Category: Health

Compliance with Health and Fitness State Laws: Background, Best Practices and Key Takeaways for Health and Fitness Club Owners

We have found that most business owners desire to run their club, studio or other fitness facility in compliance with all applicable laws.  However, the problem is the difficulty in obtaining complete and accurate information regarding which laws are applicable to their business.  Therefore, the purpose of this article to:

(i) Provide information as to where club, studio and other fitness facility owners can find the relevant state laws;

(ii) Provide a general overview concerning the various definitions of “health and fitness facility” and how that definition varies from state to state (examples from New York, Colorado, Texas, Florida and Illinois statutes);

(iii)Examine a few of the more common statutes and regulations that show up in most states; along with general comments and analysis regarding these state statutes; and

 (iv) Provide business owners with key takeaways and considerations when determining how to best comply with all applicable laws.

For purposes of this article, we focus solely on specific state laws that apply strictly to club, studio and fitness facilities.  For further clarity, this means any laws that are generally applicable to all business (wage/hour laws, general corporation/LLC laws, etc.) will not be covered by this article but are still important for business owners to be aware of and follow.

I.  Where Can Business Owners Find the Applicable State Laws?

Most of the 50 states have provided electronic access to their state laws.  Through a simple Google search, you should be able to find your state’s applicable laws online.  After locating the entire index of your state’s applicable laws, the difficult part is searching through potentially thousands of laws to determine which laws are applicable to your facility.

By way of example, after semi-extensive research, we located the applicable “health and fitness facility” state laws for New York, Colorado, Texas, Florida and Illinois.  Some of these “health and fitness facility” laws are set forth in the following links:

  1. New York: http://www.dos.ny.gov/licensing/lawbooks/HLTHCLUB.pdf

  2. Colorado: http://www.lexisnexis.com/hottopics/Colorado/

  3. Texas:  http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.702.htm

  4. Florida: http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599/0501/Sections/0501.017.html

  5. Illinois: http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2376

If you cannot locate the state laws that are applicable to your fitness facility, an attorney well-versed in the health and fitness industry should be able to assist you or provide you with the relevant “health and fitness facility” laws.

Health and Fitness State Laws

II.  How Do States Define “Health and Fitness Facility”?

There is a wide variety of definitions as to what constitutes a “health and fitness facility” depending on which state laws you are examining.  It is important that you find and analyze your state’s particular definition of a health and fitness facility to prevent future issues (and fines) from non-compliance.

New York uses the term “health club” and defines it as any “person, firm, corporation, partnership, unincorporated association, or other business enterprise offering instruction, training or assistance or the facilities for the preservation, maintenance, encouragement or development of physical fitness or well-being . . . such term shall include but not be limited to health spas, sports, tennis, racquetball, platform tennis and health clubs, figure salons, health studios, gymnasiums, weight control studios, martial arts and self-defense schools or any other similar course of physical training.”

Similarly yet distinctly, Colorado also uses the term “health club” but defines it as “an establishment which provides health club services or facilities which purport to improve or maintain the user’s physical condition or appearance through exercise . . . the term may include but is not limited to a spa, exercise club, exercise gym, health studio, or playing courts…the term shall not apply to the following: any establishment operated by a nonprofit, or public/private school/college, any establishment operated by government, any establishment which doesn’t provide the health club services or facilities as its primary purpose, and health care facilities licensed or certified by the department of public health and environment.”

While both New York and Colorado use “health club” as a catch-all for health and fitness facilities, New York delves more deeply into the specifics of exactly what types of activities fall under the definition of a health club, while Colorado speaks about the activities more broadly.  This distinction may lead to more fitness related facilities being subject to the health and fitness statutes in Colorado.

Texas uses the term “health spa” and defines it as “a business that offers for sale or sells members instruction in or the use of facilities for a physical exercise program . . . which doesn’t include: private club owned/operated by its members, aerobic/dance studios, physical rehabilitation facility, an activity conducted or sanctioned by a school and a hospital or clinic.” This broad definition differentiates itself from both New York and Colorado by listing what does not fall under the definition instead of what does fall under the definition.  It also allows for a greater variance in the types of facilities that could fall under the umbrella of a health spa.

Florida uses the term “health studio” which is “any person who is engaged in the sale of services for instruction, training, or assistance in a program of physical exercise or in the sale of services for the right or privilege to use equipment or facilities in furtherance of a program of physical exercise.” Florida’s definition, similarly to Texas’ definition, provides more emphasis on the sale of services than the physical establishment and allowed activities as provided in New York and Colorado’s definitions.

