A medical chart can be opened in seconds. The audit trail may remain for years.
That contrast sits at the center of many criminal HIPAA investigations. The dispute is rarely just whether someone clicked on a record—it is why the person accessed it, whether the access was allowed, and what the person knew at the time.
For a nurse, doctor, billing employee, records worker, or contractor, those questions can put a career and freedom at risk. A workplace privacy review can become a federal criminal matter before the employee realizes the government is involved.
Keith & Lorfing represents people facing federal investigations and federal criminal charges in West Texas. If you are under investigation for a criminal HIPAA violation, healthcare fraud, false claims, improper access to patient information, or another federal healthcare offense, speak with a healthcare fraud defense lawyer before answering questions from investigators, compliance personnel, or prosecutors.
When a HIPAA violation becomes a federal crime
HIPAA is not only a civil compliance law. 42 U.S.C. § 1320d-6 creates a federal crime for certain knowing acts involving individually identifiable health information.
The statute covers a person who knowingly and in violation of HIPAA:
Uses an identifier: The person uses or causes the use of a unique health identifier.
Obtains information: The person obtains individually identifiable health information relating to someone.
Discloses information: The person gives that information to someone else.
The government must prove the charged act beyond a reasonable doubt. A policy violation, careless mistake, or accidental click does not by itself establish every element of a federal crime.
Employees can face direct criminal liability
Older discussions of this law sometimes say that only a covered entity can be prosecuted directly. That is no longer a sound summary of the current statute.
Congress amended § 1320d-6 in 2009. It now expressly states that an employee or other individual can violate the law by obtaining or disclosing information maintained by a covered entity without authorization.
That change matters for people who work inside hospitals, clinics, pharmacies, insurers, billing companies, and other healthcare operations. An individual does not avoid possible liability merely because the employer—not the employee—is the HIPAA-covered entity.
What “knowingly” means
The word “knowingly” is important, but it is not a requirement that the person knew the section number or understood every HIPAA regulation. The focus is generally on whether the person knew the facts that made up the conduct.
Intent still cannot be assumed from a username in an audit log. A serious defense review asks whether the access was deliberate, whether someone else used the credentials, whether the record was opened through a workflow error, and whether a valid work reason existed.
Not every use requires patient authorization
HIPAA allows many uses and disclosures without a separate signed authorization. Treatment, payment, healthcare operations, certain disclosures required by law, and other public-interest activities may be permitted when their legal requirements are met.
The “minimum necessary” rule also has exceptions, including many treatment-related disclosures and requests. The HHS summary of the Privacy Rule explains these categories, but the exact regulation and facts must be checked in each case.
What information does HIPAA protect?
The Privacy Rule generally applies to health plans, healthcare clearinghouses, and healthcare providers that conduct certain transactions electronically. It also places duties on business associates that handle protected health information for covered entities.
Protected health information, often called PHI, is individually identifiable information about a person’s health, care, or payment for care that is held or transmitted by a covered entity or business associate. It can be electronic, paper, or oral.
Not every piece of information found in a healthcare workplace is PHI. Properly de-identified information is not PHI, and employment records held by an organization in its role as an employer are excluded from the Privacy Rule’s definition.
That distinction can become a real defense issue. The government must prove that the information in the charged count falls within the law, not simply that it came from a computer at a hospital or clinic.
Civil HIPAA enforcement and criminal prosecution
The HHS Office for Civil Rights, known as OCR, enforces the HIPAA Privacy, Security, and Breach Notification Rules through the civil process. The Department of Justice prosecutes federal crimes.
Those tracks can overlap. OCR may refer a matter that appears criminal to DOJ, while the organization continues to address compliance, corrective action, or breach-notification duties.
| Issue | Civil HIPAA matter | Criminal HIPAA matter |
|---|---|---|
| Government office | HHS Office for Civil Rights | Department of Justice, often working with a federal investigative agency |
| Main question | Whether a regulated entity complied with HIPAA rules | Whether a person committed an offense under § 1320d-6 |
| Burden of proof | Civil standards and agency procedures | Proof beyond a reasonable doubt |
| Possible outcome | Voluntary compliance, corrective action, resolution agreement, or civil money penalty | Dismissal, negotiated resolution, conviction, fine, probation, or imprisonment |
| Can the tracks overlap? | Yes | Yes |
OCR’s enforcement process confirms that it may refer possible criminal violations to DOJ. An employer’s internal investigation may also be running at the same time.
