HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Federal Prosecutors Take Action for Criminal HIPAA Violation

Healthcare organizations face heavy fines for violations of HIPAA regulations, failures to ensure compliance and for accidentally causing the privacy of patients to be compromised. Criminal charges may also be filed if it can be established and proven that data was viewed or copied for personal gain, as is the case with a former hospital employee from East Texas.

The Office of the Inspector General of the U.S. Department of Health and Human Services conducted an investigation on a former employee of an East Texas hospital in conjunction with the U.S. Postal Inspection Services and discovered evidence of criminal activity.

The hospital employee is alleged to have obtained Protected Health Information (PHI) while employed at the hospital between December 1, 2012 and January 14, 2013. The employee has now been indicted for criminal violation of the Health Insurance Portability and Accountability Act and faces a charge of Wrongful Disclosure of Individually Identifiable Health Information.

The theft or use of PHI for personal gain or to cause malicious harm is relatively rare, although there have been some notable cases over the past decade. The penalties are stiff for the offender and if found guilty sentences of up to 10 years in jail can be ordered in addition to financial penalties.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The incident serves as a reminder to healthcare organizations to be aware of internal threats to data security in addition to implementing strategies to protect data against unlawful access by external third parties.

Internal data breaches are also HIPAA violations and the organization responsible for the employee can also be held accountable for any data breach or theft. As part of HIPAA compliance testing access rights of staff to databases containing PHI must be assessed and access restricted. A record of staff training on HIPAA compliance must also be maintained and the obligations under HIPAA should be effectively communicated to all staff.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.