During the COVID-19 pandemic, a local public hospital is very busy treating hundreds of patients with COVID-19. Further assume that, due to shortages of senior physicians at the hospital, the hospital has deputized many younger physicians to work longer hours than normal and in areas of medicine in which they typically do not work. Further assume that, one evening, a young physician who is really tired and is trying to send her boyfriend a reply message on FaceBook telling him to not forget to feed their dog accidentally takes a cell phone photo of an electronic medical record and accidentally posts that to FaceBook (instead of the reply message about the dog needing to be fed). Further assume that all 1,209 of the young physician's FaceBook friends can see the electronic medical record, including the name and address of the particular hospital patient who is being treated for COVID-19. Finally, assume that the public hospital is not very well off financially but has never violated the HIPAA Privacy Rule before.

• Explain the range of CMP that may be appropriate and, if applicable, the range of criminal penalty (including prison time and criminal fines) that may be appropriate.

• Finally, put your "defense lawyer" hat on and identify any factors relevant to the defendant covered entity that you feel weigh in favor of a lower (versus a higher) civil and/or criminal penalty.

Answer rating: 100% (QA)

In the given scenario the young physicians inadvertent disclosure of a patients electronic medical r... View the full answer