Clinical Worker Receives Five-Year Prison Sentence for Stealing PHI
A clinic employee has failed to get his 5-year jail term reduced. The man stole the protected health information of a number of mentally ill patients and sold the data to identity thieves .
Jean Baptiste Alvarez, aged 43, of Aldan, PA, obtained daily census sheets from the Kirkbride Center, a 267-bed behavioral health care center based in Philadelphia. The census sheets listed all the information required to steal the identities of patients and file fraudulent tax returns in their names – Names, Social Security detailss, dates of birth and other personally identifiable information.
Alvarez had the chance to steal the data without being noticed, as the floor where the sheets were kept did not have security cameras operating.
Alvarez was given $1,000 per census sheet by his to-co-conspirators, who used the data to register 164 fraudulent tax returns in the names of the patients, leading to a loss of $232,612 in tax revenue for the IRS.
At the start of 2016, Alvarez was found guilty of conspiracy to defraud, misuse of Social Security details, and aggravated identity theft. The latter charge carried a minimum sentence of 2 years. The maximum sentence for all counts was a total of 24 years in jail, a maximum of three years of supervised release, and possibly a fine.
Judge Michael M. Baylson used the vulnerable victim enhancement, and Alvarez was given 5 years in jail for his crimes, 3 years of supervised release, was told to pay $266,985 in restitution, and a $500 special assessment penalty.
Alvarez appealed the sentence stating it was excessively harsh as his victims were not “vulnerable.” He also claimed that he did not target the patients because of their mentally illness and their drug addiction issues. He only took the information because he was able to access to it.
However, the U.S. Court of Appeals for the Third Circuit threw out his appeal to have the sentence lessened, ruling that Alvarez’s argument did not have merit. The victims had mental health and addition issues and were vulnerable. Judge D. Michael Fisher also remarked that since the patients were not employed, the IRS was unlikely to notice the fraud as there would not be any duplicate claim. The patients would also be unlikely to find they had been defrauded due to their mental health complications. The five-year jail term imposed stands.
The case will be a stark reminder for healthcare workers that the theft of patients’ personal data can lead to lengthy jail sentences. The Department of Justice is aggressively chasing cases of PHI theft, identity theft, tax fraud and is punishing criminals with the full force by legislation.