Woman indicted for criminal HIPAA violations

Though HIPAA violations more often result in civil penalties, criminal indictments for HIPAA violations do still happen.

On June 28, a woman from Butler, Pennsylvania, was indicted by a federal grand jury, accused of wrongfully obtaining and disclosing protected health information (PHI) in violation of HIPAA, according to a press release from the U.S. Attorney’s Office in the Western District of Pennsylvania.

According to the indictment, Linda Sue Kalina, 61, gained unauthorized access to the PHI of 111 patients from March 30, 2016, to August 14, 2017, without authorization while working as a patient information coordinator for the University of Pittsburgh Medical Center as well as for the Allegheny Health Network. In addition, the indictment charges that on four occasions, Kalina disclosed the PHI of three patients with the intent to cause malicious harm.

If convicted, Kalina could face up to 11 years in prison, a fine of $350,000, or both, according to the press release.

Typically, HIPAA violation cases that result in prison time involve financial profit from the misused information or releasing patient information with other harmful intent.

For more information on understanding HIPAA and protection patient privacy, see The Contemporary Guide to Health Information Management.