HIPAA Prosecution: Former UPMC Employee Indicted

The United States Attorney's Office Western District of Pennsylvania issued a press release providing details of their first HIPAA privacy prosecution. The federal grand jury in Pittsburgh issued a 14 count indicted naming Paul C. Pepala.

The press release provides the following details:

According to the indictment, in February 2008, Pepala, then employed at UPMC Shadyside Hospital, disclosed to others names, birth dates and Social Security numbers of patients for personal gain, in violation of federal HIPAA laws, and disclosed Social Security numbers to other persons without their authorization. This information was used to file false tax returns in 2008. Pepala was also charged with violating the Social Security Act by disclosing Social Security numbers in violation of federal law.

The law provides for a maximum total sentence of 80 years in prison, a fine of $4,730,000, or both. Under the Federal Sentencing Guidelines, the actual sentence imposed would be based upon the seriousness of the offenses and the prior criminal history, if any, of the defendant.

Agents of the United States Postal Inspection Service, Internal Revenue Service and United States Secret Service conducted the investigation leading to the indictment in this case.

Recent HIPAA Enforcement Stats

for the latest on HIPAA enforcement statistics by OCR click over to Mike Cassidy's post at the Med Law Blog: HIPAA Criminal Verdict and Enforcement Statistics. The post also contains some stats on the number of matters reported to the DOJ for investigation.

The post includes a summary of United States v. Ferrer, S.D. Fla., No. 06-CR-60261-CR-Cohn, the first criminal HIPAA verdict entered in January 2007. The case involved the wrongful disclosure of individually identifiable health information and identity theft of 1,100 patients from the Cleveland Clinic which were used to fraudulently bill Medicare claims to the tune of $7M.