Healthcare Quality CEO Misused Confidential RI Patient Data for Work at Brown, Says Lawsuit
GoLocalProv News Team
Healthcare Quality CEO Misused Confidential RI Patient Data for Work at Brown, Says Lawsuit
The Rhode Island Quality Institute (RIQI) is little known outside of the healthcare community. Founded in the early 2000 by now-U.S. Senator Sheldon Whitehouse, it plays a critical role and has access to the confidential information of hundreds of thousands of Rhode Islanders' healthcare records.
RIQI is the state’s Health Information Exchange (HIE), which is a voluntary exchange in which “confidential health care information of Rhode Island residents is maintained. The HIE maintains confidential health care information of approximately 550,000 Rhode Island residents or one-half of the population of Rhode Island.”
GET THE LATEST BREAKING NEWS HERE -- SIGN UP FOR GOLOCAL FREE DAILY EBLASTNow, a former top employee is alleging that when she raised questions about her boss Sarkar, who has dual roles in healthcare, he is both the president and CEO of RIQI and an associate professor of medical services at Brown, she was retaliated against for raising concerns about his "misuse" of confidential data.
Board Comprised of Top Healthcare Executives
The board of RIQI is a who’s who of healthcare executives, including Tim Archer, CEO of UnitedHealthcare Employer & Individual, New England; and Mukesh Jain, the Dean of Medicine & Biological Sciences at Brown University and other top executives.
The suit outlines how RIQI, which is paid upwards of $10 million in contract fees annually by the state of Rhode Island, allowed Sarkar to take highly confidential and restricted data and use it for his Brown University-driven research.
The lawsuit outlines that despite both federal and state mandates, the highly confidential information must be protected at the highest level and alleges Sarkar violated these restrictions.
The lawsuit was filed in federal court this week by longtime RIQI employee Darlene Morris. She worked at RIQI for 12-plus years.
Her suit claims the RIQI violated both state and federal Flase Claim statutes and violated whistleblower protections.
"Ms. Morris is an 'employee' as the term is defined by the False Claims Act. Ms. Morris engaged in protected conduct under the FCA by investigating and reporting matters that she reasonably believed could lead to a viable FCA action and by engaging in efforts to stop violations of the FCA. Defendant RIQI was on notice of Ms. Morris’ protected conduct. Because Ms. Morris engaged in protected conduct, Defendant RIQI retaliated against her leading up to and culminating in the abrupt termination of her employment, causing her to suffer damages," asserts Count 1 of the lawsuit.
Sarkar Accused of Misusing Confidential Data for His Own Work at Brown
According to the lawsuit, ”Rather than request the data from Ms. Morris as was established RIQI procedure, Dr. Sarkar circumvented Ms. Morris and requested the data directly from RIQI’s data department. In early 2023, Dr. Sarkar sought to obtain HIE data reflecting 2.1 million home addresses of Rhode Island patients for the purpose of an independent project supporting research conducted at Brown.”
Troubled by this, Morris reported the incident to RIQI’s counsel.
She then notified the state of Rhode Island.
According to the lawsuit, “On May 26, 2023, Morris met with Olivia King (“Ms. King”), State Health IT Coordinator, EOHHS, regarding Dr. Sarkar’s use of HIE data for research studies at Brown. Ms. King advised Ms. Morris that Dr. Sarkar’s conduct in using the State’s HIE data to perform research studies at Brown without obtaining the consent of the State to do so was a violation of state rules and regulations and a breach of the terms of the State Contract.”
“Thereafter, leading up to and culminating in the termination of her employment, Ms. Morris assisted the State; namely EOHHS and RIDOH in their ongoing inquiry and investigation of Dr. Sarkar’s misuse of HIE data. In September, 2023, Ms. Morris was tasked with reviewing Dr. Sarkar’s employment contract. In doing so, Ms. Morris advised RIQI’s counsel of her concern that Dr. Sarkar’s position at Brown conflicted with his position and role at RIQI insofar as using HIE data to advance research at Brown violated state law and the terms of the State Contract,” claims the lawsuit.
By letter dated October 12, 2023, Ms. King and RIDOH Deputy Director, Sandra Powell (“Ms. Powell”) advised RIQI that Dr. Sarkar’s use of HIE data for research purposes violates state law and is a breach of the terms of the State Contract. They further required that RIQI “Hire or assign 1.0 Full-Time Equivalent effort compliance officer."
