RICHMOND — Del. Dawn Adams, D-Richmond, shared private patient health information with a former legislative aide as part of work the aide performed for Adams’ health care consulting firm, according to emails obtained by the Richmond Times-Dispatch.
Adams’ former aide, Maureen Hains, said in an interview she was never asked to sign a confidentiality agreement required by federal law of health care workers who are asked to handle private health records.
Emails between Adams and Hains, which the Times-Dispatch obtained from the state under the Freedom of Information Act, show the information was shared via Gmail accounts, at least twice without any encryption or other protection, a potential violation of federal laws aimed at protecting patient privacy. The records included names, birth dates, medical diagnoses and hospice statuses.
Adams’ private work for Richmond-area health care facilities began while she was still employed by a state health agency in a high-ranking role — an arrangement her attorneys say was sanctioned by the agency, but which an attorney familiar with Virginia’s ethics laws says creates the appearance of a conflict of interest.
In response to an Aug. 21 request from the Times-Dispatch, a spokeswoman for the Department of Behavioral Health and Developmental Services, Maria Reppas, said the department was not in possession of a conflict of interest agreement related to Adams’ work for Integrated Health Consulting. Reppas said the department does have agreements related to other outside work by Adams, but said those are protected by a FOIA exemption.
The emails shed some light into a legal dispute between Adams and her former aide, who accused the lawmaker of hacking into her Gmail account and deleting files related to her work with Adams’ consulting firm. Hains is asking for $550,000 in damages.
Adams is seeking re-election in the 68th House District, which includes parts of the city of Richmond and Chesterfield and Henrico counties. She is facing a challenge from Republican Garrison Coward, a former aide to Rep. Rob Wittman, R-1st.
As Hains’ lawsuit, filed in U.S. District Court, winds through the legal process, the case is likely to continue beyond Election Day, Nov. 5. Absentee voting in Virginia began Sept. 20.
Adams has refused to address the details of the lawsuit, “in fairness to the legal process, including to all parties involved,” she said in a statement, in which she “strongly” denied “all claims.”
The delegate’s attorney, Cullen Seltzer, said it’s “not secret that [Hains] provided some limited assistance to Delegate Adams’ private business,” though Adams had not acknowledged that fact in legal filings. The extent of Hains’ work for Adams is among the issues in dispute.
Seltzer added that he is “not aware of any conflict of interest on [Adams’] part, and that the claims contained in the lawsuit will be addressed as the case moves forward.
“While contesting this matter, her attention and efforts are engaged in serving her constituents and the commonwealth,” he said.
Asked whether Adams met federal requirements for the disclosure of patient information, Seltzer did not immediately respond. In an earlier email, he said, “Del. Adams is committed to the privacy of patients’ medical information and has not, and would not, consent to sharing protected health information in a public forum.”
Emails between Hains and Adams obtained by the Times-Dispatch show the two exchanged charts that included patient names, birth dates, medical diagnoses, hospice status and the locations where the patients were examined.
Hains said in an interview and in court filings that she helped Adams with this work by reviewing patient charts and translating diagnoses into codes used by health care professionals.
“I knew this was unusual, but initially, it was supposed to be a one-off kind of thing,” Hains said in a phone interview with the Times-Dispatch that also included her attorney in the case.
One email dated July 23, 2018 — sent from Hains’ campaign email account to a Gmail account belonging to Adams — reads:
“So I’m not sure I’m reading your handwriting correctly on all of this, especially on [a particular patient] — it looks like the first two codes are formatted differently, no letter in the front? Not sure. Let me know if you need something changed!”
The email includes Hains’ email signature and was sent in the early afternoon on a Monday.
Another email from Hains to Adams, dated Aug. 19, 2018 — sent on a Sunday evening — reads, “I sorted them alphabetically and by location.” The email included a chart listing patient information.
Reppas, the behavioral health department spokeswoman, said that the patient health information “and other business documents contained in these emails do not belong to [the agency].”
She added: “The reason these emails became part of our search results is because [Del.] Adams forwarded them from her personal Gmail account to her DBHDS account.”
Reppas confirmed that officials at the Department of Behavioral Health had to view the private patient health information to redact it before fulfilling the Freedom of Information Act request by the Times-Dispatch.
