As a health care provider in the United States, you are subject to an inordinate volume of laws and regulations. From who you serve to how you bill and from how you keep records to how you structure relationships with suppliers and other providers, just about every aspect of your practice is restricted or overseen by the federal government.
While some of the laws that govern health care practice in America are well known, others are far less ubiquitous. As a health care provider, you may be well versed in the prohibitions of the False Claims Act and the Anti-Kickback Statute. But, you could be forgiven if you have never heard of 42 U.S.C. 1320d-6.
Criminal Culpability for Improper Use of Health Information Under 42 U.S.C. 1320d-6
Or, should we say, you should be forgiven. While 42 U.S.C. 1320d-6 serves a legitimate purpose in seeking to protect patients’ confidential health information, in doing so, it creates substantial risk for health care providers. 42 U.S.C. 1320d-6 is a criminal statute that establishes misdemeanor and felony offenses with potential penalties reaching 10 years of federal imprisonment and $250,000 in fines:
“A person who knowingly and in violation of this part (1) uses or causes to be used a unique health identifier; (2) obtains individually identifiable health information relating to an individual; or (3) discloses individually identifiable health information to another person, shall . . .
“(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;
“(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
“(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.”
What does it mean to use, obtain, or disclose identifying information “in violation of this part”? The statute provides:
“[A] person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d-9 (b)(3) of this title) and the individual obtained or disclosed such information without authorization.”
In short, knowingly using, obtaining, or disclosing patient information protected by HIPPA without authorization is a criminal offense under 42 U.S.C. 1320d-6.
Scope of Criminal Enforcement under 42 U.S.C. 1320d-6
In an attempt to clarify who could be charged under the law and provide clarification on the types of conduct that give rise to criminal culpability, the General Counsel for the U.S. Department of Health and Human Services and the Senior Counsel to the Deputy Attorney General jointly published a memorandum opinion entitled Scope of Criminal Enforcement Under 42 U.S.C. 1320d-6.
While the memorandum opinion is densely packed with legalese, reading it does shed some light on what health care providers and their personnel need to know in order to avoid prosecution under 42 U.S.C. 1320d-6. However, with statements such as this final conclusion, it is best for anyone facing an investigation under the statute to seek advice from an experienced federal health care fraud defense attorney:
“[W]e conclude that covered entities and those persons rendered accountable by general principles of corporate criminal liability may be prosecuted directly under 42 U.S.C.§ 1320d-6 and . . . the ‘knowingly’ element of the offense set forth in that provision requires only proof of knowledge of the facts that constitute the offense.”
Conspiracy to Unlawfully Use Health Information
Despite the language of 42 U.S.C. 1320d-6, actually using, obtaining, or disclosing individually identifiable health information is not necessary to be guilty of a federal crime. This is a product of the federal conspiracy statute, 18 U.S.C. 371. Unfortunately, establishing a conspiracy is not nearly as involved as forming the type of criminal enterprise you see in movies or on television.
In order to prove a conspiracy to unlawfully use health information, all federal prosecutors need to show is that:
- Two or more “co-conspirators” entered into an agreement (either explicitly or implicitly);
- Each co-conspirator charged intended to violate 42 U.S.C. 1320d-6; and
- One co-conspirator undertook an “overt act” in furtherance of the intended violation of 42 U.S.C. 1320d-6.
Conspiracy vs. Attempt
Critically, the “overt act” necessary to establish culpability for a conspiracy is not subject to the same standard as the act required to commit an attempt. An attempt involves engaging in activity with the intent to successfully commit the underlying offense (in this case, unlawful use of individually identifiable health information). In order to pursue charges for a conspiracy, all that is necessary is to show that one co-conspirator engaged in an act that was in furtherance of the eventual and potential commission of the underlying crime. As a result, the prosecution’s burden in a conspiracy case is much lower. And for this reason (among others), the U.S. Department of Justice routinely pursues conspiracy charges in health care fraud investigations.
Under 18 U.S.C. 371, the penalties for conspiracy to unlawfully use health information can include $250,000 in fines and up to five years of federal imprisonment. However, if the underlying unlawful use would qualify as a misdemeanor under 42 U.S.C. 1320d-6, then the penalties would be limited to a $50,000 fine and no more than one year of incarceration.
Contact Experienced Health Care Fraud Defense Lawyer
What do you need to do if you are under investigation for conspiracy to unlawfully use health information? Right now, the single most important thing you can do is discuss your case with an experienced federal health care fraud defense lawyer. You want to resolve your investigation without being formally charged if at all possible, and this requires prompt intervention by a skilled and knowledgeable federal law defense attorney.
To speak with an attorney from The Criminal Defense Firm about your federal investigation in confidence, call (888) 452-2503 or request a free case assessment online now.
Brian Kuester offers his extensive experience to counsel companies and individuals under civil or criminal government investigation. When resolution requires litigation, clients choose Mr. Kuester’s proven court and litigation experience.