Doctor Gets Jail Time for HIPAA Violation

Criminal penalties for HIPAA violations are rare, but not unheard of
Criminal penalties for HIPAA violations are rare, but not unheard of

This month we look at a case involving a HIPAA privacy violation. This case is particularly important (and unusual) because it illustrates two points: 1) a person can get jail time for a HIPAA violation (even a misdemeanor violation), and 2) ignorance of the law does not protect you.

Dr. H was in his mid-40's when he took a research position with a large, well-known health system in a major city. The research position was not what Dr. H wanted, but he had a family to support, and had to take whatever employment he could. In his native country of China, Dr. H had been a cardiothoracic surgeon, but since immigrating to the United States a few years ago, his job options had been limited. Although he felt that the research position was beneath him, he also felt he had no choice, at least until his English became more fluent and he obtained the requisite licensing to perform surgery again. His wife also worked, but they had three small children to support, and they were living in an expensive part of the country.

Dr. H's frustration with the position was apparent to many of his colleagues, and his discomfort with speaking English meant that he tended to be a loner. His performance reviews were poor, and in less than a year he was given notice that he was going to be terminated from the job. His employer had an appeal process, and a grievance hearing regarding his termination was set. In the meantime, Dr. H began idling away his remaining days at the health system by looking at patient records for entertainment. The day he was notified of his termination, he accessed the first one – his immediate supervisor. Over the next few weeks, Dr. H browsed the medical records of many of his colleagues. He also viewed the records of the health-system's many high-profile patients, including well-known movie stars, television personalities, and people in public office.

Dr. H never shared the information he saw in the records. He didn't talk about it with his wife, or try to sell the information about the celebrity patients to the tabloids. He knew he shouldn't be looking at records of patients who were not his, but believed that as long as he didn't share the information he gained, it wasn't a problem. Thus, he didn't believe that he had committed a federal offense.