Finally, Illinois defines “physical fitness center” as “any person or business entity offering physical fitness services to the public . . . physical fitness services includes instruction, training or assistance in physical culture, bodybuilding, exercising, weight reducing, figure development, judo, karate, self-defense training, or any similar activity; use of the facilities of a physical fitness center for any of the above activities; or membership in any group formed by a physical fitness center for any of the above purposes.” Similarly to New York, Illinois is very specific as to the types of activities that constitute a physical fitness center.

Gym 2

The purpose in highlighting the differences in these state statutes is to demonstrate the importance in understanding the definitions of health and fitness clubs in each state, which allows you to determine if the laws are applicable to your business.  As mentioned above, the failure to understand which statutes apply to your business could result in fines and other penalties down the road.

III. What are Some of the More Common Health and Fitness Statutes?

In analyzing the different health and fitness clubs statutes, several common themes arise. Perhaps the most obvious theme is consumer protection from deceptive sales and trade practices.   New York’s legislature specifically outlines its purpose in creating its health club statute by declaring that the statutes was created to “safe-guard the public and the ethical health club industry against deception and financial hardship, and to foster and encourage competition, fair dealing, and prosperity in the field of health club services.”

Every state we examined included language in its statutes that provides the consumer with the right to:

(i) Rescind contracts within a certain time period after signing up;

(ii) Cancel his or her membership if their household moves between 5-25 miles from the location of the establishment where the consumer entered into the contract; and/or

(iii) Establish limits on membership fees and the length of the membership contract.

By way of example, in California every membership contract must include the following language in 10-point boldface type: “You, the buyer, may cancel this agreement at any time prior to midnight of the fifth business day of the health studio after the date of this agreement, excluding Sundays and holidays. To cancel this agreement, mail or deliver a signed and dated notice, or send a telegram which states that you, the buyer, are canceling this agreement, or words of similar effect. The notice shall be sent to: (name and address of facility operator).” Some of the applicable California statutes (but not necessarily all of the relevant statutes) can be viewed at these two links: http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&group=01001-02000&file=1812.80-1812.98 and/or http://www.dca.ca.gov/publications/legal_guides/w-10.shtml.

In addition to the three concepts listed above, most states require health and fitness facilities to maintain a pre-opening escrow account to protect customers in the event that the facility fails to open the facility within a defined period of time.  For example, in Texas, if a health club does not open before the 181st day after it sells its first membership, members will receive a full refund of their prepayment.

Other common statutory requirements include that the membership contract must be in writing and provide a description of the services, facilities and hours of access, the facility must have a certificate of registration with the state, and the customer must receive a copy of the written contract. Additionally, many state statutes include language that a membership contract is void if a member enters into the contract under false or misleading information provided by the owner. This broad catch all is often invoked by customers seeking to get out of their membership (whether rightfully or wrongfully).

Another area of variance among state statutes is membership contract cancellation policies. As stated above, almost all states require that the club or fitness facility allow a member to terminate the membership agreement if the member moves some specific distance from the gym location (the actual distance varies from state-to-state).  Also, most states have statutes that allow members to cancel their policies if the facility does not provide advertised services, fails to provide alternative facilities if the facility contracted for is forced to close or does not open on time, and if a member can no longer use the facility’s services due to a significant injury or disability in excess of six months.

As an example, Illinois’ statutes contain a simple cancellation policy where a customer may cancel his or her membership within three days of signing the contract for a physical fitness center that is open, or within 7 days of signing a contract for a club that has not yet opened. California, on the other hand, uses a sliding contract price scale to determine when a client has a right to cancel their membership: if the contract is $1,500-$2,000, the customer has a right to cancel within 20 days, $2,000-$2,500 and the customer has a right to cancel within 30 days, and if the contract is for more than $2,501 the customer has a right to cancel within 45 days of signing the contract. Finally, Texas requires that if a facility closes it must provide alternative facilities not more than 10 miles from the original location or it must pay a full refund to its customers of any pre-paid fees.

Gym 3

IV. Key Takeaways for Health and Fitness Clubs

 Health and fitness club owners need to be mindful that every state has its own unique statutes and regulations that are applicable to any health and fitness clubs located in that state.  These state statutes govern many aspects of their operations, including, but not limited to how they obtain customers and what needs to be included in their membership contracts.

At a minimum, club and fitness facility owners should review their existing form membership contract(s) to make sure they include the concepts discussed above; provided further, club owners need to specifically make sure that their form membership agreement(s) are compliant with all applicable laws, including sometime hard to find state statutes. 

