HIPAA is becoming an increased basis for criminal prosecutions of licensed health care professionals and health care workers. In Arkansas, there was one of the first federal criminal prosecutions for accessing patient records out of curiosity -- where there was no identity theft or related criminal conduct.
On July 20, 2009, a physician and two former employees of St. Vincent Infirmary Medical Center (SVIMC) in Little Rock, Arkansas, pleaded guilty to misdemeanor violations of the health information privacy provisions of the Health Insurance Portability and Accountability Act.
Each admitted he or she had accessed patient records out of curiosity. All three acknowledged they had participated in HIPAA training provided by SVIMC, and understood the prohibition on accessing records without a legitimate reason for doing so.
The records accessed related to the treatment of Anne Pressly, a local television personality who was brutally beaten by a home intruder on October 20, 2008. Ms. Pressly died at SVIMC on October 25.
Dr. Jay Holland, medical director for Select Specialty Hospital located on one floor within SVIMC, admitted that he logged into the medical center's electronic medical record system from home seeking to determine the accuracy of a television news report concerning Ms. Pressly. The medical center suspended Dr. Holland for two weeks and ordered him to complete additional HIPAA training. Sarah Elizabeth Miller, an account representative for SVIMC, admitted viewing Ms. Pressley's medical records twelve times, and Candida Griffin, an emergency room unit coordinator, accessed the file on three occasions. SVIMC terminated Miller's and Griffin's employment.
Each of the individuals faces up to a year in jail and a $ 50,000 fine for the violation they admitted. Sentencing should take place within the next two months. In determining the actual sentence, the federal judge will consult the advisory U.S. Sentencing Guidelines, which provide appropriate sentencing ranges that take into account the severity and characteristics of the offense, the defendant's criminal history, if any, and other factors. The judge, however, is not bound by those guidelines in determining a sentence. A probation sentence given these individual's lack of prior criminal history seems likely here.
Attorney Commentary: The misdemeanor conviction will be just the beginning of the individuals' legal issues. There are employment issues, the misdemeanor conviction will need to be reported to the licensing boards, potential national reporting, and other collateral consequences.
To understand how a HIPAA violation is reported, you can review the US Department of Health and Human Services Office for Civil Rights website: www.hhs.gov/ocr/privacyhowtofile.htm
As part of compliance plans and a professional's pattern and practice, HIPAA will become more important. This particular case probably obtained the government's attention due to the fact that the patient was a local news celebrity. As records become increasingly electronic and accessible, there are greater risks of unauthorized access.
Any questions or comments should be directed to: tgreen@greenassoc.com or 213-233-2260.
Tracy Green is a principal at Green and Associates in Los Angeles, California. They focus their practice on the representation of licensed professionals, individuals and businesses in civil, business, administrative and criminal proceedings. They have a specialty in representing licensed health care providers. Their website is: http://www.greenassoc.com/
