Department of Justice Opinion Limits Prosecution of HIPAA Medical Privacy Rule Criminal Violations

Penalties for criminal violations of the Health Information Portability and Accountability Act medical privacy rule apply to providers and health insurers but might not apply to their employees or others, according to a June 1 Department of Justice opinion that "sharply limits the government's ability to prosecute people for criminal violations" of the regulation, the New York Times reports.

The office of legal counsel at DOJ prepared the opinion over the last 16 months in response to questions from the criminal division of the department and HHS. The opinion is binding on the executive branch of the federal government but not on judges.

According to the opinion, the rule applies to "covered entities" -- such as providers and health insurers -- and, as a result, only those entities can face prosecution for criminal violations of the regulation. Penalties for criminal violations of the rule include as much as $250,000 in fines and as many as 10 years in prison.

The opinion said that individuals who violate the rule could face penalties under state laws or other federal laws, such as those that address identity theft and the fraudulent use of computers, and civil lawsuits filed by patients.

According to the Times, the "ruling was a surprise to many lawyers."

Robert Gellman, an expert on privacy and information policy, said, "Under this decision, a tremendous amount of conduct that is clearly wrong will fall outside the criminal penalties of the statute." The opinion "makes it more difficult for the government to protect patients against misuse of their records," he added.

Peter Swire, a law professor at Ohio State University who served as chief counselor for privacy under former President Bill Clinton, said, "The Justice Department's interpretation is different from what lawyers have been telling their clients and different from what the government itself said in the first criminal prosecution last year."

DOJ spokesperson Eric Holland declined to comment on the opinion, and Richard Campanelli, director of the civil rights office at HHS, also declined to comment (Pear, New York Times, 6/7).