Criminal prosecutions under the HIPAA statute now tend to focus on unauthorized uses or disclosure of protected health information (PHI) in cases that often involve kickback and health fraud charges, as prosecutors stray from identity theft allegations, which had dominated past prosecutions, an expert says.

Recent cases show that “the HIPAA criminal offense is often a means to an end, the end being some kind of fraud and abuse scheme,” said attorney Gayland Hethcoat, with ArentFox Schiff in Los Angeles, at the 40th annual HIPAA Summit March 7.^[1] “And so we commonly see kickback and health fraud charges go hand in hand with HIPAA criminal charges.”

Under 42 U.S.C. § 1320d-6, HIPAA makes it a crime for a person to knowingly use or cause to be used a unique health identifier or to obtain individually identifiable health information (IIHI) or to disclose to another person that IIHI that’s maintained by a covered entity without authorization.

As of Dec. 31, 2022, the HHS Office for Civil Rights (OCR) has referred to the Department of Justice (DOJ) 1,640 cases involving the knowing disclosure or obtaining of health information in violation of HIPAA, said Christina Hud, an assistant U.S. attorney in the U.S. Attorney’s Office for the District of New Jersey.

“We have three elements here that the government would need to prove in order to find a violation of the criminal HIPAA statute,” Hud said. “The first element is that the defendant knowingly disclosed individually identifiable health information to another person or that the defendant obtained that information relating to an individual.”