Skip to main content
A Better Partnership


Mar 2005
March 01, 2005


As we work toward compliance with the HIPAA security rules, here's a sobering reminder of the increasing risk we face relating to the protection of sensitive information.

This morning, I came across an unpublished Michigan Court of Appeals decision that held a union liable under a theory of negligence for failing to protect the social security numbers of its members. The union permitted one of its employees to take information about union members home, where the employee's daughter apparently misappropriated the members' information to commit identity fraud. The court found that the union was a fiduciary for its members, that it had a duty to protect their sensitive information, and that there was a real and foreseeable risk that the information could be misappropriated for identity fraud.

This decision is limited to the facts of the case. Moreover, it is an unpublished opinion, and therefore does not establish any binding precedent. Nevertheless, employers with health plans may be in a similar situation as the union to its members--particularly if you have a self-administered health plan. A court could easily conclude that you also have a fiduciary duty to protect the information, and would likely look to the HIPAA regulations as the standard of care for such information.

The case can be found at the following link:

If you have any questions about this case or the status of your HIPAA security compliance efforts, please contact Norbert Kugele at 616.752.2186.

NOTICE. Although we would like to hear from you, we cannot represent you until we know that doing so will not create a conflict of interest. Also, we cannot treat unsolicited information as confidential. Accordingly, please do not send us any information about any matter that may involve you until you receive a written statement from us that we represent you.

By clicking the ‘ACCEPT’ button, you agree that we may review any information you transmit to us. You recognize that our review of your information, even if you submitted it in a good faith effort to retain us, and even if you consider it confidential, does not preclude us from representing another client directly adverse to you, even in a matter where that information could and will be used against you.

Please click the ‘ACCEPT’ button if you understand and accept the foregoing statement and wish to proceed.



+ -