IRS faces class action lawsuit over theft of 60 million medical records
healthcareitnews.com
healthcareitnews.com
From the filing:
A lurid but vague class action accuses corrupt and abusive IRS agents of
stealing 10 million people's medical records without a warrant - including
"intimate medical records of every state judge in California."
After being put on notice of the illicit seizure, the IRS agents refused
to return the records, continued to keep the records for the prying eyes of
IRS peeping toms, and keep the records to this very day.
Adding insult to injury, after unlawfully seizing the records and searching
their intimate parts, defendants decided to use John Doe Company's media
system to watch basketball, ordering pizza and Coca-Cola, to take in part of
the NCAA tournament, illustrating their complete disregard of the court's
order and the Plaintiffs' Fourth Amendment rights.
"Despite knowing that these medical records were not within the scope of
the warrant, defendants threatened to 'rip' the servers containing the medical
data out of the building if IT personnel would not voluntarily hand them over,"
according to the lawsuit. "Moreover, even though defendants knew that the
records they were seizing were not included within the scope of the search warrant,
the defendants nonetheless searched and seized the records without making any
attempt to segregate the files from those that could possibly be related to
the search warrant."
If you ever heard about RIAA cases where defendants were punished $250,000 per downloaded song, or $450,000,000 in total "damages", something like this should not surprise you.
It's worth noting that the largest HIPAA fine to date was $3mm -- .001% of the sought-after amount.
(http://en.wikipedia.org/wiki/Digital_Theft_Deterrence_and_Co...)
They likely won't wind up with anywhere near $250 billion, but someone needs to keep these IRS animals in check. I'd like to see a multi-million dollar judgment, paid personally by the IRS agents involved over the next several decades, while they are forced to work construction. Then I'd like to see pictures of them working in the hot sun to pay this debt published in the IRS employee newsletter as a warning to other power-tripping, pizza-eating, Coke-swilling agents that practice their profession with wanton disregard for the very laws they are supposed to be enforcing. This kind of thing is not OK.
You seek to minimize the illegal conduct of the agents involved in
this case, but this is actually very serious.
I'm not even convinced what they did was illegal. Unless you know otherwise, the story reads that the IRS had a subpoena for some electronic files on a John Doe suspected of fraud. They took a 'server' which was likely a file server that contained said files. It appears that the file server also had patient data. How devious of them.
What were they supposed to do? I'm sure John Doe didn't type up a 'master-fraud-plan.doc' and leave it on the desktop.
And in fact HIPAA was designed for exactly this type of thing.
What if the IRS decides to keep this information and use it
to spawn other investigations?
Who is going to stop them once they have the records?
If the law allows for $25,000 per person, and they were informed that
they were violating the law and did this anyway, then so be it.
Speaking of the 10 million people, any provider which loses patient information for more than 500 people must file a notice of breach, which is then public information. Looking at 2011 breach notifications, the largest California breach was only 1.9 million people, and was related to IBM losing some drives.[1] It would be outstanding if this dirtbag convinced some judge that a breach actually occurred, which would be enough evidence for the HHS to levy a massive fine against them for failing to report.
[1] - http://www.dmhc.ca.gov/library/reports/news/pr031411.pdf
Yes. They committed an illegal act; now they are being sued over it.
[Hipaa was't designed for this]
HIPAA was designed to protect medical records from falling into unauthorized hands and/or being misused or mishandled. So yes, this is a HIPAA violation, probably of unprecedented size and scope.
[If the government used this information for other cases] The cases would be thrown out almost immediately
The government routinely intercepts information that it can't use in court because of the way it was obtained. They use it as a starting point. If someone has told their psychiatrist that they were embezzling funds, for example, and this was in their records, they could use that information to know where to begin looking and prosecute a crime that they would not have otherwise known about.
Yes. They committed an illegal act; now they are being sued over it.
So yes, this is a HIPAA violation, probably of unprecedented size and scope.
1. The law makes clear exceptions for information gathered during the course of an investigation.
2. Health information is supposed to be encrypted in transit or at rest, so if the company was in compliance, there's a distinct possibility that the data isn't even accessible.
The government routinely intercepts information that it can't use
in court because of the way it was obtained. They use it as a starting
point. If someone has told their psychiatrist that they were embezzling
funds, for example, and this was in their records, they could use that
information to know where to begin looking and prosecute a crime that
they would not have otherwise known about.
I'll leave it to the courts to determine the outcome, but I predict this is the last we hear of this.
Remember it's "theft" until you get someone to pass a law requiring people to voluntarily give you what you want.
For those interested, I found more info in the following links. Though, it still does not appear that the IRS would be privy to the exact details of medical care.
http://www.cnbc.com/id/100711119
http://www.irs.gov/PUP/newsroom/REG-148500-12%20FR.pdf
it's "theft" until you get someone to pass a law requiring people to voluntarily give you what you want
While this is very true, it is rarely applied retroactively.
"...According to the case, the IRS agents had a search warrant for financial data pertaining to a former employee of the John Doe company..."
I wonder who gained access to this data after it was seized?
What political party hack would not want access to "psychological counseling, gynecological counseling, sexual/drug treatment and other medical treatment data" of current or future political figures?
And probably more than they usually want to know about these things.
Reading http://www.courthousenews.com/2013/03/14/55707.htm it seems like the John Doe Plaintiff is a hosting company or datacenter, not the HIPAA covered entity.
I dream of the day when a simpler system like a national sales tax could replace the whole thing.
