Former Hospital Employee Is Convicted of HIPAA Violation, Shared Photo of Ex’s Wound

The criminal conviction of a former Iowa hospital employee for wrongfully accessing her ex-boyfriend’s protected health information (PHI) and sending a picture of his wounds to a mutual friend is a powerful example of the potential consequences for employees who violate HIPAA and may be an unusually persuasive teachable moment for privacy training. The unauthorized access stemmed partly from anxiety about child custody, according to court papers.

Jennifer Lynne Bacor, who at the time was a patient care technician in the pulmonary medicine center at a Cedar Rapids hospital, pleaded guilty to wrongfully obtaining individually identifiable health information under false pretenses and was sentenced to five years of probation and fined $1,000, the U.S. Attorney’s Office for the Northern District of Iowa said June 21.[1] The hospital was not identified.

The hospital had repeatedly trained Bacor on HIPAA and terminated her after her actions came to light. “What really stood out is this was not a penalty against the hospital,” said Richelle Marting, an attorney in Olathe, Kansas. Marting said Bacor’s plea agreement and sentence are an opportunity to vividly show employees the perils of snooping in medical records, because many of them think the worst thing that can happen is losing their job. “When I am doing HIPAA training for workforce members, this type of scenario is exhibit A of what I talk about,” she said. “The fact this crossed the line to a criminal penalty against an individual suggests an interest in more stringent, potentially criminal penalties against individuals.”

Bacor’s attorney, Michael Lahammer, called this “a ridiculous case for the federal government to pursue.” He noted no restitution was required.

According to court papers, Bacor, as a hospital employee from Feb. 9, 2016, to Oct. 10, 2017, was authorized to access only the individually identifiable health information of her patients as necessary to provide services consistent with the hospital’s privacy policies. Bacor’s ex-boyfriend J.B., who is the father of her two children, was treated at the hospital’s wound clinic repeatedly in 2017 for injuries he suffered on his job at the post office. J.B. also had complications because of underlying health conditions, including a leg wound that wouldn’t heal.

This document is only available to subscribers. Please log in or purchase access.
 


Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field