06-003319 University Of Florida, Board Of Trustees vs. J. Chris Sackellares, M.D. Status: Closed Recommended Order on Thursday, December 6, 2007.

Summary: Petitioner had just cause to suspend Respondent without pay for releasing health information without authorization.

STATE OF FLORIDA

DIVISION OF ADMINISTRATIVE HEARINGS

UNIVERSITY OF FLORIDA, )

BOARD OF TRUSTEES, )

)

Petitioner, )

)

vs. ) Case No. 06 - 3319

)

J. CHRIS SACKELLARES, M.D., )

)

Respondent. )

)

RECOMMENDED ORDER

A formal hearing was conducted in this case on

September 26 - 27, 2007, in Gainesville, Florida, before

Suzanne F. Hood, Administrative Law Judge with the Division of

Administrative Hearings.

APPEARANCES

For Petitioner : Susan M. Seigle, Esquir e

Dell Graham, P.A.

Post Office Box 850

Gainesville, Florida 32602

B. Dianne Farb, Esquire

Assistant General Counsel

Unive rsity of Florida

Post Office Box 100215

Gainesville, Florida 32610 - 0215

For Respondent: Carla D. Franklin, Esquire

Haile Professional Center

4809 Southwest 91st Ter race

Gainesville, Florida 32608

STATEMENT OF THE ISSUE

The issue is whether Petitioner had just cause to

discipline Respondent by suspending his employment without pay

as a tenured professor for six months , by prohibiting him fr om

engaging in any activities with outside businesses, and by

withdrawing existing outside activities exemptions or approvals .

PRELIMINARY STATEMENT

By letter dated August 2, 2006, Petitioner University of

Florida, Board of Trustees ( Petitioner /UFBOT ) , advised

Respondent J. Chris Sackellares, M.D. (Respondent) that he was

suspended for six months, without pay, from his position as a

professor in the University of Florida's College of Engineering,

commencing on August 16, 2006. The letter also advised

Re spondent that he was prohibited from engaging in any outside

business activities. The letter stated that Respondent 's

existing outside activities exemptions or approvals were

withdrawn.

On August 23, 2006, Respondent filed a Petition for

Administrative Hearing. On September 6, 2006, Petitioner

referred the p etition to the Division of Administrative

Hearings.

A Notice of Hearing , dated September 18, 2006, scheduled

the hearing for December 4 - 7, 2006.

On November 13, 2006, Respondent filed an unopp osed Motion

for Continuance. On November 14, 2006, the undersigned issued

an Order Granting Continuance and Placing Case in Abeyance. At

the request of the parties, the undersigned continued the case

in abeyance on two occasions.

A Notice of Hearing , dated May 21, 2007, scheduled the case

for hearing on September 10 - 12, 2007. Due to a medical

emergency, the case was rescheduled for hearing on September 26 -

27 , 2007 .

During the hearing, Petitioner presented the testimony of

six witnesses. Petitioner offered the following exhibits that

were admitted as evidence: P - 1, P - 2, P - 3a and P - 3b, P - 4 through

P - 9, P - 10a through 10d, P - 11 , P - 12a through P - 12f, P - 13, P - 14,

P - 15a through P - 15e, P - 17 through P - 21.

R espondent testified on his own behalf and prese nted the

testimony of two additional witnesses. Respondent offered the

following exhibits that were admitted as evidence: R - 2, R - 3,

R - 5 through R - 1 2 . Respondent's Exhibit R - 12 is the testimony by

deposition in lieu of live testimony of William L. Ditto , Ph.D.

On November 1, 2007, Respondent filed the testimony by

deposition in lieu of live testimony of Dr. Thomas Walsh, which

is hereby identified as Respondent's Exhibit R - 13 and accepted

as evidence.

The court reporter filed the Transcript on Octobe r 16,

2007. On October 18, 2007, Petitioner filed an unopposed Motion

for Additional Time to File Findings of Fact. The undersigned

granted the motion on October 19, 2007.

The parties timely filed their Proposed Recommended Orders

on November 5, 2007.

FINDINGS OF FACT

1. Respondent is a Board Certi fied medical doctor.

Respondent specializes in neurology and clinical

neurophysiology. He has special expertise in epilepsy and

clini cal neurophysiology. Respondent has performed research in

the area of epilepsy.

2. At all times material to this case, UFBOT employed

Respondent. Respondent also worked for the Malcolm Randall

Veterans Administration (VA).

3. Respondent had a laboratory at the McKnight Brain

Institute on the University of Florida camp us. He was a tenured

professor on the faculty of the B iomedical Engineering

D epartment. He also held joint appointments as Professor of

Neurology and Professor of Psychiatry, a s well as an affiliate

appointment as Professor of Neuro science. Respondent w as a

member of the University of Florida's Graduate Faculty.

