Huntington Hospital ex-employee who sold patient data faces up to 10 years in prison
A former Huntington Hospital employee has pleaded guilty to illegally accessing patient records. Credit: Yellow House Images/Andrew Theodorakis
The former Huntington Hospital employee accused of illegally accessing 13,000 patient records has pleaded guilty to a seven-year string of federal health-care privacy law violations.
Prosecutors allege that the former telemetry technician, Luis Soriano, was paid as much as $150,000 to disclose confidential patient information that he illegally accessed between 2012 and 2019 at three hospitals, according to court documents.
He faces up to 10 years in prison, law enforcement authorities said Friday.
Soriano is due to be sentenced April 5 by Judge LaShann DeArcy Hall in federal court in Brooklyn, court documents show. He is accused of wrongful disclosure of health information, a felony.
Soriano pleaded guilty on Jan. 29, 2020, and he is free on a $50,000 bond, law enforcement authorities said. The case was previously sealed because it was an ongoing investigation with a risk of evidence destruction or flight, court documents state.
Soriano could not be reached on Friday. His attorney, Steven Goldman of the Bronx, did not respond to requests for comment.
Huntington Hospital last month reported the breach of 13,000 patient records, which it said occurred from 2018 until early 2019.
A spokeswoman for Northwell Health, whose network includes Huntington Hospital, said in a statement, "due to our tools to monitor access to medical record applications and our regular audits of medical record access, Huntington Hospital determined that the employee improperly accessed patient information and the employee was immediately suspended and was subsequently terminated. In addition, we notified authorities of the incident and [have] cooperated fully with the investigation."
The health system has tightened controls on employees' access to patient data and retrained staff, the spokeswoman said. The hospital is offering all affected patients identity theft protection services for at least one year.
Huntington Hospital followed law enforcement authorities’ instructions to delay publicly reporting the incident until last month, the Northwell spokeswoman said. A spokesman for the Eastern District declined to comment on the instructions to delay reporting the incident.
The court documents do not include the names of the three hospitals, but all are located in the Eastern District of the federal court system, which includes Nassau and Suffolk counties as well as Queens, Brooklyn and Staten Island. The only Northwell hospital that employed Soriano was Huntington Hospital, where he worked from June 2017 until February 2019, a health network spokeswoman said.
The court documents state Soriano "engaged in a scheme to disclose individually identifiable health information" to others without authorization, "including Individual A, an individual known to the United States," in exchange for payments totaling about $100,000 to $150,000. No information about the identity of Individual A or the other individuals was available Friday.
Soriano disclosed information about patients seeking treatment at the three hospitals, including names, telephone numbers, medical conditions and reasons for hospitalization, with the intent to use it "for commercial advantage, personal gain and malicious harm," court records state. His actions violated the federal Health Insurance Portability and Accountability Act of 1996, which restricts health care providers’ use of patient information, court documents state.
At the three hospitals, Soriano worked as a patient caretaker from 2009 until 2014; as an emergency department technician from 2014 until 2017; and as a telemetry technician remotely monitoring patient vital signs from 2017 until 2019, court documents show.
Soriano became a licensed emergency medical technician in 2006, court documents show. His license expired in 2009, according to the state Department of Health.
In May 2020, Soriano informed the judge that he had taken a job where he had access to confidential medical information, in violation of his plea agreement, and he asked for permission to continue working there, court documents show. The judge ordered him to leave the job immediately and threatened to revoke bail if he violated the terms of the agreement again, court records show.
Maura McDermott covers health care and other business news on Long Island.
