Employee of Pharmaceutical Manufacturer Criminally Charged with Wrongful Disclosure of Patient Information for Marketing Purpose
On October 16, the United States Attorney’s Office for the District of Massachusetts filed a criminal information against a former Warner Chilcott district manager alleging that he had obtained and used patient protected health information (PHI) in violation of the criminal provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The information alleges that this criminal violation occurred in connection with a scheme to promote Warner Chilcott’s osteoporosis drug Atelvia. The charge against former employee Landon Eckles is significant because it appears to be the first time a criminal prosecution under HIPAA has been brought against an employee of a pharmaceutical manufacturer for an alleged HIPAA privacy violation. Eckles pleaded guilty to the charges on November 12.
Eckles’ charge stems from a case originally brought against Warner Chilcott by qui tam relators alleging the illegal promotion of seven Warner Chilcott drugs, including Atelvia. According to that complaint, Warner Chilcott employees provided payments, meals and other remuneration to promote various products. Warner Chilcott pleaded guilty to related criminal charges, on October 29, and has agreed to pay $125 million to resolve the civil and criminal charges brought against it.
According to the separate criminal information filed against Eckles, he allegedly supervised a team of sales representatives in Warner Chilcott’s osteoporosis division responsible for sales of Atelvia. Atelvia was purportedly covered only with prior authorization (PA) by most payors. Because of this, Eckles and the team of sales representatives allegedly engaged in a variety of tactics to influence the PA process. In addition to paying for meals for staff responsible for filling out PA forms, Eckles purportedly instructed his team to offer PA staff “canned” medical justifications for inclusion in PAs. The government information also alleges that Eckles and his team filled out and submitted PA forms to insurers when the staff failed to do so. In addition, the information alleges that Warner Chilcott employees accessed patient charts to “flag” the patients for prescribers as candidates for company products.
The government alleges that Eckles violated HIPAA when he accessed or directed others to access PHI maintained by HIPAA-covered entities. The government seems to be taking the position that PHI was not accessed for a treatment or payment-related purpose but for a marketing purpose, for which patient authorization would have been required.
The criminal information charged Eckles with a violation of (1) 42 U.S.C. § 1320d-6, the criminal enforcement section of the Administrative Simplification provisions of HIPAA, and (2) 18 U.S.C. § 2, which makes it a criminal violation to aid and abet the commission of a federal crime. Eckles, who will be sentenced in March, faces a prison sentence of up to ten years, three years of supervised release, a $250,000 fine and exclusion from federal healthcare programs.