Michael Goodman, a health care lawyer based in Glen Allen who is not involved in the case, told the Times-Dispatch that Hains would have been legally authorized to view the information if she had been employed by Adams’ firm and signed a legally binding agreement designed to protect the information.
Goodman said that under the Health Insurance Portability and Accountability Act, or HIPAA, employers handling private health information are required to obtain signed “business associate agreements” to share protected information.
“If she was a legitimate employee, she would have to have some agreement in place,” Goodman said. “If I’m an authorized entity sharing private information, I want an assurance I won’t find it on the highway.”
Asked if she was ever presented with any paperwork or agreement that might fit this requirement, Hains said she was not.
“[Adams] never presented me with any paperwork and I never signed anything in that regard,” Hains said.
Goodman said that HIPAA also requires technological protections of patient data, which for many providers often means using encryption, and/or software that tracks who has viewed the information.
“If you wanted to protect the information, you wouldn’t have just attached it. Would it be unusual? No. Would it be a violation of the law? Yes,” Goodman said.
“If I send it to you on your Gmail account, how do I know you’re not sharing it with friends? Anybody you give your password to — your husband, your mother — they now have access. That’s where the security fear comes in.”
Goodman said HIPAA violations that are prosecuted often come with fines as high as $50,000 per incident, and usually some form of corrective action. The law also requires that health care providers notify their patients if their records were breached or even just vulnerable.
One of the firms Adams worked with, Laurel Health Care Co., a network of rehabilitation facilities with four locations in Virginia, confirmed Adams did work for some of its contracted physicians at The Laurels of Bon Air and The Laurels of Willow Creek in Chesterfield between July 2018 and January 2019.
Scott Williamson, regional director of operations for Laurel, said in a statement that the company did not contract with Adams directly, and did not believe that security issues related to Adams’ work included their patients.
“To the best of our knowledge, no private information of residents at our facilities was compromised,” Williamson said.
For a four-month period in 2018, Adams worked as a state agency official, a delegate in the General Assembly and the CEO of her consulting firm.
Republicans criticized Adams’ simultaneous work for the state and the General Assembly as “unethical double-dipping,” but despite initial questions about a state constitutional provision that apparently bars the practice, Adams said the Attorney General’s Office determined that “there’s precedent for a state employee being in the legislature.”
It’s unclear whether Adams’ work for the state behavioral health agency while working for her consulting firm meets similar state ethics standards.
Adams’ work through her private consulting firm, Integrated Health Consulting, began in July 2018 — months before her departure from the behavioral health agency. While working for the state, Adams served as the director of the Office of Integrated Health before her departure on Oct. 1, 2018. She received a salary of $117,810 in 2017 and supervised 12 employees.
Reppas, the spokeswoman for the agency, confirmed Adams’ last day. Adams registered Integrated Health Consulting as a limited liability company June 4, 2018, according to the State Corporation Commission. Emails forwarded to Adams’ agency account show Adams interacting with health care facilities, and signing them “Integrated Health Consulting,” in July 2018.
Reppas said, “There are guidelines for state employees who do work outside of their state government jobs. Any special dispensation we possess for Delegate Adams is exempt under FOIA as this information is directly related to personnel.”
Eric Gregory, a local attorney who advises local and regional government agencies on compliance with state law, said the work presents the “appearance and potential for a conflict of interest.”
“It’s conceivable that if somebody had started a consulting agency that covered the same subject matter as their government work, they might create a conflict,” he said. “Certainly, it creates an appearance of impropriety. Does it create an actual conflict? Hard to say.”
Adams disclosed her status as CEO of Integrated Health Consulting with state ethics officials in January, in line with state ethics laws, which only require annual filings and don’t require updates throughout the year, according to Stewart Petoe, executive director of the Virginia Conflict of Interest and Ethics Advisory Council.
Still, the full picture of Adams’ consulting work and Hains’ role in it remains murky.
While Adams’ legal team widely denies Adams has any financial liability to Hains, they neither admit nor deny that Adams attempted to access or actually accessed Hains’ Facebook and Gmail accounts, or that she deleted information from Hains’ Gmail account.
“Those claims present issues that are not susceptible to resolution at this stage in the proceedings,” a court filing by Adams’ team reads.
No trial date has yet been set. The parties are awaiting a ruling by Judge M. Hannah Lauck on Adams’ motion to dismiss the suit.