Alaska Woman Sentenced to Prison in HIPAA Criminal Case

While HIPAA criminal cases are rare, KTVA in Alaska recently reported that an Anchorage woman was sentenced to two concurrent 24 month prison terms.  The case is being reported as the first prosecuted HIPAA criminal case in the state.

Stacy Laulu illegally accessed medical records of two patients at the hospital where she worked.  The patients were victims of assault and Ms. Laulu obtained information for the perpetrator to determine what the victims had told police and hospital staff about their injuries and how badly they were injured.  Ms. Laulu texted the information to the perpetrator.

The HIPAA Statute provides that persons who knowingly use, obtain or disclose protected health information will be subject to fines and imprisonment of up to one year.  Where the offense is committed under false pretenses, persons may be imprisoned up to five year.  The highest penalties are for situations where the offense is committed with the intent to sell, transfer or use PHI for commercial advantage, personal gain, or malicious harm in which case prison sentences of up to 10 years can be imposed.

For covered entities conducting HIPAA training, it is often helpful to remind employees of their potential personal criminal liability if they knowingly misuse protected health information.

Speak Your Mind