4. An Institutional Review Board (IRB) is an internal

review board that has the obligation to provide oversight for

all research activities involving human subjects. IRB - 01 is one

of four r eview boards affiliated with the University of Florida.

IRB - 01 is responsible for oversight of research at the Health

Science Center.

5. IRBs are charged with the responsibility of complying

with federal regulation for the protection of human subjects

found in 45 C.F.R. Part 46 , Protection of Human Subjects . This

regulation is known as the "Common Rule."

6. Beginning in 1993, Respondent was the principal

investigator (PI) on a research protocol entitled "Dynamical

Studies in Temporal Lobe Epilepsy ," hereinafter referred to as

Protocol 447 - 1993. IRB - 01 approved Protocol 44 7 - 1993.

7. Pursuant to Protocol 447 - 1993, data in the form of

video - taped EEGs and clinical records were collected from 18

patients with intractable epilepsy. Some of the dat a was called

"scalp" data, because it was collected via electrodes attached

to the patients' scalps. The rest of the data was called

"depth" data, because it was collected during surgical

procedures.

8. The informed consents in Protocol 447 - 1993 infor med the

subjects that researchers would be reviewing their medical

records to gather information about their epilepsy. According

to t he informed consents, researchers would analyze brain wave

recordings that were performed on the patients as part of the

d iagnostic evaluation , store the recordings on a computer, and

analyze the recordings with new mathematical techniques. The

informed consents also advised the subjects that their personal

information would not appear in print or be presented in a

manner th at could identify them.

9. The informed consents for subjects enrolled in Protocol

447 - 1993 provided that the University of Florida and the VA

Medical Center would protect the confidentiality of the

subjects' records to the extent provided by law. Subje cts were

also informed that the National Institute s of Health (NIH) as

the Study Sponsor, the Food and Drug Administration (FDA), and

IRB - 01 had the right to review the records.

10. Protocol 447 - 1993 continued with IRB - 01 approval for

several years. T he protocol expired in May 2002. It is not

permissible for a researcher to use data from an expired

protocol in a later protocol without additional approval from

the IRB.

11. In 2001, Respondent applied for and received approval

from IRB - 01 for a rese arch protocol entitled "Bioengineering

Research Partnership," identified as Protocol 430 - 2001 (BRP

Protocol). Respondent was the PI for the new protocol. The

proposal for the protocol described the research procedures a s a

plan to develop and test automa ted computer - based algorithms for

analyzing the spati otemporal dynamical properties of multi -

channel EEG recordings to determine the probability of an

epileptic seizure. The computer algorithms were to be tested

and evaluated on three (3) data sets. The first dataset was

comprised of a group of long - term EEG recordings that were

obtained for clinical purposes in patients with medically

intractable epilepsy.

12. By memorandum dated September 18, 2001, Respondent

informed the IRB - 01 Vice Chairman that t he study under which the

EEGs were collected for the BRP Protocol was another IRB - 01

approved protocol, identified as Protocol 22 - 2000. Protocol 22 -

2000 did not include data from Protocol 447 - 1993. Respondent

did not reference data from Protocol 447 - 1993 in his

September 18, 2001, memorandum. Further, there is nothing in

the BRP Protocol that informs the IRB - 01 that data from Protocol

447 - 1993 would be included in the new research project.

13 . If there is a change in a protocol, no matter how

slight, the change must be approved by the IRB. If Respondent

wished to include data from Protocol 447 - 1993 in the BRP

Protocol, he needed to make a request to include that specific

data.

14 . The IRB never gave Respondent approval to use the data

from Proto col 447 - 1993 in the BRP Protocol. The IRB approved

the BRP Protocol as an exempt Category IV study pursuant to the

Common Rule. An exempt Category IV study is " [ r ] esearch

involving the collection or study of existing data, documents,

records, pathologica l or diagnostic specimens, if these sources

are publicly available or if the information is record ed by the

investigator in such a manner that subjects cannot be

identified, directly or through identifiers linked to the

subjects." See 45 C.F.R. § 46.101(b )(4).

1 5 . NIH grants funded the BRP Protocol and Protocol 447 -

1993.

1 6 . In 2003, the privacy provisions of the Health

Insurance Portability and Accountability Act of 1996 (HIPAA)

were implemented at the University of Florida. In order to

enforce t hose provisions, the University of Florida created the

Privacy Office at the Health Science Center. Respondent and all

of his staff were required to take privacy training provided by

the Privacy Office.