Thereafter, in addition to her existing job duties as Senior Director, Programs and HIPAA Privacy Officer, Ms. Morris was now tasked with serving as RIQI Compliance Officer.
Morris says that despite the actions of the state and the warning, Sarkar continued to misuse RIQI data for his own work at Brown University.
According to the lawsuit, “Despite receiving pressure from Brown to approve the manuscript, Ms. Morris refused to do so. Ms. Morris knew that EOHHS would not approve of the purpose of the research as reflected in the revised manuscript.”
One of the board members overseeing RIQI is Brown Dean Mukesh Jain.
"On February 28, 2024, Dr. Sarkar called Ms. Morris and stated that 'the boys on the team' were 'feeling paranoid' about her meeting alone with the State. He further stated that by referencing 'the boys,' he was referring to Scott Young (“Mr. Young”), RIQI’s Senior Director of Strategy, and Charles Dansereau (“Mr. Dansereau”), Senior Director of IT. I In fact, Mr. Dansereau advised Ms. Morris that he had no such concern," claims the lawsuit.
GoLocal reached out to both Sarkar and Young, but neither responded.
"Shortly thereafter, on February 29, 2024, Dr. Sarkar questioned Ms. Morris about her communications with EOHHS and cautioned Ms. Morris not to engage in any further discussions with EOHHS regarding the use of HIE data," according to the lawsuit.
Sarkar then restricted Morris’ duties.
State Contract Was Up for Renewal
According to the lawsuit, "The existing State contract was set to expire at the end of June, 2024. Dr. Sarkar advised Ms. Morris that he did not want her to discuss specific terms of the State Contract with EOHSS for fear that in doing so, she might jeopardize RHIO’s ability to obtain a new State Contract. Dr. Sarkar further instructed Ms. Morris that she was not to inform EOHHS in advance of a meeting that Dr. Sarkar, Mr. Young and/or RIQI counsel planned to attend. On March 7, 2024, Ms. Morris reported Dr. Sarkar’s continuing misuse of HIE data to James Berson (“Mr. Berson”), RIQI’s Board member and the Chairman of the Operations Oversight and Audit and Compliance Committees. Ms. Morris described the risks associated with Dr. Sarkar’s unlawful use of HIE data. She also notified Mr. Berson of the ongoing retaliation she was enduring."
The alleged retaliation included limiting Morris from performing many of her duties.
“In fact, Brown advised RIQI that if RIQI did not approve Brown’s request to publish the revised manuscript within the next two weeks, the manuscript would be published regardless of RIQI’s approval,” according to the lawsuit.
"In a feigned attempt to distance himself from Brown’s decision to publish the manuscript regardless of RIQI’s approval, Dr. Sarkar instructed Ms. Morris to advise Ms. King at EOHHS of Brown’s decision. Dr. Sarkar instructed Ms. Morris to provide him and counsel with a draft of the email she planned to send to Ms. King. After doing so, Dr. Sarkar provided Ms. Morris was revisions to the email and instructed her to send the revised email to Ms. King," the suit alleges.
The retaliation by Sarkar elevated, and she was banned from communicating with critical state players.
“On May 15, 2024, Ms. Morris again met with Mr. Berson regarding Dr. Sarkar’s continuing misuse of HIE data. She advised Mr. Berson of the escalating risk his misuse posed to RIQI; that the retaliatory restrictions placed on her were interfering with and obstructing her ability, as RIQI’s Compliance Officer, to properly perform her job; and she reported the ongoing retaliation she was continuing to endure," stated the lawsuit.
"The State’s May 23, 2024 letter further advised RIQI that “the continued unauthorized use of HIE data for research is a serious violation of the terms and conditions set forth by the State. RIQI’s actions demonstrate a blatant disregard for the State’s directives and the trust placed in your organization to handle confidential healthcare information responsibly”. The State’s May 23, 2024 letter instructed the RIQI to 'immediately cease and desist from any further use of HIE data for research purposes” and that RIQI’s “failure to comply with this demand will result in legal action to protect the State’s interests and the privacy rights of its citizens.' Moreover, the letter 'require[d] that Ms. Morris resume compliance meetings and activities with the State,'" said the lawsuit.
In July, Sarkar terminated Morris.