New York Times:
Ruling Limits Prosecutions of People Who Violate Law on Privacy of Medical Records
By ROBERT PEAR
Published: June 7, 2005
WASHINGTON, June 6 - An authoritative new ruling by the Justice Department sharply limits the government's ability to prosecute people for criminal violations of the law that protects the privacy of medical records.
The criminal penalties, the department said, apply to insurers, doctors, hospitals and other providers - but not necessarily their employees or outsiders who steal personal health data.
In short, the department said, people who work for an entity covered by the federal privacy law are not automatically covered by that law and may not be subject to its criminal penalties, which include a $250,000 fine and 10 years in prison for the most serious violations.
The reasoning is that federal regulations establish the standards for medical privacy. The regulations apply just to "covered entities," including insurers and health care providers. Thus, only covered entities can be prosecuted for criminal violations of the law.
This interpretation is set forth in an opinion written by the office of legal counsel at the Justice Department. The opinion, dated June 1, is binding on the executive branch of the federal government, but not on judges....The ruling was a surprise to many lawyers. Robert M. Gellman, an expert on privacy and information policy, said, "Under this decision, a tremendous amount of conduct that is clearly wrong will fall outside the criminal penalties of the statute," the Health Insurance Portability and Accountability Act of 1996....
http://www.nytimes.com/2005/06/07/politics/07privacy.html