An ex-doctor working at practices in New York, New Jersey, and Florida has admitted to committing criminal violations of HIPAA for exposing patients’ protected health information (PHI) to a sales agent of a pharmaceutical company, based on the U.S. Attorney’s Office of the District of New Jersey.
65-year-old Frank Alario, residing in Delray Beach, Florida, admitted to exposing patient data to a sales agent, Keith Ritson, who offered compound prescription medicines and other drugs to the patients. Compound prescription medicines refer to medications made exclusively for specific patients when standard FDA-approved medicines are found to be inappropriate, because of an allergy for instance. Compound prescription medicines aren’t approved by the FDA however doctors can legally prescribe them.
The HIPAA Privacy Rule allows disclosures of patients’ PHI for the reasons of treatment, billing, or healthcare surgeries; nevertheless, other disclosures are solely allowed if permission to share data is given by each patient. Because Ritson was a pharmaceutical agent who wasn’t connected with Alario’s practices, he was not allowed to get access to the PHI of Alario’s patients. Consent to share the data wasn’t given by patients.
Alario permitted Ritson to have substantial access to his clinic, patients’ medical records, and other patient data, during regular business hours and beyond. Ritson was allowed access to sections of Alario’s clinic that were limited to employees, for example, places with patient records and computers. Besides giving access to these parts, Ritson was permitted to search for patient data in data files and on computer systems to find patients whose insurance policy covers compound medicines. Ritson would subsequently tag the records of patients whose insurance plan would pay for the prescription drugs so Alario knows which patients can be prescribed the compound medicines.
In certain instances, Ritson was permitted to be there during consultations. Alario’s patients get the feeling that Ritson was an employee or was associated with the medical practice and throughout those consultations, sensitive health data would be directly shared with Ritson. The data acquired was then employed to prepare prescription forms for medicines, which would subsequently be approved by Alario, with Ritson getting a commission on the approved prescription medications.
Both Alario and Ritson had been charged in an indictment for a conspiracy to abuse HIPAA. Ritson’s charges remain pending, as his trial is slated for November 7, 2022. Alario admitted his wrongdoing and his sentencing will be on February 7, 2023. Alario is facing one year in prison and a $50,000 penalty.