The title on an email does not always reveal which track the facts are moving toward. A privacy-office interview, document request, or request to “clear something up” may later become evidence in a criminal investigation.
How criminal HIPAA investigations begin
These cases often begin quietly. A patient complains, a coworker reports a conversation, or a compliance review finds that an access does not appear to match the employee’s assignment.
Electronic systems can record who entered a chart, when the access occurred, which areas were opened, and whether information was printed or exported. HHS rules require regulated entities to use audit controls for systems containing electronic PHI and to review records of system activity.
An audit log is powerful evidence, but it records computer activity—not the full reason for it. The defense may need to connect the log to staffing records, patient assignments, access permissions, shared-workstation evidence, and the actual care or billing task underway.
People may first learn about a case through:
An internal interview: Compliance, human resources, or corporate counsel asks about an access event.
A preservation notice: The employer directs staff to preserve messages, files, or devices.
A subpoena: A grand jury or agency demands records or testimony.
An agent’s contact: An investigator asks for a voluntary interview.
A target letter: A federal prosecutor states that the person is a target of a grand jury investigation.
A search warrant: Agents seize a phone, computer, account data, or business records.
Not every investigation follows all of these steps. Some people are charged without first receiving a target letter or a chance to explain.
Evidence that can change the case
The strongest defense is built from the records, not from guesses about what an investigator may believe. In a patient-record case, the important evidence often extends well beyond the chart-access report.
We may examine:
Audit data: Login records, chart sections viewed, search terms, timestamps, printing, exports, and later changes.
Access controls: The permissions tied to the account and the employer’s role-based access settings.
Work records: Shift schedules, assignments, referrals, billing tasks, coverage duties, and supervisor instructions.
Authentication evidence: Badge access, device details, network addresses, multi-factor records, and shared-terminal practices.
Communications: Work messages, emails, and calls that may show a legitimate task or the government’s claimed motive.
Training and policies: The rules in effect at the time, how staff were trained, and whether actual workflows matched written policy.
Authorization records: Patient authorizations, legal process, public-health requests, and other grounds for a permitted use or disclosure.
Financial evidence: Payments, searches, transfers, or relationships when prosecutors allege commercial advantage or personal gain.
Context can cut both ways. A record showing a valid assignment may undercut the government’s theory, while a message discussing a patient can strengthen it.
The defense must test authenticity and completeness as well. A report may omit system-generated access, lack the surrounding date range, or combine different actions under a label that sounds more conclusive than the underlying data.
Penalties for a criminal HIPAA violation
Section 1320d-6 has three penalty levels. The higher levels require proof of additional facts, not merely proof that health information was involved.
| Offense level | What the government must prove | Maximum fine | Maximum prison term |
|---|---|---|---|
| Base offense | A knowing violation of the statute | $50,000 | 1 year |
| False pretenses | The offense was committed under false pretenses | $100,000 | 5 years |
| Commercial, personal, or malicious purpose | Intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm | $250,000 | 10 years |
These are statutory maximums, not automatic sentences. If there is a conviction, the judge considers the applicable Sentencing Guidelines, the conduct proved in the case, criminal history, and the factors in 18 U.S.C. § 3553(a).
Curiosity may help prosecutors argue that an access lacked a work purpose. Curiosity alone does not automatically establish commercial advantage, personal gain, or malicious harm, so it should not be treated as an automatic 10-year-tier allegation.
“False pretenses” also requires more than an unauthorized click. The alleged misrepresentation, how it was used, and its connection to obtaining the information all deserve close review.
Other federal charges that may appear
A HIPAA count may be only one part of a larger indictment. Additional charges depend on what the evidence shows; they do not follow automatically from every privacy violation.
Our healthcare fraud defense attorneys evaluate the HIPAA allegation alongside any related fraud, false statement, identity, computer-access, billing, or obstruction theories so the defense addresses the full federal investigation rather than one count in isolation.