Further, national club and fitness facilities need to adjust their form membership contract on a state-by-state basis to ensure proper compliance (i.e. have a specific membership contract for their New York facilities, a different membership contract for their Florida facilities, etc.).  Failure to do so can result in fines into the hundreds of thousands of dollars, as some states enforce their laws on a per occurrence (per membership) basis.

ARTICLE BY Aaron D. Werner of Horwood Marcus & Berk Chartered

Connor Valentyn contributed to this article.

© Horwood Marcus & Berk Chartered 2016. All Rights Reserved.

More Than Family Affair: Six-Figure HIPAA Penalty Upheld for Unrepentant Home Care Agency due to PHI Access by Spurned Spouse of Employee

HIPAAIntroduction

The Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 and the regulations promulgated thereunder (“HIPAA”) should be now well-known to health care providers and health plans.  Under HIPAA’s “Privacy Rule,” covered entities must take steps to “reasonably safeguard” protected health information (“PHI”) from any “intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements” of the Privacy Rule.  What is also becoming painfully clear is the growing financial and reputational risks to covered entities (and business associates) from a breach of HIPAA’s Privacy or Security Rules stemming from unauthorized access or disclosure of PHI.

A recent ruling by a U.S. Department of Health and Human Services Administrative Law Judge (“ALJ”) in the case of Director of the Office for Civil Rights v. Lincare, Inc., (Decision No. CR4505, Jan. 13, 2016), underscores the substantial penalties that a health care provider can face, even for relatively small-scale HIPAA violations, particularly if the provider determines to not settle with the Office of Civil Rights (“OCR”) and instead contests the claimed violations.  In Lincare, a home care agency was found to have violated the Privacy Rule when an unauthorized person (the husband of a home health employee) was able to access patient records after the employee had removed records from the agency and taken them into the field as part of her job.  Specifically, the ALJ upheld a civil monetary penalty (“CMP”) of $239,800 imposed by OCR – only the second time the OCR has sought CMPs for violations of HIPAA’s Privacy Rule.  In a unique twist, OCR was alerted to the improper disclosures when the “estranged husband” of an employee of the home care agency complained to OCR that his wife allowed him to access documents containing PHI when she moved out of the marital home and left patient records behind.

Background

Lincare Home Care Agency.  The respondent Lincare, Inc., d/b/a United Medical (“Lincare”) supplies respiratory care, infusion therapy, and medical equipment to patients in their homes.  Lincare operates more than 850 branch locations in 48 states.  As Lincare explained, because its employees provide services in the homes of patients, they often remove patient records containing PHI from its branch locations.  Additionally, according to Lincare, managers of the various Lincare branch offices are required to maintain in their vehicles copies of Lincare’s “Emergency Procedures Manual,” which contains PHI of Lincare patients, so that employees could access patient contact information if an office was destroyed or otherwise inaccessible.

PHI at Issue.  Faith Shaw was a Lincare branch manager in Wynne, Arkansas from October 2005 until July 2009 and maintained the “Emergency Procedures Manual,” with PHI of 270 Lincare patients, as well as patient-specific documents of eight Lincare patients.  The patient records and Manual were apparently hard copies, and not electronically secured through encryption or authentication.

Disclosure of the PHI.  Ms. Shaw kept the records containing PHI in her car and in her marital home, where her husband lived.  After a falling out with her husband Richard in August 2008, Ms. Shaw moved out of the marital home and left the documents containing the PHI behind in her home and car.  In November of 2008, Mr. Shaw, who was concededly not authorized to access the Lincare PHI, reported to Lincare and OCR that he had in his possession the Emergency Procedures Manual and the eight patient files left behind by his wife.

OCR’s Investigation and Action.  Following its investigation, OCR determined that Ms. Shaw:  (a) kept the PHI either in her vehicle or home, to which Mr. Shaw had access; (b) maintained the PHI without proper safeguards, (c) knew or reasonably should have known that the manner in which she kept the PHI did not reasonably safeguard such PHI, and (d) knew or reasonably should have known that Mr. Shaw had ready access to the PHI.  While acknowledging that the provision of home care services may require providers to remove PHI from their offices, OCR found that Lincare’s policies and procedures did not adequately instruct its employees how to maintain PHI taken off the premises in a safe and secure manner and that Lincare did not properly record or track removed PHI.  Unlike the majority of HIPAA violations cited by OCR against providers, Lincare did not settle with OCR and instead determined to contest OCR’s charges.

