By now, everyone has seen the promises of artificial intelligence (AI) in healthcare. A program that rapidly interprets all of a patient’s medical records, images, scans, and tests, and then drives the right inquiry into that patient’s medical problems. That seems like a superpower to bestow upon physicians.
However, for AI to meet its full potential in healthcare, it needs access to the full panoply of protected health information (PHI). That prospect likely sends shivers down the spines of every covered entity (CE) in the United States. How can AI do its job while still securing PHI and ensuring responsible use of PHI? That is a broader topic than what this author is prepared for.
Instead, this article sets the outer limits of PHI misuse: criminal prosecutions for HIPAA violations. Recognizing the facts that gave rise to criminal convictions for abusing patient privacy is useful in that it gives a name to the things to be avoided at all costs in implementing AI and other useful technologies promising to revolutionize healthcare in America. In addition, we will examine the basics of criminal HIPAA violations and some of the rare previous cases against individuals accused of violating HIPAA in a criminal fashion.
42 U.S.C. § 1320d–6, in a nutshell
The criminal arm of HIPAA is found in 42 U.S.C. § 1320d–6. In essence, the law prohibits CEs from knowingly violating HIPAA by obtaining or disclosing individually identifiable health information without authorization. The term “individually identifiable health information” is broad, applying to anything created or received by a CE that both relates to some aspect of a patient’s healthcare and identifies a particular patient (or can be reasonably used to do so).[1] Thus, virtually every patient-related record in a CE’s practice could give rise to HIPAA violations under the definition.
The consequences of violating 42 U.S.C. § 1320d–6 depend on the violator’s motive. Those who violate the statute with the intent to “sell, transfer, or use” PHI for “commercial advantage, personal gain, or malicious harm” are subjected to the most serious consequence under the statute: imprisonment for up to 10 years.[2] The absence of commercial advantage still results in a serious consequence, so long as the violation is committed under false pretenses, with that violation resulting in imprisonment for up to five years.[3] But if a CE violates HIPAA in a way that results in no commercial advantage, personal gain, or malicious harm, and is not committed under false pretenses, then that CE is subjected to a misdemeanor: imprisonment for not more than one year.[4]