1 7 . According to HIPAA, protected health informa tion (PHI)

about a patient may be used or disclosed to others only in

certain circumstances or under certain conditions. Information

about a patient can be de - identified under two alternative

procedures set forth at 45 C.F.R. Section 164.514(b).

1 8 . T he first procedure requires that a qualified person

applying accepted statistical and scientific principals

determines that the risk is very small that the information

could be used, alone or in combination with other reasonably

available information, by a n anticipated recipient to identify

an individual who is a subject of the information . The

qualified person must document the methods and results of the

analysis that justify such a determination.

1 9 . The second procedure is the removal of all identif iers

set forth in 45 C.F.R. Section 164.514(b)(2)(i) from a given

patient data set. The identifiers include any unique

identifying number, characteristic, or code. Additionally, t he

covered entity may not have actual knowledge that the remaining

informat ion can be used alone or in combination with other

information to identify the patient.

20 . If a data set is properly de - identified, it is not PHI

and is not governed by HIPAA. Furthermore, it does not fall

within the definition of human subject resea rch under the Common

Rule. Properly de - identified data does not require subject

consent or IRB approval for disclosure.

21 . Pursuant to the policies and procedures of the IRB - 01,

only the IRB can make the determination that the research does

not inclu de human subjects.

2 2 . BioNeuronics (formerly Neurobionics) is a start - up

medical technology company that Respondent and others formed for

the purpose of translating an invention developed by Respondent

and his colleagues at the University of Florida a nd Arizona

State University into medical devices for the treatment of

patients with epilepsy. The University of Florida Research

Foundation (UFRF) and Arizona State University owned the patent.

BioNeuronics entered into a licensing agreement with the two

institutions , permitting the company to develop the patented

technology.

2 3 . The University of Florida's Office of Technology

Licensing (OTL) was established to work with inventors to

facilitate the transfer of technologies created at the

university t o the commercial sector for public benefit. It is

not uncommon for both inventors and the UFRF to be given stock

in start - up companies. The OTL encourages inventors to maintain

an advisory relationship with the licensee.

2 4 . Pursuant to the licensing agreement, the UFRF was to

provide "test data" to BioNeuronics. The licensing agreement

does not identify the test data to be provided. The licensing

agreement did not contain any provision that test data from

Protocol 447 - 1993 was to be provided to Bio Neuronics .

2 5 . At all times material to this case, Respondent owned

stock in BioNeuronics, as does the UFRF. Respondent was paid

$2000 per month as a consultant for the company. The University

of Florida approved the terms of Respondent 's participat ion in

BioNeuronics .

2 6 . The UF BOT employs Michael Mahoney as the IRB - 01

Coordinator. He is responsible for management of the IRB - 01

office. He sits as an alternate member of the IRB - 01 Board.

The IRB - 01 Executive Committee is composed of the Chairm an, the

Vice - Chairman, the QA Coordinator, the Assistant Director for

IRBs, and Mr. Mahoney.

2 7 . Mr. Mahoney's duties involve more than just office

management. He also act s as a resource for investigators and

research team members on general regulator y information . He

provides guidance with IRB - 01 forms and assistance with the

preparation of submissions for IRB review.

2 8 . In January 2006, Respondent sent an e - mail to

Mr. Mahoney, informing him that Respondent had been acquiring

and storing long - t erm EEG and video records of patients with

medically intractable seizures. Respondent 's e - mail stated that

there was an international effort to establish a shared database

so that researchers in participating institutions could share

datasets. Respondent requested information as to the

requirements to share this data with persons outside the

university.

2 9 . On February 1, 2006, Mr. Mahoney responded to

Respondent , informing him that he needed IRB approval before

doing anything new with the data, inclu ding releasing it to

others. Mr. Mahoney concluded his message by stating that

Respondent would have to submit something to the IRB before

using or sharing old datasets for different research purposes.

30 . At all times material here, Deng Shan Shiau, Ph.D.,

held a faculty position as a Research Assistant Professor of

Biomedical Engineering. Dr. Shiau was in charge of Respondent 's

laboratory.

31 . Dr. Shiau and another research assistant,

Dr. Iasemidis, supervised the work of graduate engineering

students who record ed , stor ed , and analyz ed data in Respondent 's

laboratory . Drs. Iasemidis and Shiau brought technical

experience and engineering expertise to Respondent 's research

projects.

3 2 . Daniel J. D i Lorenzo , M.D., Ph.D., M.B.A, is an

official with BioNeuronics. On February 8, 2006, Respondent

forwarded to Dr . D i Lorenzo a copy of Respondent 's January 2006

e - mail and Mr. Mahoney's February 1, 2006, response. In his

transmittal, Respondent stated that he would ask a new

assistant, Jessica Marti n, to work with Dr. Shiau to obtain

copies of consents signed by patients in the depth electrode

database to see if the consents would allow the sharing of the

de - identified data. Respondent stated that if the consents were

inadequate, he would request pe rmission from IRB.

