Patricia M. Wagner, Chief Privacy Officer and Member of the Firm in the Health Care & Life Sciences and Litigation practices, in the firm’s Washington, DC, office, was quoted in Healthcare Risk Management, in “Educate Staff on Criminal Prosecution Risk.”
Following is an excerpt:
Criminal prosecutions for HIPAA violations appear to be increasing, putting both individuals and healthcare organizations at risk for more than just monetary penalties and regulatory burdens.
The criminal penalties for HIPAA violations can be severe: a fine of up to $50,000, imprisonment for up to a year, or both. Additionally, if the offense is committed under false pretenses, there can be a fine of up to $100,000, imprisonment for up to five years, or both.
If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, the offender can be fined up to $250,000 and imprisoned for up to 10 years, or both. …
It is important to remember that criminal prosecution may not start with a standard OCR investigation, says Patricia Wagner, JD, an attorney with Epstein Becker Green. In addition to the OCR referral process, it is possible that a HIPAA violation will come to light when the DOJ is investigating or prosecuting another crime and decide to include the HIPAA prosecution as part of the other matter.
When educating employees on the risk of criminal prosecution, Wagner says leaders can describe real incidents in which people have gone to prison for their actions. This makes the risk more than theoretical, she says.
“Often, it is useful to include examples of when penalties have been applied so that employees have a better understanding of the risk,” she says. “Of course, it is more important to train employees on and to have a culture of compliance for HIPAA and other laws so that the focus of the organization and employees is on performing tasks in an appropriate manner.”
People
General Counsel / Chief Privacy Officer