Wire fraud: 18 U.S.C. § 1343 requires a scheme to defraud and use of interstate wire communications to help carry it out. Sending data electronically, by itself, does not prove the full offense.
Computer access charges: Prosecutors may consider the Computer Fraud and Abuse Act when someone allegedly entered a protected computer without authorization or exceeded authorized access. Under the Supreme Court’s decision in Van Buren v. United States, an improper purpose alone does not mean that a person exceeded authorized access to information they were otherwise entitled to obtain.
Aggravated identity theft: Section 1028A may add a mandatory consecutive two-year term when a person knowingly uses another person’s means of identification without lawful authority during a listed predicate felony. Under Dubin v. United States, the identity misuse must be at the crux of the predicate offense, not merely an incidental part of it.
False statements: 18 U.S.C. § 1001 can apply to a materially false statement in a matter within federal jurisdiction. A person can create separate exposure during an interview even when no HIPAA charge has been filed.
Obstruction: Knowingly destroying, altering, concealing, or falsifying a record with the required intent to impede a federal matter can lead to an obstruction allegation. This is why preserving records is so important once an investigation is known or expected.
Conspiracy: An agreement to commit a federal offense, followed by the required act to advance it, may create a separate charge even when several people played different roles.
Charge stacking changes plea leverage and possible sentencing exposure. It also means white-collar defense counsel should evaluate the whole investigation, not isolate the HIPAA count from the alleged use of the information.
Professional and employment consequences
A federal investigation can create problems outside the criminal case. The effect depends on the person’s profession, license, employer, reporting duties, and the facts alleged.
Workplace action: An employer may suspend access, place the employee on leave, or end employment before the criminal case is resolved.
Licensing review: A medical, nursing, pharmacy, or other professional board may require a report or open a separate inquiry.
Credentialing issues: Hospitals, insurers, and other organizations may review privileges, enrollment, or credentialing.
Federal program exclusion: HHS OIG exclusion is mandatory for some convictions and permissive for others under 42 U.S.C. § 1320a-7. A HIPAA conviction does not produce one automatic answer; the offense and underlying conduct must fit a statutory ground.
Reputation and privacy: A public charge may expose personal and professional details long before a court decides the case.
A charge does not automatically revoke every professional license. Board proceedings have their own rules, deadlines, evidence, and possible outcomes, so statements made in one case should be planned with the other in mind.
What to do after learning about an investigation
The early response matters because records can be lost through ordinary retention systems, and an informal explanation can become fixed evidence. A careful response protects both the facts and the person’s options.
Preserve relevant material: Keep work schedules, assignments, messages, policy documents, notices, and other records you lawfully possess. Do not access or take additional patient information in an effort to build a defense.
Do not delete or edit records: Do not clean up messages, alter files, or ask someone else to do it. Preservation should extend to relevant personal devices and accounts.
Do not contact patients or coworkers to compare accounts: A well-meant attempt to compare stories may be misunderstood as pressure or coordination.
Identify who is asking questions: An employer, OCR, OIG, FBI agent, prosecutor, licensing board, and private lawyer have different roles and powers.
Do not assume the employer’s lawyer represents you: Corporate counsel usually represents the organization. Ask directly and obtain independent advice before relying on that lawyer for personal protection.
Treat deadlines as real: Subpoenas, board notices, employment demands, and preservation instructions may require different responses on different schedules.
Speak with defense counsel before an interview: Counsel can learn the person’s status, communicate with investigators, and prepare a response without forcing an immediate choice between silence and an unplanned interview.
Do not lie to federal agents. A person generally has the right to decline a voluntary interview, but a materially false statement may create a new criminal issue.
Defense issues in a criminal HIPAA case
Every defense depends on the evidence, but the recurring legal questions are more precise than “Was there a HIPAA problem?” The criminal statute requires the government to prove the charged crime and any higher penalty tier beyond a reasonable doubt.
Was the access or disclosure permitted?
A job title does not answer this question. We examine treatment responsibilities, payment or operational tasks, the scope of any authorization, legal duties, and the rules that applied to the specific use or disclosure.
Did the information fall within the statute?