33 . Respondent contends that his January e - mail to

Mr. Mahoney and Mr. Mahoney's response was not intended to refer

to the release of data to BioNeuronics. Instead, he claims that

he was inquiring about the release of data to an int ernational

symposium of scientists. Respondent 's February 8, 2006, e - mail

to Dr. DiLorenzo is persuasive evidence to the contrary.

3 4 . On March 7, 2006, Jessica Stevens, an employee in

Respondent 's laboratory also wrote an e - mail to Mr. Mahoney.

Ms. Stevens wanted to know what needed to be done to hand over

pre - existing data to others. Ms Stevens wrote a subsequent

e - mail to Mr. Mahoney, clarifying that the data Respondent would

be handing over was gathered from 1994 to 1997, and that the

data wou ld be furnished to BioNeuronics.

3 5 . Mr. Mahoney responded to Ms. Stevens the next day.

Mr. Mahoney stated that Ms. Stevens' question was fairly similar

to the one he had previously answered directly to Respondent .

Mr. Mahoney informed Ms. Stevens th at releasing data originally

obtained for research purposes is a tricky proposition at best.

Mr. Mahoney wanted to know whether the subjects originally

consented to share their data, regardless of whether it was

de - identified. Mr. Mahoney questioned wh ether Respondent wanted

to release identifiable data and whether Respondent had any

conflict of interest issues with the receiving entity.

Mr. Mahoney informed Ms. Stevens that her e - mail did not give

him enough details to assist her, and that she might w ant to

meet with him to ensure that nothing inappropriate occurred.

36 . Ms. Stevens read Mr. Mahoney's response to Respondent ,

who responded, "Don't listen to him." Respondent told

Ms. Stevens that Mr. Mahoney did not know what he was talking

about.

37 . Mr. Mahoney's advice to Respondent about the release

of old data to persons outside the University of Florida was not

a n official directive of the IR B . However, if Respondent did

not believe Mr. Mahoney was qualified to give advice regarding

the re lease of data, there would have been no reason for

Respondent to contact Mr. Mahoney in the first place.

3 8 . On March 8, 2006, Dr. DiLorenzo sent an e - mail to

Respondent . The message thanked Respondent for agreeing to

transfer de - identified continuous EEG data to BioNeuronics .

Dr. DiLorenzo stated that all were in agreement that de -

identified data would not require IR B approval. Dr. DiLorenzo

also related that Dr. Shiau mentioned that he could provide

copies of Epilepsy Monitoring Unit (EMU) reports and a

spreadsheet with the timing of seizure events for each patient.

Respondent did not respond to this message from Dr. DiLorenzo .

3 9 . Respondent subsequently asked Dr. Shiau to put data

from Protocol 447 - 1993 on an external hard drive to send to

BioN euronics. Dr. Shiau sent the external hard drive to

BioNeuronics on or about March 14, 2006.

40 . On March 16, 2006, Respondent sent an e - mail to

Dr. DiLorenzo, asking whether he had any questions about the

data format, location of seizures, seizure ty pes, et cetera.

Respondent admits that Dr. DiLorenzo would not have been able to

determine the seizure type with just the EEG data. Respondent 's

testimony that he did not intend to send BioNeuronics the

patients' clinical records or Excel spreadsheets is not

persuasive.

41 . The patient information from Protocol 447 - 1993

consisted of the following computer files: (a) an EEG file with

an associated " t ag" file; (b) and EMU report consisting of a

clinical encounter record, saved in .pdf format; and (c)an Excel

spreadsheet with the timing of seizure events for each patient.

Respondent knew or should have known that BioNeuronics needed

this information to test its algorithm and that the company

could not succeed using just the EEG files .

42 . Each pati ent from Protocol 447 - 1993 was identified by

a research subject number such as P171 or P267. Dr. Shiau kept

a list of the codes with the associated patient name in a locked

file cabinet to which only he had access.

43 . Each of the computer files on a given patient included

the research subject number as part of the file name. For

example, one of the EEG files for P171 was named P17101.eeg.

The associated tag file for that EE G file was named P17101.tag.

The EMU clinical record for that patient was na med P171.pdf.

The corresponding Excel spreadsheet was named P171.xls.

44 . Respondent originally recorded the Protocol 447 - 1993

data on VHS tapes. In a second study, the pre - recorded data was

transferred from VHS to a digitized form using a proprietar y

Nicolet Biomedical software program util i zed to read the EEGs.

