HIPAA Criminal Verdict and Enforcement Statistics

The first criminal HIPAA verdict was entered in January of 2007, and HIPAA privacy rule enforcement statistics were reported at the 14^th National HIPPA Summit.

In U.S. v. Ferrer, in the Cleveland Clinic case, a Florida jury found the Defendant, Mr. Fernando Ferrer, Jr. guilty of one count of wrongful disclosure of individually identifiable health information, five counts of aggravated identity theft, one count of computer fraud and one count of conspiring to defraud the United States. Mr. Ferrer was the owner of a healthcare claims administration company at the time and misappropriated the personal data of more than 1,100 patients of the Cleveland Clinic, using a cousin who was an employee of Cleveland Clinic to assist him in this effort. The misappropriated information was used to submit more than $7,000,000 of fraudulent Medicare claims, which netted about $2,500,000 in payments to providers and suppliers.

The following is a summary of the enforcement activities reported at the National HIPAA Summit, listing total complaints, closed cases and cases in which corrective action was taken or which were referred to the Department of Justice for prosecution.