HIPAA Prosecution: Former UPMC Employee Indicted

The United States Attorney's Office Western District of Pennsylvania issued a press release providing details of their first HIPAA privacy prosecution. The federal grand jury in Pittsburgh issued a 14 count indicted naming Paul C. Pepala.

The press release provides the following details:

According to the indictment, in February 2008, Pepala, then employed at UPMC Shadyside Hospital, disclosed to others names, birth dates and Social Security numbers of patients for personal gain, in violation of federal HIPAA laws, and disclosed Social Security numbers to other persons without their authorization. This information was used to file false tax returns in 2008. Pepala was also charged with violating the Social Security Act by disclosing Social Security numbers in violation of federal law.

The law provides for a maximum total sentence of 80 years in prison, a fine of $4,730,000, or both. Under the Federal Sentencing Guidelines, the actual sentence imposed would be based upon the seriousness of the offenses and the prior criminal history, if any, of the defendant.

Agents of the United States Postal Inspection Service, Internal Revenue Service and United States Secret Service conducted the investigation leading to the indictment in this case.