The tag files were also generated by the Nicolet read er . The

contents of the tag file did not appear on the computer screen

when viewing the EEG files, but they could be opened using a

word processing program such as WordPad.

45. Neither Respondent nor Dr. Shiau was aware that six of

the tag files had patient last names imbedded within the binary

codes.

4 6 . The data sent to BioNeuronics was gathered prior to

the implementation of HIP AA. At some point in time, an effort

had been made to de - identify the clinical records by removing

the patients' names, birthdates, and other personal information

on the top half of the first page. There is no evidence that

anyone specifically checked th e data to determine if the records

were de - identified pursuant to the new HIPAA standards.

Therefore, Respondent 's testimony that he did not seek IRB

approval prior to sending the data to BioNeuronics because he

had a reasonable belief that the data from Protocol 447 - 1993 was

de - identified and related to the BRP Protocol is not credible.

4 7 . On March 18, 2006, an anonymous letter was sent to

various entities, including the Office of Civil Rights, the

Department of Veteran Affairs, the FDA, the Florida Board of

Medicine, the Office of the Attorney General of Florida, the

Office for Human Research Protections, the College of Medicine

of the University of Florida, the Office of Research Affairs of

the University of Florida School [sic] of Medicine, and the NIH.

The letter alleged that Respondent had committed an intentional

and willful HIPPA [sic] research protocol violation. The letter

alleged that the violation involved the release of PHI to

BioNeuronics on external hard drives.

4 8 . On March 21, 200 6, Linda Dance, an assistant in

Respondent 's laboratory, wrote a letter to Susan Blair, the

Privacy Officer for the University of Florida. In the letter,

Ms. Dance reported what she believed was a HIPPA [sic]

violation. Ms. Dance identified the violation as the release of

patient data to BioNeuronics, a company in which Respondent

owned stock and from which he received monthly consulting fees.

4 9 . The Office of Human Research Protections (OHRP) is a

federal agency of the United States Department of He alth and

Human Services. The OHRP wrote to the University of Florida and

the VA based on the anonymous letter. The OHRP requested both

institutions to investigate the alleged non - compliance, and

forward to OHRP a written report. The OHRP also required t he

university and the VA to provide a description of any corrective

actions taken to prevent noncompliance in the future.

50 . Ms. Blair undertook an investigation of the matter,

interviewing all of the persons involved. She also contacted

BioNeuronics to inform the company of a potential disclosure of

PHI. The University of Florida Police Department was also

involved in the investigation.

5 1 . BioNeuronics immediately returned the external hard

drive. The company's president, John Harris, attested t hat

BioNeuronics had erased any data from the hard drive that had

been put onto their computer systems. He also attested that to

his knowledge, no one at the company had viewed any PHI.

5 2 . The Security Office of the Health Science Center

received the hard drive. The office then made a forensic copy

of the drive, which contained 18 patient files, including EE G

files, tag files, clinical records, and Excel spreadsheets.

5 3 . The Privacy Office made hard copies of the computer

files to determine whet her t hey contained any PHI . An employee

of Shands Hospitals, who was not connected with the Privacy

Office, but who had full access to confidential hospital patient

records, was able to identify all 18 patients within a very

short time.

5 4 . For at lea st one of the patients, the clinical record

reflects that it is a record of Shands Hospital at the

University of Florida. It also contains a room number, a date

of service, the name and signature of the doctor, the

medications prescribed, the types of pro cedures involved, and a

diagnosis and detailed description of the patient's seizure

activity. In the body of the narrative, the clinical record

contains the last name of the patient.

5 5 . Access to patient records at Shands Hospitals and

Clinics is res tricted to persons having a verified and

le g itimate need to know. Unauthorized access for the purpose of

identifying a patient is a violation of law. However, it makes

no difference whether an average citizen has access to the

information necessary to re - identify a patient. Rather, if

identification is possible, the information is PHI.

5 6 . Respondent and Dr. Shiau were placed on administrative

leave as of March 31, 2006, pending the outcome of the

investigation.

5 7 . Ms. Blair concluded her invest igation and issued a

report dated April 30, 2006. William Ditto, Ph.D., the Chairman

of the Department of Biomedical Engineering, in consultation

with the Dean of the College of Engineering and the Provost of

the University of Florida, determined that in lieu of dismissal,

Respondent would be s uspended without pay for six months,

commencing August 16, 2006, through February 7, 2007. Dr. Shiau

was given a written reprimand.

