HIPAA Violations, Criminal Penalties, and Patient Privacy

Introduction: The HIPAA Disclosure Question

The central question in this analysis is whether Dr. Williams violated the Health Insurance Portability and Accountability Act (HIPAA) by showing Joan's medical records to a friend for advice. According to the facts presented, Dr. Williams's friend advised him to contact his medical malpractice insurance carrier. There are no directly applicable court rulings to resolve the question, so the analysis must proceed from the statutory text and regulatory guidance.

The critical threshold issue is whether the friend qualifies as a person exempted under the Act for the purpose of disclosure. This is not entirely clear from the facts. For the purpose of this analysis, it is assumed that the friend is also a medical practitioner or similarly qualified professional. If so, Dr. Williams may argue that no violation occurred, provided the information was shared solely for consultation purposes. This position finds support in 45 CFR 160.103, which defines a business associate to include those providing "legal, actuarial, accounting, consulting," and related services to a covered entity (U.S. Department of Health & Human Services, 2003a).

Permissible Disclosures and Business Associate Exceptions

The scope of permissible disclosures under HIPAA extends to laboratory technicians, lawyers, and insurers, among others. Liability arises only when information is disclosed to a third party who has no association with the covered entity — in this case, the clinic — and who is not otherwise permitted to access that information. Where a physician discloses information to another person who is entitled to view it, culpability does not attach.

The HIPAA Privacy Rule imposes conditions on the disclosure of medical information, but it does not restrict the use of information for treatment, payment, or public health purposes (Chaikind, 2004). Accordingly, if the information was shared with the friend on a consultation basis — and the friend is a competent medical professional, the clinic's lawyer, or an insurance officer — Dr. Williams commits no offense. As the regulations clarify, a primary care provider may send a copy of an individual's medical record to a specialist who needs the information to treat the individual, and providers may similarly disclose health information to another covered entity or health care provider for consultation purposes (Krause, 2012).

Any disclosures beyond these permitted categories require the individual's written authorization under 45 CFR 164.508(a)(2). If the friend is a complete stranger to the health care system and the disclosure serves no covered purpose, then Dr. Williams would have committed a violation. The rule's overarching purpose is to protect patient privacy to the greatest extent operationally feasible, while allowing reasonable exceptions for legitimate health care operations.

Criminal Prosecution and Penalties Under HIPAA

In 2010, the Supreme Court's decision in Skilling v. United States held that mail and wire fraud cases premised on violations of the "intangible right to honest services" have the potential to alter the future of health care fraud litigation (Krause, 2012). The unauthorized disclosure of patient information can cause serious harm, including stigma — particularly for patients with AIDS or mental health conditions — and it can facilitate kickbacks involving insurance companies, pharmacies, and other entities that may exploit the information for fraud or manipulation.

It has been argued that the jurisprudence in this area mirrors that of the Medicare & Medicaid Anti-Kickback Statute. In practice, the Act carries the most force in cases where the information is used to commit a crime. The first notable HIPAA criminal prosecution arose in Seattle, Washington, involving a phlebotomist named Richard Gibson from the Seattle Cancer Care Alliance. Gibson used patient names and identifying numbers to obtain credit cards in patients' names, which he then used to purchase video games, home improvement supplies, and other goods totaling $9,139.42. Cases of this nature — involving clear criminal intent and personal gain — result in conviction and sentencing (McQuarrie, 2007).

Criminal penalties for violations of the HIPAA Privacy Rule can include a fine of up to $50,000 and up to one year of imprisonment. Civil penalties may reach $100 per violation, with a calendar-year cap of $25,000. Penalties may be waived if it can be demonstrated that the violation was not the result of willful neglect and was corrected within 30 days after the entity knew or should have known that a failure to comply had occurred (U.S. Department of Health & Human Services, 2003b).

Conclusion

Whether Dr. Williams violated HIPAA depends entirely on the identity and professional status of the friend to whom he disclosed Joan's medical records. If the friend qualifies as a business associate, a consulting professional, or another covered entity, no violation occurred. If the friend was unaffiliated with the health care system and the disclosure served no permitted purpose, a civil penalty of up to $100 per violation could apply. Criminal prosecution, however, remains unlikely because the disclosure lacked the criminal intent and personal gain that have characterized the small number of HIPAA prosecutions brought to date. The maximum penalty realistically facing the clinic would be the $100-per-violation civil fine. For authoritative guidance on HIPAA privacy compliance, the U.S. Department of Health & Human Services remains the primary regulatory resource.

References

Chaikind, Hinda R. (2004). The Health Insurance Portability and Accountability Act (HIPAA): Overview and analyses. Nova Publishers.

Krause, Joan H. (2012). Kickbacks, honest services, and health care fraud after Skilling. Annals of Health Law, 21(1), 41–43.

McQuarrie, Doreen Z. (2007). HIPAA criminal prosecutions: Few and far between. Retrieved November 22, 2012, from http://www.law.uh.edu/healthlaw/perspectives/2007/(DM)HIPAACrimCharges.pdf

U.S. Department of Health & Human Services. (2003a). Business associates — Health information policy. Retrieved November 22, 2012, from http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/businessassociates.html

U.S. Department of Health & Human Services. (2003b). Summary of the HIPAA Privacy Rule. Retrieved November 22, 2012, from http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

U.S. Department of Health & Human Services. (2003c). Uses and disclosures for treatment, payment, and health care operations. Retrieved November 22, 2012, from http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/usesanddisclosuresortpo.html