The US Department of Justice announced some former hospital employees have been charged with HIPAA violations. Five former Methodist Hospital employees have been indicted for colluding with a conspirator to unlawfully disclose patient information.
Background
An individual paid the employees for over three years to provide information. Specifically, he wished to have the names and phone numbers of patients who had been involved in motor vehicle accidents. Once the information was received, he then sold the information on to people such as personal injury attorneys and chiropractors. The case was investigated by the Federal Bureau of Investigation and also the Tennessee Bureau of Investigation. A federal grand jury has now indicted the five former hospital employees.
Potential Penalties
The individual who paid the hospital employees has been charged with seven counts of obtaining patient information with intent to sell it for financial gain. Each of those charges carries a maximum penalty of:
- 10 years imprisonment
- A fine of $250,000
- 3 years of supervised release
The five former hospital employees face a conspiracy charge and were each charged with separate HIPAA violations. The conspiracy charge carries a maximum penalty of:
- 5 years imprisonment
- A fine of $250,000
- 3 years of supervised release
The HIPAA violation of disclosing information to the conspirator carries a maximum penalty of:
- 1 year imprisonment
- $50,000 fine
- 1 year of supervised release