5 8 . Dr. Ditto sent Respondent a letter dated August 2,

2006. The letter advise d Respondent of the six - month

suspension. The letter also noted that Respondent was

prohibited from engaging in any outside activities with

businesses outside the university. The letter stated that

Respondent 's current outside activities, exemptions, or

approvals were withdrawn, including those with BioNeuronics,

Inc. and Optima Neuroscience, Inc.

59. The revocation of Respondent 's waiver to participate

in outside activities would have required him to abandon

investors who licensed his technology at O ptima Neuroscience and

give up hope of ever seeing his work come to fruition.

Therefore, Respondent did not divest himself of his interest in

BioNeuronics or Optima Neuroscience. Respondent did discontinue

all outside activities with those companies duri ng th is period

and his stock in Optima Neuroscience was held in escrow.

60 . Respondent appealed the disciplinary action. The

UFBOT referred the appeal to the Division of Administrative

Hearings. UFBOT denied Respondent 's request to be reinstated to

h is position with the university during the appeal in accordance

with Florida Administrative Code Rule 6C1 - 7.048(2)(c).

61. UFBOT stopped paying Respondent at the end of the

spring semester 2006. Ordinarily, UFBOT would have paid him

during the summer from funds generated by this grants. Due to

his involuntary administrative leave, Respondent could not do

any work under his grant during the summer because t he UFBOT

refused to continue Respondent in pay status pending his appeal.

6 2 . Prior to the en d of his disciplinary suspension, the

university relinquished Respondent 's major funding source, the

On Line, Real Time Seizure Prediction G rant , worth 2.4 million

dollars to the NHI.

6 3 . Since research was the primary basis of Respondent 's

employment, Respondent assumed there was no job for him to

return to after his defacto suspension was over. On February

16, 2007, Respondent voluntarily resigned from his tenured

professorship at the University of Florida.

CONCLUSIONS OF LAW

64 . The Division of Administrative Hearings has

jurisdiction over the parties and the subject matter pursuant to

Sections 120.569 and 120.57(1), Florida Statutes (2006), and its

contract to hear such cases.

65 . The parties have agreed that Petitioner has the burden

of provi ng by a preponderance of the evidence that it had just

cause to discipline Respondent.

66 . The parties have also agreed that the following

federal and state statutes and/or regulations apply here:

(a) the provisions of HIPAA as set forth in 42 U.S .C. Sections

1320d et seq. ; (b) 45 C.F.R. Part 46, Protection of Human

Subjects known as the "Common Rule"; (c) 45 C.F.R. Section

164.514, Other Requirements Relating to Uses and Disclosures of

Protected Health Information; ( d ) 45 C.F.R. 164.530, Security

and Privacy , Administrative Requirements ; and ( e ) rules

governing the University of Florida as set forth in Florida

Administrative Code Chapter 6C1.

67 . Petitioner is entitled adopt rules and to administer

standards of conduct for faculty and other per sonnel, imposing

discipline that can range from reprimand to dismissal. See

Sections 1001.74(4), 1001.74(19), and 1012.92, Florida Statutes

(2006).

6 8 . The University of Florida is a "covered entity" that

"must have in place appropriate administrative , technical, and

physical safeguards to protect the privacy of protected health

information." See 45 C.F.R. § 164.530(c)(1). This requirement

means it "must reasonably safeguard protected health information

from any intentional or unintentional use or di sclosure that is

in violation of the standards, implementation specifications or

other requirements of this subpart." See 45 C.F.R.

§ 1 64.530(c)(2)(i).

6 9 . As a "cover ed entity", the University of Florida must

comply with the requirement set forth in 45 C.F.R. Section

164.530(e)(1) , which states that "[a] covered entity must have

and apply appropriate sanctions against members of its workforce

who fail to comply with the privacy policies and procedures of

the covered entity or the requirements of this subpart."

70 . The University of Florida is required to designate

IRBs to review and approve research involving human subjects in

accordance with the constraints set forth by the IRBs and by

other institutional and federal requirements. See 45 C.F.R.

P art 46 . The IRBs' approval process must ensure that "there are

adequate provisions to protect the privacy of subjects and to

maintain the confidentiality of data. " See 45 C.F.R.

§ 46.111(a)(7).

