of this fact.

Besides, she reminded me, the Office of Civil Rights (OCR), the federal wing with punitive authority for HIPAA breaches, routinely takes years to levy a fine. Dealing with whatever punitive action OCR saw fit would be a problem for our future selves, not our present ones.

Sponsored

Her counsel hit me like a bolt of lightening. She was right. My actions had done little more than cast blame on the organization and incite a small panic; they had not taken any demonstrable steps to finding a solution.

In fact, the only “wise” decision I made that day was to turn over the reins of our response to my colleague who suggested we first ask the manager to retrace her steps over the previous day. And as luck would have it, her laptop turned up in a rarely used conference room a few minutes later. Safe and sound, and most importantly, no violation of HIPAA or our patients’ information.

Although I think I am still removing the proverbial egg from my face from my first crisis moment many years later, I am forever grateful for the experience.

As in-house lawyers, our job is often to be the voice of reason in an uncertain time. By keeping a measured tone in a crisis moment, we just may be able to prevent the CEO from firing off an e-mail that later is both discoverable and damning.

Admittedly, keeping a measured tone in the face of crisis has been difficult. As in-house counsel, you can get clued into some seemingly catastrophic scenarios; however, leave the Doomsday predictions to your non-legal colleagues in these moments.

Sponsored

Your job is to think of the common-sense solutions, like having someone retrace their steps from the day, not join in on the talk of the worst-case scenarios.


Stephen R. Williams is in-house counsel with a multi-facility hospital network in the Midwest. His column focuses on a little talked about area of the in-house life, management. You can reach Stephen at stephenwilliamsjd@gmail.com.