In the absence of a settlement, OCR cited the following “aggravating” factors for imposing a substantial CMP against Lincare:

  • The length of time Lincare allowed employees to transport PHI away from the office without appropriate and reasonable safeguards; and

  • Lincare’s failure to promptly review and enhance its HIPAA policies for safeguarding PHI taken off premises even after it was notified of the improper disclosure.

Accordingly, OCR sought to impose a CMP totaling 239,800 for Lincare’s alleged violations of HIPAA’s Privacy Rule, broken down as follows:

  • Impermissibly disclosing PHI:  OCR determined that Lincare had improperly disclosed PHI of 278 patients in November of 2008, which then carried a penalty of $100 per patient.  OCR imposed a penalty of $25,000 – the maximum penalty that could be applied in the 2008 calendar year.

  • Failure to safeguard PHI:  OCR determined that the failure to safeguard the PHI lasted from February 1, 2008 through November 17, 2008, which carried a penalty of $100 per day.  OCR imposed an additional penalty of $25,000 – the maximum penalty that could be applied in the 2008 calendar year.

  • Failure to implement policies and procedures to ensure compliance with the Privacy Rule:  OCR determined that Lincare’s failure continued from (a) February 1, 2008 through December 31, 2008, at a penalty of $100 per day, with a maximum of $25,000 per calendar year, (b) January 1, 2009 through February 17, 2009, at a penalty of $100 per day, which totaled $4,800, and (c) from February 18, 2009 through July 28, 2009, during which time, penalty amounts were increased pursuant to the adoption of the HITECH Act, and which OCR determined to be $1,000 per day, totaling $160,000.

Significantly, in effectively stacking CMPs for separate HIPAA violations, one on top of another—although arising from the same breach or continued breach—OCR was able to multiply the aggregate size of penalties to $239,800.  At the same time, OCR determined that there was no basis to waive the imposition of the CMP because there was no evidence that the payment of a CMP would be excessive relative to the violations that it found.

Lincare appealed OCR’s determination before an ALJ.  OCR moved for summary judgment, arguing that there was no genuine issue of material fact concerning the HIPAA violations and that it was entitled to impose the aggregate CMP as a matter of law.

The ALJ’s Analysis

The ALJ granted OCR’s motion for summary judgment, finding that the evidence established that Lincare had violated HIPAA, and upheld the CMP of $239,800.

Theft is No Defense to Improper Disclosures:  In its defense, Lincare claimed that it was not responsible for the improper disclosure because it was the victim of a theft.  Specifically, Lincare claimed that Mr. Shaw “stole” the PHI from his wife and “attempted to use it as leverage to induce his estranged wife to return to him.”  The ALJ rejected this argument, concluding that Lincare was obligated to take “reasonable steps to protect its PHI from theft.”  The ALJ explained that Lincare violated this obligation when Ms. Shaw took documents out of the office and left them in in her car or home, allowing her husband to access them; and then completely abandoned them.

Lincare’s Policies Did Not Properly Address the Removal of PHI:  The ALJ also found that Lincare’s privacy policy failed to properly address the security of records removed from the office for use in the field, and monitor removed records to ensure their return.  When asked about specific guidelines for safeguarding PHI taken out of its offices, Lincare’s Corporate Compliance Officer replied that Lincare personnel “considered putting a policy together that said thou shalt not let anybody steal your protected health information.”  The ALJ did not “consider this a serious response.”

Key Takeaways

Consider Settling with OCR to Avoid a CMP:  The OCR’s imposition of a CMP, and the ALJ’s decision to affirm this penalty, represents only the second time a CMP has been imposed for a violation of the HIPAA Privacy Rule, and the first one in which an ALJ ruled on the merits.  Typically, OCR attempts to resolve HIPAA violations informally, but could not reach such a resolution with Lincare in this case.  Had a resolution been reached, the OCR would likely not have sought and secured such a substantial CMP based on “aggravating factors,” with the resultant fine likely to have been significantly lower.

Consider Encryption or other Means for Accessing PHI Remotely:  Employees of home care agencies often need to access PHI in the field when providing services.  However, the provider should consider restricting access only through electronic devices, with appropriate encryption and user authentication, to prevent unauthorized users from accessing these records.

Update Policies and Procedures:  Policies and procedures should detail for employees when patient records can be removed from the office and taken into the field, and under what circumstances; and identify how such records containing PHI should be safeguarded from disclosure.

Implement a System to Track Removed PHI:  Similarly, a system should be implemented to record and track the removal of records containing PHI so as to allow the health care provider to account for and maintain oversight over removed documents.

