It's not just hypothetical.
This article first appeared February 03, 2018 on Medpage Today.
By David J. Goldberg, MD, JD
"Dr. Child" finished both a dermatology residency and a pediatric dermatology fellowship at a prestigious training program. Upon completion of his fellowship he was unable to get any of the jobs he wanted and eventually settled on a job at a large, highly prestigious children's hospital doing solely night shifts. He became disgruntled, however, and in time neither he nor his supervising pediatricians and dermatologists liked working with each other. He was disciplined multiple times and thought about quitting.
Before doing so, he was curious to know some of the children who had been admitted to the hospital over the years. He found a veritable treasure trove of information about kids from both entertainment and political families. He had no intention of making any of this information public and assumed his actions were harmless.
Eventually, hospital officials became aware of his actions, terminated his employment, and reported his actions to the authorities. He was found guilty of a Health Insurance Portability and Accountability Act of 1996 (HIPAA) violation and given jail time. He is totally demoralized. Both he and his attorney are shocked. They assumed that, at most, a HIPAA violation is a misdemeanor associated with a fine. But jail time. How can that be?
It might come a as a surprise to many, but there is already legal precedent for such a case.
Precedent
Dr. H was in his mid-40s when he took a research position with a large, well-known health system in a major city. The position was not what he wanted, but he had a family to support. His frustration with the position was apparent to many of his colleagues. His performance reviews were poor, and in less than a year he was given notice that he would be terminated from the job.
In the meantime, Dr. H began idling away his remaining days at the health system by looking at patient records for entertainment. He viewed the records of the health system's many high-profile patients, including well-known movie stars, television personalities, and people in public office.
Dr. H never shared the information he saw in the records. He never tried to sell the information about the celebrity patients to the tabloids.
After losing his job, he was hit with another shock -- he was charged by the government with violating HIPAA.
Dr. H immediately hired a defense attorney, who told him that although there was information that Dr. H had illegally accessed patient records over 300 times, the government was only charging him with four counts.
"But I didn't do anything wrong," Dr. H said. "I never sold the information or told anyone about it."
"They aren't charging you with selling the information," the attorney replied. "If they were, you would be facing a felony and a lot of jail time. They are charging you with simply accessing identifiable health information without a valid reason for doing so. You were not treating any of those patients. And in the last several instances, you weren't even working for the health system anymore."
"But I didn't know that was a crime," Dr. H said.
The attorney made a motion to dismiss the case, seeking to have the charges against Dr. H dropped.
The court denied the motion. Then the defense attorney sought to have the court issue instructions telling the jury that elements of the case required that the defendant knew that obtaining the personal medical information was a violation of criminal laws.
The court refused. Faced with what appeared to be a losing proposition, Dr. H entered a conditional plea of guilty, reserving his right to appeal his original motion to dismiss the case. He was sentenced to 4 months in prison, followed by a year of supervised release, and a $2,000 fine.
The court held that the plain text of the statute does not limit its application to people who knew their actions were illegal. Rather, the court stated, "the misdemeanor applies to defendants who knowingly obtained individually identifiable health information relating to an individual, and obtained that information in violation of HIPAA."
The key language, according to the court, was "knowingly and in violation of this part." Dr. H wanted it to be interpreted as "knowingly, in violation of this part" -- therefore presuming that knowledge was a violation necessary for conviction. The court disagreed, saying that if the statute did not contain the word "and," Dr. H's argument might be more persuasive.
"However, we cannot ignore 'and,' because its presence often dramatically alters the meaning of a phrase," wrote the court in its decision.
Therefore, Dr. Child may well end up with jail time.