For One Practice Owner, a Broken Marriage Means a Broken IT Systems Contract — and This Very Serious HIPAA Headache

DR. FULLER’S MULTI-DOCTOR private practice had barely survived 2020: the pandemic, unemployment claims, staffing shortages and even a late-night break-in. Then, a few months into 2021, the practice fell victim to a ransomware attack.

One of Dr. Fuller’s associate optometrists, Dr. Pullman, was married to the owner of a mid-sized IT firm. When Dr. Pullman was hired in 2019 his wife Ginny offered a complimentary audit of the practice’s systems. Dr. Fuller gratefully accepted—she herself had no computer skills and could tell that Ginny was honest and knowledgeable. Up until then the practice had relied on a patchwork of part-time college students to keep things running smoothly.

Ginny’s audit revealed a myriad of issues and concerns, and when Dr. Fuller confessed she couldn’t afford the $1,200/month service contract, Ginny moved most of the work off the books, taking projects on herself. Dr. Fuller signed a contract for $200/month—which covered third party subscription fees—and wrote off eyewear, contact lenses and medical care for Ginny, her two kids and her parents. The deal had worked out in Ginny’s favor financially, but the recent data breach was a heavy administrative burden and Dr. Fuller was grateful to have someone like Ginny when the threat of fines in the tens of thousands of dollars was at stake.

Advertisement

One Sunday, while Dr. Fuller was catching up on charting, she got a text that Dr. Pullman needed to speak to her immediately. Ten minutes later he was in her office, disheveled and hoarse.

“I’m going to need to cancel my patients tomorrow, and I’m not sure about the rest of the week,” began Dr. Pullman. His eyes were red and puffy.

“Is everything okay?” Dr. Fuller asked sympathetically.

“Ginny and I are splitting up,” he blurted.

Dr. Fuller fell back in her chair, shocked, then leaned over her desk to give her coworker a big hug. “I’m so sorry Doug,” she finally said. “I had no idea anything was wrong.”

Dr. Pullman was quiet, then replied, “To be totally honest with you, I was unfaithful. She’s just found out.”

Dr. Fuller sat back down and put a hand to her mouth. “Oh.” Just then her computer dinged with an incoming email. In an attempt to break the awkward silence she quickly looked at her screen—it was an email from Ginny.

“Hang on a sec,” she said distractedly, scanning the message. “Oh. Oh. Ginny is discontinuing IT services, effective immediately.”

“I’m sorry,” Dr. Pullman replied. “What a mess.”

She continued reading. “That includes work on the HIPAA audit! Shit.”

Advertisement

“Isn’t the audit documentation due on Thursday?” he asked. “She can’t do that. We have a contract—remind her we can sue her company!”

Dr. Fuller shook her head. “Ginny’s work wasn’t factored in. The contract covers software and licensing fees and does require 30 days’ notice,” she said. “The bigger issue is she knows we didn’t have all the required security and safety protocols before the breach.”

“So?” asked Dr. Pullman.

“She’s now in a position to be a whistleblower, which means I don’t know how honest I should be with this audit!”

Christopher D.
Central Florida

I would advise the doctor to send an immediate email response that after a 24-hour cooling off, they need to speak. This should help to allow cooler heads to prevail. I would advise allowing Ginny to vent a small bit but keep the conversation about the contracts business between owner and IT contractor. Let feelings be put aside for professionalism. If Ginny cannot maintain a professional relationship and honor her contract, I would then advise going after her to get all documentation and whatever else she needs to get the audit done. You can worry about the lawsuit later. I would not submit any falsified information. None. Own your mistakes and get on top of it. And no more shortcuts.

William C.
Forsyth, GA

Dr. Fuller has all rights to demand that the contract that Ginny signed should be fulfilled despite the “personal” concerns. If Ginny does breach the contract then her company and herself should be held liable for losses and incomplete work. A suitable replacement would need to be found immediately and approved by the doctor and practice ownership. If in the role of Dr. Fuller, I would have to insist that Ginny and her company fulfill the duty of completing the audit prior to leaving, despite the personal issues.

Barbara M.
Venice, CA

Dr. Fuller should find a proper new IT firm and work out the problems legally and appropriately. Then she should call Ginny. Thirty days’ notice was the deal—quitting now is breaking her contract. It seems that Dr. Fuller was trying to do things on the cheap. That doesn’t work. Dr. Fuller should confront Ginny with this plan. Ginny will realize she is also liable for not reporting and correcting the problems she saw. Both Dr. Fuller and Ginny have a business/financial problem; Dr. Pullman has a personal problem.