Jury convicts physician of HIPAA violations

Among the many impermissible uses and disclosures of protected health information (PHI) is the sale and use by third parties. Specifically, 45 CFR § 164.502(5)(ii)(A) states, “[e]xcept pursuant to an in compliance with § 164.508(a)(4), a covered entity or business associated may not sell protected health information.”

The exceptions are very narrow and require the express consent of the patient, as well as other required items.

After a five-day trial, a federal jury in Springfield, Mass., convicted a physician of the following: disclosing patients’ PHI to a sales representative at pharma company Warner Chilcott without the knowledge or consent of the patient in violation of HIPAA; accepting remuneration in violation of the anti-kickback statute, which Warner Chilcott admitted to in 2015; and lying to federal agents during the investigation.

The jurors found OBGYN Rita Luthra, MD, guilty of violating HIPAA by disclosing information, which enabled Warner Chilcott’s subsidiary company, Allergan, to target customers for its expensive osteoporosis products, Actonel and Atelvia. Warner Chilcott actually paid the government $125 million in penalties for providing physician “speakers’ fees” in return for access to the medical records and prescribing the products. Luthra was found to have obstructed justice during the course of the criminal healthcare investigation.

According to Law360, “[s]pecial agents from the U.S. Department of Health and Human Services’ Office of the Inspector General showed up at Luthra’s office in 2014 to ask about her relationship with the salesman. According to the superseding indictment, Luthra told the investigators that the salesman had helped her prepare prior authorizations but did not have access to confidential patient information and that Warner Chilcott paid her to comment on clinical research. The jury decided those were lies and convicted her of tampering with the investigation in that interview.”

For physicians, this case should underscore several important factors:

1. HIPAA violations can result in criminal prosecution.

2. Relationships with pharmaceutical and medical device companies need to be disclosed to patients and certain requirements need to be met.

3. Fraudulent payments by companies to physicians are never acceptable.

Failing to address these items in policies and procedures could have significant adverse consequences. The small amount of cash that looks good in the short run can have very adverse financial, legal, reputational, and professional consequences in the long run.