71 . The standard for de - identification of PHI is found i n

45 C.F.R. Section 164.514(b), which provides as follows in

relevant part:

(b) Implementation specifications:

requirement for de - identification of

protected health information. A covered

entity may determine that health information

is not indivi dually identifiable health

information only if:

(1) A person with appropriate

knowledge of and experience with generally

accepted statistical and scientific

principles and methods for rendering

information not individually identifiable:

(i) Applying such principles and

methods, determines that the risk is very

small that the information could be used,

alone or in combination with other

reasonably available information, by an

anticipated recipient to identify an

individual who is a subject of the

information; and

(ii) Documents the methods and results

of the analysis that justify such

determination; or

(2)(i) The following identifiers of

the individual or of relatives, employers,

or household members of the individual, are

removed :

(A) Names;

* * *

(C) All elements of dates (except

year) for dates directly related to an

individual, including birth date, admission

date, discharge date, date of death; and all

ages over 89 and all elements of dates

(including year) i ndicative of such age,

except that such ages and elements may be

aggregated into a single category of age 90

or older ;

* * *

(R) Any other unique identifying

number, characteristic, or code, except as

permitted by paragraph (c) of this section .

. . .

7 2 . Research data involving human subjects is exempt from

IRB review and approval in certain circumstances. The only

exemption relevant here is found in 45 C.F.R. Section

46.101(b) ( 4), which states as follows:

(4) Research involving the co llection

or study of existing data, documents,

records, pathological specimens, or

diagnostic specimens, if these sources are

publicly available or if the information is

records by the investigator in such a manner

that subjects cannot be identified, direc tly

or through identifie rs linked to the

subjects.

7 3 . Consistent with federal requirements, the University

of Florida has published its "Information Privacy Policy and

Procedures Operational Guidelines" (Guidelines). The G uidelines

set forth example s of privacy violations , including but not

limited to , the "[u]nauthorized disclosure of private data to

persons without a 'Need to Know' either deliberately or

accidentally . . ." See Guidelines, Examples of Violations,

Number 7, P age 2.

7 4 . Regardin g non - compliance with privacy requirements,

the Guidelines , Non - Compliance, Number 3, P age 2, state as

follows:

Members of the UF's workforce who fail

to comply with the University of Florida's

privacy policies and procedures or with the

requirement s of the state and federal

privacy regulations will be disciplined in

accordance with the University of Florida's

normal disciplinary procedures, up to and

including termination of employment.

[Emphasis included]

7 5 . The Guidelines , Types of Disclosu res, P age s 5 and 6,

describe i ncidental, a ccidental and i ntentional disclosures as

follow s in relevant part:

1. Incidental Disclosures :

Unintentional disclosures of private data

that occur as a result of the normal course

of business, and which are incidental to an

otherwise permitted use of disclosure of the

information.

* * *

2. Accidental Disclosures :

Unintentional disclosures of private data

that occur as a result of carelessness

and/or failure to follow established

policies and proce dures, but without

malicious or premeditated intent.

* * *

3. Intentional Disclosures :

Disclosures of private data that occur as a

result of deliberate and/or pre - meditated

disregard of established policies and

procedures, with or without malicious

i ntent. ( Emphasis included )

7 6 . According to the Guidelines , Recommended Corrective

Actions and Sanctions for Violations of Privacy, P age 10, a

Level I violation includes carelessness in handling PHI ,

resulting in discipline up to and including a Lett er of

Reprimand. A Level II violation consist s in part of a breach of

policies that address use and disclosure of PHI, resulting in

discipline up to and including suspension without pay. Id.

A Level III violation consists in part of a breach in polic ies

that address the use and disclosure of PHI for personal gain or

to affect harm on another person, resulting in discipline up to

and including termination. Id.

7 7 . The IRB - 01 has published a "Policies & Procedures

Manual" (Manual) to implement the "Common Rule" as required by

federal law. The Manual at page 27 discusses revisions to

research, stating that "[t]he IRB must consider and approve all

changes to previously approved research, no matter how minor,

before they are implemented ." ( Emphasis i ncluded ) . At page 42,

the Manual states as follows in relevant part:

Some types of research may be

undertaken without definite plans to include

human subjects (as defined in 45 C.F.R.

46.102(f)). In the event that the research

does not include human subjects, federal

regulations do not apply and IRB review may

not be required (this determination however

may only be made by the IRB).

7 8 . In this case, Respondent unilaterally authorized the

disclosure of the 447 - 1993 Protocol data, including the c linical

records containing PHI. As the PI for the 447 - 1993 Protocol,

Petitioner knew or should have known that the released data had

not been de - identified pursuant to the new HIPAA standards and

that it contained PHI. Respondent took this action contrar y to

Mr. Mahoney's advice to get IRB approval before using the data

from the expired protocol for any additional use. Additionally,

Respondent could not have had a reasonable belief that he could

send the data to BioNeuronics as part of the exempt BRP

Pro tocol.

7 9 . Respondent may not have intend ed to send PHI to

BioNeuroni cs. However, his carelessness and/or failure to

follow established policies and procedures resulted in an

unintentional disclosure of PHI that constitutes a Level II

violation of the Guidelines.

