We
have often said that if authorities initiated more high-profile legal actions
against alleged HIPAA violators, it would go a long way toward boosting
compliance. So, we are glad to see that federal prosecutors in Virginia have
announced an indictment in a case that alleges a particularly heinous HIPAA
Privacy Rule violation.
The U.S. Attorney's Office for the Eastern District of Virginia
says a federal grand jury has indicted a physician who is alleged to have
provided health information about a patient he treated for mental illness to an
agent of the patient's employer, without obtaining the patient's authorization;
and that is a serious allegation, to be sure.
The prosecutors say the physician "made the unauthorized
disclosure under the false pretenses that the patient was a serious and
imminent threat to the safety of the public, when, in fact, he knew that the
patient was not such a threat."
If convicted, the physician could face a maximum penalty of five
years in prison. His attorney told a local news website that the doctor plans
to plead not guilty in the HIPAA case. If the physician is convicted, a stiff
prison sentence would send a strong signal about the importance of abiding by
HIPAA.
In the meantime, when is the last time your practice
trained clinicians about the HIPAA privacy requirements? You might want to
double-check.