A medical technician in the general surgery department of a university hospital in Washington, DC had access to patients' identifiable health information and to the hospital's prescription pads. According to a statement of offense signed by the defendant and the government, on at least three occasions between August 2010 and December 2011 the technician pulled the records of multiple patients and sold their names, addresses, dates of birth and Medicare numbers, together with blank hospital prescription forms, to another person. Each transaction brought about $500 to $800 in cash; in total roughly 40 patients' information was sold for approximately $2,100.
The buyer used the forms and patient details to forge prescriptions for oxycodone and presented them to pharmacies around the Washington, DC area. The forged prescriptions listed the technician's hospital telephone number as the verification contact. When pharmacists called, the technician confirmed the prescriptions were legitimate, and the pharmacies dispensed the oxycodone.
The FBI's Washington Field Office investigated. In June 2012 the technician pleaded guilty in the U.S. District Court for the District of Columbia to wrongful disclosure of individually identifiable health information, a violation of the Health Insurance Portability and Accountability Act. The press release does not describe how the scheme first came to light.
On September 21, 2012, the court placed the defendant on three years of probation, with the first six months to be served in a halfway house and a further six months on home confinement, ordered 100 hours of community service and imposed a $2,100 fine. The U.S. Attorney stressed that health care providers have an obligation to closely guard patient confidentiality.