◆ Five former Memphis-based hospital employees and another man have pled guilty to unlawfully disclosing patient information in violation of HIPAA, U.S. Attorney for the Western District of Tennessee Kevin Ritz announced. According to the case, Roderick Harvey, 41, paid five employees of Methodist Hospital to provide him with names and phone numbers of Methodist patients who had been involved in motor vehicle accidents. After obtaining the information, Harvey sold the information to third parties, including personal injury attorneys and chiropractors, the U.S. Attorney’s office said. Harvey pled guilty on April 21 to conspiring to violate HIPAA and faces a maximum penalty of five years imprisonment, a fine of $250,000 and three years of supervised release. Sentencing is set for Aug. 1. The five hospital workers—Kirby Dandridge, 38, Sylvia Taylor, 43, Kara Thompson, 31, Melanie Russell, 41, and Adrianna Taber, 26—pled guilty to disclosing the information to Harvey in violation of HIPAA; each faces a maximum penalty of one-year imprisonment, a $50,000 fine and one year of supervised release. They will be sentenced separately later this year.[1]
◆ Washington State has become the nation’s first to codify into law broad protections for consumer health data into law. Washington Gov. Jay Inslee (D) signed the My Health, My Data Act on April 26. The law, which takes effect in 2024, requires companies to get consent from consumers to collect, share or sell health data, which is defined broadly as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.” It prohibits advertising companies from using geofence technology in particular locations, such as health care facilities, to collect and sell data. It also provides for a private right of action that enables consumers to sue companies without explicit consent to use their data. The state’s attorney general can take civil action on behalf of consumers under the act. The act also seeks to fill gaps left by HIPAA since HIPAA only pertains to health data collected by health care providers. Washington Attorney General Bob Ferguson and three state lawmakers introduced the My Health, My Data bill last October in response to the Supreme Court’s ruling earlier in 2022 in the abortion case Dobbs v. Jackson Women’s Health Organization overturning Roe v. Wade. Ferguson cited concerns about apps used to track menstrual cycles, which can sell sensitive information to law enforcement agencies in other states where seeking abortion care is illegal or limited. Lawmakers in several other states—including Illinois, Massachusetts, New York and Nevada—are considering their own versions of new legislation that would expand health data protections beyond HIPAA.[2]