Regularly Train Employees:  Having detailed policies and procedures is not enough; all employees should be regularly trained on the HIPAA Privacy and Security Rules, and the agency’s corresponding HIPAA policies and practices.  To reinforce training, to the extent any PHI is removed from the premises, employees should be continually reminded not to allow unauthorized persons—including a spouse or other family or friends—to access the records.

Article By Jared Facher & Brian T. McGovern of Cadwalader, Wickersham & Taft LLP
© Copyright 2016 Cadwalader, Wickersham & Taft LLP

Tips and Considerations (#1 – 5) Before Opening a Fitness Studio or Facility

I have worked with a number of clients over the past few years in opening up their own fitness studio (franchisee or otherwise) or CrossFit affiliated gym.  This article is the first in a three part series (15 tips and considerations total) aimed at helping people that are considering taking their passion for fitness from a hobby and turning it into a career.  The items discussed below are some of the best practices that I have observed in clients that were successful in their first fitness venture.

1. Write a serious business plan.  Creating a thorough business plan is one of the best ways to really force yourself to look at the financial prospects of owning a business, and is a great way to identify weaknesses prior to committing endless time, energy and money into a venture that may not be as viable as it seemed when discussing with your friends or significant other.  In my experience, my most successful clients from day 1 of opening are those that had the most well thought out business plan because they have better identified weakness prior to opening and made the proper adjustments accordingly.  As part of any business plan, you should include a line by line budget for Years 1 through 5 of the business, including granular detail on expenses associated with operating the business.

2. Understand that everything costs more than you think.  The business plan will help you understand the initial costs (equipment, build out, etc.) and ongoing costs (payroll, rent, software, etc.) of opening and running a fitness facility.  It will also force you to think about insurance, legal, employment taxes and other costs that tend to get overlooked by business owners just starting out.  My rule of thumb is to come up with a conservative budget for Years 1 and 2 of the business, and then add 20% to the final expenses line item.  The expenses, at first, will always be higher than you expect.

3. Identify and retain your “go-to” employees/managers.  Hillary Clinton once said, “it takes a village. . . ” – surely she was not referring to owning and operating a gym, but she might as well have been.  If you are the only person that everyone looks to when things go wrong, you will quickly burn out and the studio will likely fail.  The employees need an inspirational leader, and you will most definitely lose much of your inspiration after working 70+ hour weeks for what may amount to minimum wage (at best) over the first several months of operations.  It is important that you retain at least 1 or 2 key employees that you can count on to be there from the beginning.  You must take initiative to train these key employees in every facet of the business.  While generally I do not recommend just handing out equity in the business to key employees from day 1, you may consider a Phantom Equity or Bonus Plan to incentivize your key employees to work to make the business profitable.  Many of the successful gym clients I work with have Bonus Plans in place for their key executives based on the overall profitability of the gym.

4. Find the right partners, and document your business deal.  Let me first say, if you can afford to go it alone and not have business partners, I encourage you to do so.  In my experience, gym partnerships end badly 75%+ of the time.  Inevitably, one partner thinks they are doing more than the other, and they start unilaterally taking actions that damage the relationship.  Often times, friendships spanning many years are destroyed.  Before going into business with someone, spend time discussing much more than the money each person brings to the table; spend time discussing the vision of the business, decision making, how profits will be distributed, who makes hiring decisions, who makes equipment purchasing decisions, can an owner sell his ownership in the business to another person, etc.  I find the most successful business partnership are those between owners that have complementary skill and talents, and understand where each of the partners adds the most value to the business.  There is a laundry list of issues that should be discussed and agreed up before partners go into business together.

5. Find the right lawyer – someone who is familiar with issues faced by studio and gym owners.  This tip is even more important if you have partners.  Once you decide on the business deal with your partners, each of you will need independent, legal representation to properly document your business agreement in an Operating Agreement (for LLCs) or a Shareholder Agreement (for corporations).  One of the attorneys will also need to form the LLC or the corporation which will actually operate the business.  The attorney for the business will also need to review and negotiate your lease (be careful about sound/noise provisions!), possibly review your financing arrangement, and review and negotiate your Franchise Agreement (if you are going to be a fitness franchise owner).  Ask the attorney what other studios and club facilities he or she has worked with, and consider asking for a few references before commencing work with that attorney.

ARTICLE BY Aaron D. Werner of Horwood Marcus & Berk Chartered

© Horwood Marcus & Berk Chartered 2015. All Rights Reserved.