It’s not very common for HIPAA violations to get criminal penalties, but there are cases when the Department of Justice pursues criminal charges especially when patient privacy is seriously violated. For example, there’s impermissible disclosure of protected health information for malicious purposes or financial profit.
One such case has led to 2 criminal convictions – a violation of the HIPAA and obstructing a criminal healthcare investigation. It is a healthcare fraudulence case involving the pharmaceutical company Warner Chilcott which the DOJ investigated. In 2015, Warner Chilcott confessed to paying doctors some money in exchange for prescribing its medications and for modifying prior authorizations to trigger medical insurance companies to purchase prescriptions. Waner Chilcott resolved the case with the DOJ by paying $125 million.
The other criminal case involved a Massachusetts gynecologist named Rita Luthra, M.D. She was convicted of HIPAA violation for giving a Warner Chilcott sales consultant access to patients’ protected health information for 10 months from January to November 2011.
The access to PHI allowed the firm to target patients with certain health conditions and helped with the receipt of previous authorizations for Warner Chilcott pharmaceutic products and services. When federal agents questioned Luthra regarding her relationship with Warner Chilcott, she did not give the right information thereby impeding the investigation.
Luthra was previously charged for accepting kickbacks from Warner Chilcott in the amount of about $23,500. The money were accounted as payment for speaker fees during trainings and educational events that didn’t actually happen.. The DOJ ditched the mentioned charges, even though the case against the doctor continued to be targeted, leading to the 2 convictions.
Luthra faces prison time and a big fine. The maximum fine for the HIPAA infringement is a custodial sentence of at most 1 year, one year of monitored release, and a maximum penalty of $50,000. The greatest fine for impeding a criminal health investigation is about 5 years in prison, 3 years of monitored release, and a penalty of up to $250,000.