HIPAA memo could affect doctors' criminal liability

Privacy experts say a new Justice Dept. opinion indicates that criminal prosecutions of HIPAA violations will target covered entities but not others.

By Amy Snow Landa, amednews correspondent. July 18, 2005.

A memo the Justice Dept. recently issued could make some physicians more susceptible to criminal prosecution under the federal medical privacy law and others less so, health lawyers and privacy experts say.

Released publicly on June 9, the memo is the first Justice Dept. statement to address criminal enforcement of patient privacy protections under the Health Insurance Portability and Accountability Act of 1996.

According to the opinion, HIPAA's criminal enforcement provision applies directly to "covered entities," which include physicians and other health professionals specified in the statute, health plans, health care clearinghouses and Medicare prescription drug card sponsors.

"In addition," the memo states, "depending on the facts of a given case, certain directors, officers, and employees of these entities may be directly liable." But the memo adds, "Other persons may not be directly liable under this provision."

That wording could offer physicians an important avenue for avoiding criminal liability under HIPAA, said Sarah Coyne, a partner at the law firm Quarles & Brady LLP in Madison, Wis., and a member of its health law group.

Whether an individual physician is a covered entity "wasn't all that important before," said Coyne, who represents doctors on regulatory compliance issues. "But it is now, in light of this opinion."

In many cases, there is no question as to whether a particular physician is a covered entity or not, Coyne said. For example, a physician with his or her own practice who submits electronic transactions is clearly a covered entity, whereas a physician who works only on paper clearly is not.

[...]

Full text of American Medical News content is available to AMA members and paid subscribers.

Access details

Join the AMA