Five former employees of Memphis, Tenn.-based Methodist University Hospital were indicted for their alleged role in the unlawful disclosure of patient information in violation of HIPAA, according to a Nov. 10 news release from the Justice Department.
The former hospital employees are accused of conspiring with Roderick Harvey, 40, to disclose the names and phone numbers of Methodist patients who had been involved in motor vehicle accidents.
Prosecutors allege that between November 2017 and December 2020, Mr. Harvey paid Kirby Dandridge, 38, Sylvia Taylor, 43, Kara Thompson, 30, Melanie Russell, 41, and Adrianna Taber, 26, to provide him with the information about patients, which was then sold by Mr. Harvey to third persons including personal injury attorneys and chiropractors.
All five former hospital employees — and Mr. Harvey — were charged with conspiracy and face up to five years in prison, a fine of $250,000 and a three-year period of supervised release, the Justice Department said. Mr. Harvey also faces charges of obtaining patient information with the intent to sell it for financial gain, each of which carries a penalty of up to 10 years in prison, a fine of $250,000 and three years of supervised release.
The Justice Department said each former hospital employee was charged with disclosing the information to Mr. Harvey in violation of HIPAA. That charge carries a penalty of up to one year in prison, a $50,000 fine, and a one-year period of supervised release.
Sarah Farley, a hospital spokesperson, issued the following statement to Becker's: "At Methodist Le Bonheur Healthcare, we take the security of our patient's private information very seriously. Once we became aware of the situation, we promptly took action and alerted the appropriate legal authorities. We've cooperated fully with their investigation and ensured each patient who was affected has been notified. While there is no evidence of financial information being disclosed, we are offering free credit reporting for those affected."