In October of 2013, two outreach workers from the New York Harm Reduction Educators (NYHRE) were walking past a Harlem United housing facility on Lexington Avenue and they came upon a dumpster on the sidewalk that they said held records including “the full name, HIV diagnosis, secondary diagnosis of MAI, medication list, CD4 count, Viral Load, Social Security card, and New York State Benefit ID Card” of Harlem United clients.
The workers went into the facility and reported to staff of the AIDS group that people were “rummaging through the exposed materials on the sidewalk,” according to a letter that Carolina M. Lopez, the NYHRE’s executive director, later sent to Harlem United and about a half dozen government agencies. The workers “were met with indifference by the staff at Harlem United,” Lopez wrote.
The NYHRE workers took the records and carried them back to their own office where they were reviewed by a deputy director who concluded that they contained “a multitude of [HIPAA] and [Americans with Disabilities Act] violations, involving five individuals,” the letter said.
Healthcare provider says it’s not covered by federal healthcare provider confidentiality law
Roughly two weeks later, Lopez filed a complaint with the Office for Civil Rights at the US Department of Health and Human Services (HHS) which investigates breaches of patient records under HIPPA, the 1996 Health Insurance Portability and Accountability Act. In the complaint, Lopez wrote, “The file contained confidential information about the HIV status, medical conditions, substance use histories, and personal identification of numerous clients at Harlem United.”
On June 27, 2014, HHS began its investigation into a possible HIPAA violation by writing to Harlem United and asking if it was a “covered entity” as that is defined under federal law. More specifically, the federal agency asked, “Are any of the covered transactions transmitted in electronic form?” and “Does your organization furnish, bill, or receive payment for health care provided to patients?”
Harlem United has been billing Medicaid for years. In 2012, the latest year Gay City News could find information for, Harlem United billed Medicaid just over $2.1 million, accounting for about 10 percent of the agency’s revenues that year, according to an annual form that non-profits file with the IRS.
Currently on its website, Harlem United says it provides primary care services to clients at two health centers and uses “state-of-the-art electronic medical records,” which would mean it is a “covered entity” as that is defined under federal law. It has been operating a federally qualified health center since 2007 where it provides healthcare to clients.
But in its July 2014 response, Harlem United wrote, “No, neither Harlem United nor [North General AIDS Housing Development Fund Corporation] furnishes, bills, or receives payment for health care provided to patients.”
The North General entity is a wholly owned subsidiary of Harlem United that operates the housing facility where the records were found. The agency declined to comment, and HHS did not respond to requests for comment.
On July 31, HHS wrote to Lopez informing her that it had closed the case because it “does not have authority to investigate your complaint… In this particular case, Harlem United does not meet the definition of a health care provider as it does not provide health care services. In a conversation with a Harlem United staff member, [the Office for Civil Rights] learned that Harlem United’s primary purpose is the provision of housing services.”
Gay City News sought the records under the federal Freedom of Information Act last year after Kelsey Louie, the chief operating officer at Harlem United until mid-2014, was accused of rigging a board election at Front Runners New York by registering clients at the AIDS Service Center NYC. Gay City News sought the records to determine if Louie, who now heads GMHC, had been accused of breaching the confidentiality of medical records.
Louie and the AIDS Service Center NYC are not named in any HIPAA complaint. GMHC is named in a 2005 complaint, which was outside the date range for records that Gay City News sought. The Harlem United records were released to Gay City News this past September.
Jonathan E. Montgomery, an attorney in the healthcare practice at Gordon Feinblatt LLC in Baltimore, was not surprised that HHS asked Harlem United if it was a “covered entity” because it is not immediately apparent that the agency is a healthcare provider.
“It makes sense because they are not talking to a hospital where there is no question,” Montgomery said. “They have to establish their jurisdiction.”
As to Harlem United’s assertion that it was not a “covered entity,” Montgomery said that was possible, but unlikely.
“It’s very rare that a healthcare provider that collects and bills for services will not be a HIPAA entity,” he said. “I’ve never encountered [a federally qualified health center] that asserted it was not covered by HIPAA. It’s theoretically possible, but it would be very surprising.”
Editor's note: Subsequent to the publication of this story, Kimberleigh J. Smith, Harlem United's vice president for policy, advocacy & communications, in an email message said the group “will not comment on complaints or investigations,” but explained, “Harlem United does not provide health care services, and is not a Federally Qualified Health Center. Upper Room AIDS Ministry, Inc.: Adult Day Health Care, which is a subsidiary corporation of Harlem United (and is a separate 501(c)(3) not-for-profit corporation with a separate EIN) is the Federally Qualified Health Center, and provides health care services and bills Medicaid for those health care services.”