80 . Florida Administrative Code Rule 6C1 - 7.048 discusses

disciplinary actions for faculty as follows in relevant part:

(1) Just cause for termination,

suspension, and/or other disciplinary action

imposed on a faculty member shall b e defined

as incompetence or misconduct, which shall

include, but not be limited to, the

following:

(a) Neglect of duty or

responsibilities which impairs teaching,

research, or other normal and expected

services to the University;

(b) Failure t o perform the terms of

employment;

(c) Willful violation of a rule or

regulation of the University;

(d) Failure to discharge assigned

duties;

* * *

(2) Termination and Suspension.

(a) The appointment of any faculty

member can be s uspended or terminate d with

or without pay during the term of the

faculty member's employment contract for

just cause.

* * *

(c) Termination or suspension imposed

under this section shall take effect on the

date set forth in the notice of termin ation

or suspension, except that if the faculty

member timely files a grievance concerning

the termination or suspension as set forth

in subsection 6C1 - 7.041(3), F.A.C., the

faculty member shall not be deprived of pay

and benefits until the grievance proce ss

ends with an outcome that allows the

discipline.

81 . Florida Administrative Code Rule 6C - 7.041(3) describes

the grievance procedures av ailable to a faculty member who is

subject to discipline. One of the procedures is the opportunity

to elect an a dministrative proceeding pursuant to Section

120.57(1), Florida Statutes, for matters involving the faculty

member's substantial interests and disputed issues of fact.

8 2 . Petitioner ha d just cause to suspend Respondent

without pay for misconduct invol ving his Level II Guidelines

violation . Petitioner also was entitled to

prohib it Respondent from engaging in any acti vities with outside

businesses and to withdraw his existing outside activities,

exemptions, or approvals.

8 3 . However, Respondent 's r equest for an administrative

proceeding to challenge the imposition of discipline, required

Petitioner to continue Respondent's salary and to provide him

with other employment benefits until the issuance of a final

order in this case that affirm s Petitione r's decision. See Fla.

Admin. Code R. 6C1 - 7.048(2)(c). Florida Administrative Code

Rule 6C1 - 7.048(2)(c) does not require continuing other

privileges associated with Respondent's research position.

84 . There is no evidence that Petitioner deprived

Res pondent of employment benefits until he voluntarily resigned

his position on February 16, 2007. Petitioner did fail to

follow the rule requirement to pay Respondent his salary during

this appeal .

85 . Petitioner stopped paying Respondent's salary

effec tive August 16, 2006 . Respondent is therefore entitled to

back pay from August 16, 2006, to February 16, 2007 .

Respondent's resignation on the latter date relieved Petitioner

of the requirement to pay salary and/or benefits beyond that

time. It also moo ts the need for Petitioner, upon the issuance

of a final order finding ju st cause, to impose a prospective

six - month suspension from employment without pay.

RECOMMENDATION

Based on the foregoing Findings of Fact and Conclusions of

Law, it is

RECOMMENDE D:

That Petitioner enters a final order finding just cause to

discipline Respondent , who is entitled to back pay from

August 16, 2006, to February 16, 2007 .

DONE AND ENTERED this 6th day of December, 2007, in

Tallahassee, Leon County, Florida.

S

SUZANNE F. HOOD

Administrative Law Judge

Division of Administrative Hearings

The DeSoto Building

1230 Apalachee Parkway

Tallahassee, Florida 32399 - 3060

(850) 488 - 9675 SUNCOM 278 - 9675

Fax Filing (850) 921 - 6847

www.doah. state.fl.us

Filed with the Clerk of the

Division of Administrative Hearings

this 6th day of December, 2007.

COPIES FURNISHED :

Carla D. Franklin, Esquire

Carla D. Franklin, P.A.

4809 Southwest 91st Terrace

Gainesville, Florida 32608

Susan M. Seigle, E squire

Dell Graham, P.A.

Post Office Box 850

Gainesville, Florida 32602

B. Dianne Farb, Esquire

Assistant General Counsel

University of Florida

Post Office Box 100215

Gainesville, Florida 32610 - 0215

Deborah K. Kearney, Esquire

General Counsel

Departmen t of Education

Turlington Building, Suite 1214

325 West Gaines Street

Tallahassee, Florida 32399 - 0400

Jeanine Blomberg

Interim Commissioner of Education

Department of Education

Turlington Building, Suite 1514

325 West Gaines Street

Tallah assee, Florida 32399 - 0400

NOTICE OF RIGHT TO SUBMIT EXCEPTIONS

All parties have the right to submit written exceptions within

15 days from the date of this Recommended Order. Any exceptions

to this Recommended Order should be filed with the agency that

will issue t he Final Order in this case.