by Elizabeth E. Hogue, Esq.
HIPAA Violation
HIPAA violation: Trent James Russell was convicted in federal Court on charges of obtaining another person’s health care information in violation of the Health Insurance Portability and Accountability Act (HIPAA). Russell was employed by an organ transplant organization. As a transplant coordinator, he had access to electronic medical records at George Washington University Hospital in Washington, DC.
Justice Ginberg
In January of 2019, Russell accessed the medical records of U.S. Supreme Court Justice Ruth Bader Ginsburg even though Justice Ginsburg had not been referred as a possible organ donor. He took a screenshot of the records and then posted them on a message board called “4chan.” Ginsberg’s records quickly appeared on Twitter and YouTube, including her name and the exact dates and times when she received radiology, oncology, and surgical treatments at the Hospital between 2014 and 2018.
Hospital officials traced the search of Ginsburg’s records to one of Russell’s home computers. As soon as Russell was identified as a suspect, his access was denied by the Hospital. His request to have access restored was also denied.
The Cat Made me Violate HIPAA Laws
Russell initially told federal agents that his “cats had run across his keyboard.” He later characterized this statement as a “nervous joke.” Russell said that he had no idea how his computer searched terms that produced the Justice’s records and that “everyone makes typos.”
Online users who viewed Ginsberg’s records promoted various antisemitic conspiracy theories. One theory was that Ginsburg had died in late 2018 and that democrats were hiding her death in order to deny President Trump an opportunity to appoint her replacement. A search of Russell’s computer also revealed a search for the term “dirty jew.”
An FBI agent said that she found an image on Russell’s hard drive that mimicked a poster for the film “Weekend at Bernie’s.” The caption said “Weekend at Ginsburg’s” and showed leaders of the U.S. House of Representatives propping Ginsburg up from both sides in a morbid play on how the movie characters covered up Bernie’s death so that they could use his beach house.
Ignorance of HIPAA Law is not a Defense
But, he didn’t even have that. The Chief Executive Officer of the transplant organization at the time the access occurred testified that coordinators like Russell had “no business being inside the chart” of patients who had not been referred to the organization. The CEO said that Russell was certainly aware of this prohibition because of numerous agreements he signed with his employer and the extensive training he received.
Lessons Learned
There are several important takeaways from this case. First, it is important to note that Russell had extensive training about the requirements of the HIPAA Privacy Rule. He also agreed to comply with these requirements. The temptation is great, but employees must be reminded not to succumb. In addition, practitioners should take note of the fact that Russell was criminally prosecuted. Since he was convicted, he faces up to twenty-two years in prison and fines in the tens of thousands of dollars. Serious business!
# # #
Elizabeth Hogue is an attorney in private practice with extensive experience in health care. She represents clients across the U.S., including professional associations, managed care providers, hospitals, long-term care facilities, home health agencies, durable medical equipment companies, and hospices.
©2024 by The Rowan Report, Peoria, AZ. All rights reserved. This article originally appeared in Healthcare at Home: The Rowan Report. One copy may be printed for personal use: further reproduction by permission only. editor@therowanreport.com
©2024 Elizabeth E. Hogue, Esq. All rights reserved.
No portion of this material may be reproduced in any form without the advance written permission of the author.