The record must contain individually identifiable health information covered by the law. De-identification, the source of the information, the organization’s role, and the capacity in which it held the record can matter.
Can the government identify the user?
A credential in a log can be important, but it may not conclusively identify the person at the keyboard. Shared workstations, saved sessions, credential practices, device data, and authentication records can support or challenge attribution.
Can knowing conduct be proved?
An accident, system behavior, or mistaken patient selection is different from a deliberate search. The surrounding workflow and what the user did before and after the event may help establish the difference.
Does the evidence support a higher penalty tier?
The government must prove false pretenses or the specific intent tied to commercial advantage, personal gain, or malicious harm to reach the higher statutory limits. The defense should test the alleged motive rather than accept the government’s label.
Were the investigation and evidence lawful?
Search warrants, subpoenas, interviews, device searches, and electronic records each raise separate issues. Depending on the facts, the defense may challenge the scope of a search, seek suppression, dispute an inference, or present information before a charging decision.
How Keith & Lorfing approaches these cases
In a criminal HIPAA matter, the first courtroom is often a conference room: a compliance interview, an agent meeting, or a prosecutor presentation. We prepare for those moments with the same trial-minded discipline we bring to court.
Our review may include preserving favorable evidence, reconstructing the work setting around an access event, testing the government’s reading of the logs, and addressing related federal counts. When a licensing or employment matter is also pending, we work to keep one response from damaging the other.
Keith & Lorfing has offices in Abilene, Lubbock, Midland, and San Angelo, and we focus our practice on West Texas. Our attorneys bring more than 75 years of combined experience and over 500 jury trials.
Those credentials do not decide a case; the facts do. They do mean that our criminal defense team is built to investigate, advise, negotiate, and try serious matters without backing away when the government’s theory needs to be challenged.
Speak with a West Texas federal defense lawyer
A chart-access allegation should not be reduced to a frightening audit-log entry or an employee’s hurried explanation. The full story may be found in the work assignment, authorization, system design, communications, and purpose behind the access.
Keith & Lorfing offers free consultations to people facing federal investigations and criminal charges in West Texas. Call (325) 480-8100 or contact us online to discuss what happened and what may come next.
Frequently asked questions
Can one unauthorized chart view support a criminal charge?
Potentially. The statute covers knowingly obtaining individually identifiable health information in violation of HIPAA, so the government does not always need to prove repeated access or a disclosure.
One audit entry does not end the analysis. Authorization, identity, job duties, system behavior, and knowledge still matter.
Must the government prove that I shared the information?
Not for a charge based on obtaining information. Section 1320d-6 lists obtaining and disclosing as separate acts.
If prosecutors seek the highest penalty tier, however, they must prove the added intent required by that part of the statute. The charged subsection matters.
Is every employee HIPAA violation a federal crime?
No. An employer may find a policy or compliance violation without DOJ proving a knowing criminal offense beyond a reasonable doubt.
The information, authorization, conduct, and mental state must be analyzed under the criminal statute. Workplace discipline and criminal liability are different questions.
Can OCR and DOJ investigate the same event?
Yes. OCR can address civil compliance while DOJ considers criminal charges, and an employer may conduct its own review at the same time.
Information can move between those processes through referrals, subpoenas, and witness interviews. That is one reason to plan responses across all open matters.
Will a criminal HIPAA charge automatically cost me my license?
No single rule applies to every profession or board. A charge or conviction may trigger reporting and discipline, but the board makes a separate decision under the law governing that license.
Do not ignore a board notice while focusing on the federal case. Missing a deadline may limit options in the licensing matter.
Does my employer’s lawyer also represent me?
Usually not. A hospital or company lawyer represents the organization unless the lawyer clearly agrees to a separate or joint representation that professional rules allow.
Interests that appear aligned at the start can separate later. Ask who the lawyer represents before sharing information in confidence.
How long does a federal HIPAA investigation take?
There is no standard timeline. The length may depend on the volume of electronic records, number of witnesses, related fraud or computer allegations, grand jury activity, and whether several agencies are involved.
An investigation can end without charges, but no lawyer can promise that result. Early work is valuable because evidence and charging decisions can develop before the target hears another word from investigators.