$1'000'000 * 0.005 = $10'000/yr $300'000 * 0.015 = $10'000/yr
It puts a general price pressure on decreasing housing prices. I would also put a much higher property tax rate on long term unoccupied property to increase rental supply to further decrease property values. California with it's relatively low property tax schemes favoring older people pays for it in overpriced property prices.
No need for that. If the only taxes were on real estate, that would free up a vast amount of capital that the elderly are currently paying in taxes on their IRA withdrawals. Even if their current property taxes were tripled, they'd likely end up with a net gain (or at least no net loss) due to the eliminated income taxes.
On a serious note, it's been a bad week for the IRS, but that agency is seriously struggling right now with a slashed budget and increased responsibilities. As David Cay Johnston, puts it "The IRS is drowning." http://www.cjr.org/united_states_project/the_other_irs_scand...
The only thing I've seen is that they're expected to expand to take on Obamacare, and may not have the funding to do so.
Do you have the specific details on their budget being cut? Hasn't Obama expanded their budget in the last four years?
What's absurd is that estimates of ROI on IRS funding range from 7:1 to 10:1. So it's really not about the budget. I'll leave it as an exercise for the reader to speculate on what's really behind the underfunding of the IRS.
Last night I heard on NPR the story of a New Zealand expatriate that did not file US taxes for several years as is required by every US citizen no matter where they live or how long they've lived outside the US. He voluntarily notified the IRS of his oversight and paid the $20,000 in back taxes. The IRS then told him his penalty exceeded $140,000.
Unfortunately the US tax system is a very adversarial one.
A programmer earning around $100k could easily accrue that kind of tax liability over a few years, even after deducting payment of foreign taxes. (But not penalties and interest for the delayed payments)
My rough estimate is he could have earned $60k a year for 3 years and owe approximately that much.
There are several more requirements not related to income, or even if the citizen ever lived in the US (many people have US citizenship and have never stepped foot here), each of which can carry a substantial penalty if violated.
There are many people living in fear -- and many in substantial debt -- not about income tax problems, but about IRS filing requirements. The system is a monstrosity.
I think this is a concept that should be applied with a broad stroke across society. When someone who is empowered by the people (afforded special privileges or abilities by a government that is democratically elected) commits a crime, that crime is inherently twofold. Liability needs to increase in proportion to the amount of power that has been granted.
His penalty did exceed $140,000 though, they didn't make this up to punish him. That's what happens when you just ignore federal laws.
After meeting with the IRS, the penalty was reduced to $25k.[1] A New Zealand savings account would have averaged ~4%/year over that time period, so subtracting the gains from his owed $20k leaves about $20k in penalties.
What's an appropriate amount to discourage tax cheats? They're called penalties for a reason... are we just supposed to trust everyone who, when caught, claim they 'didn't know' about the law?
[1] - http://www.reuters.com/article/2011/12/08/us-usa-taxes-forei...
Van Horn contacted the IRS's Taxpayer Advocate Service, which agreed to
work on his case. After a series of offers and counter-offers, he says,
the result was a single "non-willful" FBAR penalty of $5,000 per year,
or $25,000 total.Not filing taxes for 5 years is fraud.
Filing and paying taxes while working for the IMF -- but not realizing you should've been paying the 'employer' half of payroll taxes as well -- is negligence.
On top of that you have huge accountant costs to file these complicated penalty prone returns even if you end up not owing any taxes year over year.
It's still 'negligence', your IMF example is just in part instead of in full.
And from American citizens by birthright, born outside of the US, and who have never set toe inside the country nor made a penny of US income.
Perhaps my snark should've more explicitly called out Charlie Rangel. Nothing like misreporting your income while also being chairman of the Ways & Means Committee.
But really, all of the examples just underscore how insane the tax code has become.
His excuse for not claiming the income is plausible too since the payments went straight against the mortgage through the resort it was attached to, so the money never hit his savings account. If you owned a home, rented a room on AirBnB, and then AirBnB paid off a small part of your mortgage, would most people know to claim that money as income?
That being said, the Nabors tax shelter mess, the unreported checking accounts, the multiple rent-controlled apartments, etc. all add up to show Rangel as a typical corrupt politician.
But really, all of the examples just underscore how insane the tax code has become.
If those groups are indeed "political opponents" of the current administration, then the IRS has good reason to believe those groups are "political". Political groups have a different tax status than a group that is a church or other non-profit fraternal organizations. That is the law, and the IRS is correct to scrutinize them, in order to properly ascertain what category they fall under.
Slam dunk for the IRS, right there.
Remember the law where you had to start creating 1099s for every vendor you ran across? People yelled at that got taken care of, but there's a lot more in that law yet to come. [inset long discussion about the exact nature of that requirement]
I'd be interested in knowing if it is still possible to keep your health records private. I used to self-pay and this was not a problem. But now? Where I have to be part of some aggregate that then assesses health risks? I'm not sure how it works. (And note the use of the word "private", not "anonymous")
Or at least 20% of it is.
Regardless of use or potential misuse of such data, us "mere mortals" can face serious challenges just for improperly maintaining it.
Is all this stuff sitting on some agents' laptops, somewhere? Given the security requirements for the IRS's own inherent data (or, I would hope they have such requirements), one might hope that the records are reasonably secure. But I can't help being somewhat skeptical on this point. And... such IRS requirements may not be HIPAA compliant.
My point is, amongst everything else, if the government is going to run around vacuuming up data wholesale, we can also look at whether they are even prepared to... "properly", and consistent with the government's own requirements, manage the data that they hoover.