A doctor, who has since ceased practicing, has pleaded guilty to criminal violations of HIPAA in which he passed on protected health information to the sales representative of a pharmaceutical firm. The doctor, who had practices in New York, New Jersey, and Florida, was prosecuted by the U.S. Attorney’s Office of the District of New Jersey.
Frank Alario, the physician in question, disclosed the patient information to Keith Ritson, a sales representative for a pharmaceutical firm. Ritson promoted the use of compound prescription medications, which are patient-specific mixtures that are used when standard medications are not seen to be effective or appropriate. This may be the case if the patient has previously had bad side effects using the FDA-approved course of treatment, for example. Though compound prescription medications are not approved by the FDA, physicians can prescribe them legally.
Even though Ritson was not associated with any of Alario’s practices, he was given extensive access to patient medical files. Ritson was allowed access to Alario’s offices outside of business hours, and was given access to areas where patient files were stored.
Ritson was able to use this access to search patient records and find the insurance details of individual patients, identifying those whose health insurance would cover compound prescription medications. Ritson earmarked these files for Alario, who would then be able to prescribe compound prescription medications to these patients. Ritson received a commission on these prescriptions.
Alario implied to patients that Ritson was a member of staff, with Ritson sitting in on patient consultations. During those consultations, protected health information was shared. This, and Ritson’s general access to PHI, is a clear violation of the HIPAA Privacy Rule. The Rule stipulates that only those required to access protected health information to support a patient’s treatment, the payment of healthcare, or other healthcare operations can legally access it. Specifically prescribing patients medication to earn a commission does not fall within that remit.
Ritson’s sentencing hearing will take place on November 7th, 2022. He faces a maximum fine of $50,000 and up to one year in jail. Ritson’s charges are still pending.