Federal Bureau of Investigation Little Rock Field Division Press Release

NURSE PLEADS GUILTY TO HIPAA VIOLATION

Little Rock – Jane W. Duke, United States Attorney for the Eastern District of Arkansas, along with William C. Temple, Special Agent in Charge of the Little Rock Division of the Federal Bureau of Investigation, announced today the guilty plea of Andrea Smith, age 25, of Trumann , Arkansas . Smith, a licensed practical nurse, pleaded guilty to wrongfully disclosing individually identifiable health information for personal gain, a violation of the health information privacy provisions of the Health Insurance Portability and Accountability Act (“HIPAA”) contained in Title 42, United States Code, Section 1230d-6.

On December 5, 2007 , Smith and her husband, Justin Smith, were indicted on charges of conspiracy to violate, and substantive violations of, the HIPAA privacy provisions. At the time of the offense, Smith was employed as a nurse with Northeast Arkansas Clinic (“NEAC”) in Jonesboro , Arkansas . According to the indictment, Andrea Smith accessed the private medical information of an unnamed patient of the clinic on November 28, 2006 . Andrea Smith then disclosed that private medical information to her husband, Justin Smith. That same date, Justin Smith called the unnamed patient and told the patient that he [Smith] intended to use the information against the patient in “an upcoming legal proceeding.” NEAC, which was not charged in connection with this case, subsequently terminated Andrea Smith’s employment.

Pursuant to a plea agreement with the United States , Andrea Smith pleaded guilty to Count Two of the indictment, which charged her with wrongful disclosure of individually identifiable health information for personal gain and malicious harm. In exchange, the United States dismissed the one remaining count pending against her in the indictment. Following the acceptance of Andrea Smith’s plea by the Honorable Susan Webber Wright, the counts against Justin Smith were also dismissed. Andrea Smith faces a maximum penalty of 10 years imprisonment, a fine of not more than $250,000, or both, and a term of supervised release of not more than three (3) years. Andrea Smith’s sentencing has not yet been set, but it is anticipated to be within the next 45-60 days.

“What every HIPAA-covered entity needs to realize and reinforce to its employees is that the privacy provisions of HIPAA are serious and have significant consequences if they are violated,” Duke stated. She added, “Long gone are the days when medical employees were able to snoop around office files for ‘juicy’ information to share outside the office. We are committed to providing real meaning to HIPAA. We intend to accomplish this through vigorous enforcement of HIPAA’s right-to-privacy protections and swift prosecution of those who violate HIPAA for economic or personal gain or malicious harm.” Duke noted that criminal enforcement of HIPAA is a fairly new concept. In fact, the first Department of Justice HIPAA prosecution was initiated in 2004 in the Western District of Washington. Since then only a handful of such cases have followed. To report a HIPAA violation, follow the instructions at the US Department of Health and Human Services Office for Civil Rights website: www.hhs.gov/ocr/privacyhowtofile.htm or call 214-767-4056, the regional office with oversight over violations occurring in Arkansas .

This case was investigated by the Little Rock Division of the Federal Bureau of Investigation and was prosecuted by Assistant U.S. Attorney Laura G. Hoey.