Criminal enforcement of HIPAA still a new concept (UALR Public Radio) - The recent criminal prosecution of three healthcare workers who inappropriately accessed the medical records of deceased KATV news anchor Anne Pressly shows that violating a patient's privacy can have significant consequences.

FM 89's Karen Tricot-Steward reports that this case is one of two criminal cases pursued under HIPAA here in Arkansas and that the Arkansas cases are part of only a handful that have been pursued nationwide.

------------------------------------------------------------------------

Last year, Andrea Smith, a nurse from Truman, pleaded guilty to violating HIPAA privacy provisions. She was 25 at the time and admitted that she'd given the private medical information of a patient to her husband, who intended to use that information against the patient in an upcoming legal proceeding.

"Andrea Smith was sentenced to two years probation and including in her term of probation was 100 hours of community service."

That's Jane Duke, the U.S. Attorney for the Eastern District of Arkansas. Her office prosecuted both the Andrea Smith case and the case involving the records of Anne Pressly. Duke says criminal enforcement of HIPAA is still a fairly new concept and only a small number of cases have been pursued around the country.

"Since April of 2003, HHS has received over 46,000 HIPAA privacy complaints. With the violations that we've seen nationwide, I think we've had about 16 individuals prosecuted."

In the majority of cases, healthcare workers were using private medical information to commit other crimes, like identity theft, and had malicious intent. But more recent cases, like the one involving the records of Anne Pressly, show that U.S. Attorneys like Duke are equally willing to pursue prosecution of HIPAA violations in the absence of other crimes.

"In the Anne Pressly case, we did not have any of that underlying malicious motivation."

Because of this, the defendants were all charged with a misdemeanor rather than a felony, like in the Andrea Smith case. But Duke explains that motive isn't the only thing that matters when prosecutors examine violations. The way in which an individual gains access to the medical information can also lead to a more severe charge.

"For example, if one employee of a hospital has stolen the password for another employee and logged on to access the information by using the stolen password, that could also be a felony violation."

Robert Steinbuch, an associate professor at UALR's Bowen School of Law, has been following the Arkansas cases. He says these criminal prosecutions are making HIPAA meaningful.

"Any law that you have if it's not enforced is no law at all. If you prevent something but never punish anybody when they violate it, well then you'll get rampant violations."

Steinbuch and Duke both say that it's been violations of people of celebrity status, like Anne Pressly, that have brought the cases to the attention of law enforcement.

"For non-high profile cases, the biggest problem is not that the prosecutor may not bring the case. It's that the prosecutor may not ever know about the case."

Duke says her office strongly believes that healthcare information has to be vigorously protected, and it's an issue she'll continue to examine. She says it's about more than respecting a patient's privacy. It's also about a patient getting the best treatment possible.

"It is only through the candid ability to provide information that people can get adequately treated. The doctor-patient relationship simply has to have that kind of candor that can only be gained if you have 100% trust in the confidentiality of the information you provide."

For FM 89 News, I'm Karen Tricot-Steward.


© Copyright 2009, UALR Public Radio