Readers Ask:  Just How Bad Is It To Sell Patient Privacy?

 

---

Dear Editor,

 

I understand that the Health Insurance Portability and Accountability Act (HIPAA) can impose criminal penalties if we violate a patient’s privacy.  Is this true and how likely is it that this will happen?

 

Worried Health Care Provider

---

 

Dear Worried Health Care Provider,

 

I would not be too worried about this.  Yes, HIPAA’s Privacy Rule does provide for criminal penalties for egregious breaches of a patient’s privacy with respect to his/her protected health information (PHI).  However, the breach really would need to be egregious.

 

There are three levels of criminal provisions in the privacy regulations.  The first level involves misdemeanor violations.  These breaches of privacy are unlikely to result in criminal prosecutions.  These breaches involve the disclosure of PHI without malicious intent.  The next level adds the element of committing the breach of privacy under false pretenses.  This is a felony.  Whoever commits this crime is liable for up to a $100,000 fine as well as five years in prison.  The third level includes breaching a patient’s privacy by selling the PHI for commercial gain.  A guilty verdict for this third level carries the maximum penalty available:  a $250,000 fine and ten years in prison.

 

An example of the third level of criminal prosecution is an employee in a long-term care skilled nursing facility who “sells” information about an HIV infected patient to the tabloids.  So far there haven’t been any such prosecutions.

 

What are more likely to be prosecuted in months to come will be health care providers who ignore the HIPAA Privacy Rule and patient after patient complains with no change in the providers’ behavior.

 

Editor

---

Note:  We are happy to answer any questions you have regarding health care legal issues.  Of course all requests for information shall remain anonymous.  All letters are published for educational purposes only.  Legal advice and opinion can only be provided for upon individual consultation.