Federal Prosecutors Take Action for Criminal HIPAA Violation
Healthcare organizations face heavy fines for violations of HIPAA regulations, failures to ensure compliance and for accidentally causing the privacy of patients to be compromised. Criminal charges may also be filed if it can be established and proven that data was viewed or copied for personal gain, as is the case with a former hospital employee from East Texas.
The Office of the Inspector General of the U.S. Department of Health and Human Services conducted an investigation on a former employee of an East Texas hospital in conjunction with the U.S. Postal Inspection Services and discovered evidence of criminal activity.
The hospital employee is alleged to have obtained Protected Health Information (PHI) while employed at the hospital between December 1, 2012 and January 14, 2013. The employee has now been indicted for criminal violation of the Health Insurance Portability and Accountability Act and faces a charge of Wrongful Disclosure of Individually Identifiable Health Information.
The theft or use of PHI for personal gain or to cause malicious harm is relatively rare, although there have been some notable cases over the past decade. The penalties are stiff for the offender and if found guilty sentences of up to 10 years in jail can be ordered in addition to financial penalties.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident serves as a reminder to healthcare organizations to be aware of internal threats to data security in addition to implementing strategies to protect data against unlawful access by external third parties.
Internal data breaches are also HIPAA violations and the organization responsible for the employee can also be held accountable for any data breach or theft. As part of HIPAA compliance testing access rights of staff to databases containing PHI must be assessed and access restricted. A record of staff training on HIPAA compliance must also be maintained and the obligations under HIPAA should be effectively communicated to all staff.
