When HIPAA Violations Become Criminal Charges
Healthcare professionals and employees routinely handle sensitive patient information as part of their work. Federal criminal exposure may arise when investigators believe a person knowingly accessed medical records without authorization, disclosed patient information to an unauthorized recipient, or used that information for personal or financial gain.
A HIPAA investigation can begin with a single disputed chart access or expand into allegations involving repeated disclosures or the sale of patient information. The nature of the alleged conduct shapes the evidence federal investigators are likely to examine. Early review by a knowledgeable Miami HIPAA violations defense lawyer can identify what conduct is under scrutiny and how the surrounding records fit the government’s theory.
Not Every HIPAA Violation Leads to Criminal Prosecution
Most HIPAA problems do not begin as federal criminal cases. The Office for Civil Rights within the U.S. Department of Health and Human Services handles civil enforcement of the HIPAA Privacy and Security Rules, including complaints, compliance reviews, corrective action, and civil penalties. Conduct that appears to implicate HIPAA’s criminal provision may instead be referred to the Department of Justice for investigation.
Federal criminal exposure involves a narrower category of conduct. Under 42 U.S.C. § 1320d-6, prosecutors may pursue charges involving the knowing use of a unique health identifier, obtaining individually identifiable health information, or disclosing that information to another person in violation of HIPAA. The statute also addresses employees and other individuals who obtain or disclose information maintained by a covered entity without authorization.
The circumstances surrounding the alleged conduct may separate a compliance problem from a criminal investigation. A mistaken disclosure, an internal policy violation, and an intentional effort to obtain patient information for an unauthorized purpose present different factual questions. Federal investigators may examine the person’s authority, job responsibilities, reason for accessing the information, and what happened after the information was obtained.
Unauthorized Access Can Lead to Charges Without Any Disclosure
A criminal HIPAA case does not require proof that patient information was ultimately given to another person. The criminal provision separately reaches the unauthorized obtaining of individually identifiable health information. A healthcare employee who enters a medical record without a legitimate work-related reason may face federal scrutiny even when investigators do not allege that the information left the healthcare system.
Electronic health record platforms frequently record the account used to open a chart, when the access occurred, the workstation or device involved, and other activity associated with the record. Investigators may compare those logs with patient assignments, work schedules, job responsibilities, credential histories, and internal access policies. A disputed access may look very different once the person’s actual duties, workflow, or involvement with the patient are placed alongside the electronic record.
United States v. Huping Zhou, 678 F.3d 1110 (9th Cir. 2012), involved a former UCLA Health System research assistant who accessed patient records without authorization after his employment had ended. Zhou argued that the criminal charge was deficient because it did not allege that he knew HIPAA prohibited his conduct. The Ninth Circuit rejected that interpretation, holding that the misdemeanor provision required knowing acquisition of individually identifiable health information in violation of HIPAA, rather than proof that the defendant also knew the conduct itself was illegal.
Unauthorized Disclosure Creates a Different Criminal Theory
Disclosure cases focus on whether medical information was provided to another person without authority to do so. HIPAA permits protected health information to be shared for treatment, payment, healthcare operations, valid patient authorizations, and other recognized purposes, while 45 C.F.R. § 164.502 establishes the broader limits governing those uses and disclosures.
Federal scrutiny may arise when investigators believe patient information was instead sent to a friend, business associate, marketer, fraud participant, or another unauthorized recipient. The information does not have to consist of an entire medical chart. A screenshot, patient list, demographic information tied to healthcare data, or selected information taken from a record may become part of the alleged disclosure.
The evidence in a disclosure case often follows the path the information allegedly took. Emails, text messages, messaging applications, printed records, photographs of screens, cloud-storage activity, file transfers, and testimony from the recipient may show how information moved from one person to another. Communications surrounding the transfer may also reveal who requested the information, what was requested, whether the exchange happened repeatedly, and how the parties described the purpose of the disclosure.
Selling Patient Information Can Bring Much More Serious Penalties
The purpose behind an alleged HIPAA offense can substantially increase the potential penalties. A basic violation carries up to one year in prison and a fine of up to $50,000, while conduct committed under false pretenses carries up to five years and a fine of up to $100,000. When prosecutors allege that individually identifiable health information was obtained, disclosed, or used with intent to sell, transfer, or use it for commercial advantage, personal gain, or malicious harm, the maximum increases to ten years in prison and a fine of up to $250,000.
Payment records and communications often take on greater importance when the government alleges personal gain. Investigators may examine bank transfers, payment applications, cash transactions, messages discussing compensation, repeated access to patient records, and communications identifying particular patients. Prosecutors may use those records to connect a payment or benefit to a specific disclosure and support an allegation that the transfer was deliberate.
In United States v. Corbett, 921 F.3d 1032 (11th Cir. 2019), the Eleventh Circuit described a Florida Hospital scheme in which patient “face sheets” were obtained without authorization and transferred for payment. Tanganica Corbett received approximately $150 to $200 for obtaining patient information at another person’s request. She and a co-defendant pleaded guilty to federal charges arising from the scheme.
Federal Scrutiny Can Begin Before Criminal Charges Are Filed
An internal compliance inquiry, privacy complaint, or employer audit may create a substantial record before federal agents ever contact the person whose conduct is being examined. Interview notes, written explanations, access reports, emails, disciplinary records, and other internal materials may later become part of a federal investigation if the matter is referred for possible criminal prosecution.
Federal scrutiny may also become apparent through an interview request, subpoena, demand for records, or contact from investigators. By that point, prosecutors may already have access to materials gathered during an internal investigation and may be comparing those records with electronic activity, communications, or information obtained from other witnesses.
The early investigative record may affect how the alleged conduct is characterized before any charging decision is made. Guidance from an experienced Miami HIPAA violations defense lawyer can focus on the statements already made, the records investigators possess, and the scope of any further request or interview as the federal investigation develops.
Contact The Baez Law Firm
If you are being questioned about patient records, an unauthorized disclosure, or the alleged sale or transfer of protected health information, what you do during the early stages of the investigation may affect the evidence prosecutors ultimately rely upon. Your access authority, job responsibilities, communications, and the circumstances surrounding the information should be examined in the context in which the events actually occurred.
The Baez Law Firm represents clients facing serious federal criminal investigations in Miami, throughout Florida, and across the country. Our experienced team of Miami HIPAA violations defense lawyers brings extensive federal defense and healthcare-related litigation experience to allegations involving sensitive medical information and complex digital evidence. Contact The Baez Law Firm to learn how we can protect your rights throughout a federal HIPAA investigation or prosecution.
Sources:
- 42 U.S.C. § 1320d-6, Wrongful Disclosure of Individually Identifiable Health Information
uscode.house.gov/view.xhtml?req=%28title%3A42+section%3A1320d-6+edition%3Aprelim%29 - 45 C.F.R. § 164.502, Uses and Disclosures of Protected Health Information: General Rules
ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502 - United States v. Huping Zhou, 678 F.3d 1110 (9th Cir. 2012)
law.justia.com/cases/federal/appellate-courts/ca9/10-50231/10-50231-2012-05-10.html - United States v. Corbett, 921 F.3d 1032 (11th Cir. 2019)
media.ca11.uscourts.gov/opinions/pub/files/201813203.pdf - S. Department of Health and Human Services, How OCR Enforces the HIPAA Privacy & Security Rules
hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaa-privacy-and-security-rules/index.html
