Emergency Room Doctor Pleads Guilty to HIPAA Violation

Press Release

Illegally Obtained the Medical Records of Multiple Individuals Under False Pretenses

An emergency room doctor who illegally obtained the personal health information of multiple individuals pled guilty today in federal court in Cedar Rapids. Dr. Gabriel Alejandro Hernandez Roman, age 30, of Puerto Rico, formerly of Iowa City, Iowa, was convicted of one count of Wrongfully Obtaining Individually Identifiable Health Information Relating to an Individual Under False Pretenses.

In a plea agreement, Dr. Hernandez Roman admitted that, in June 2020, the State of Iowa issued him a resident physician license. That same month, Dr. Hernandez Roman began participating in the emergency medicine residency program at a university hospital in the State of Iowa. Between 2020 and 2023, Dr. Hernandez Roman worked in the emergency departments of hospitals within the State of Iowa, including "Hospital-1" in Cedar Rapids and "Hospital-2" in Iowa City.

In January 2022, Dr. Hernandez Roman knowingly and without authorization obtained the individually identifiable health information of "K.F" under false pretenses at Hospital-1. Specifically, Dr. Hernandez Roman used his access, as a resident doctor, to Hospital-1's electronic medical records system to access K.F.'s medical records and learn private medical information about K.F. without K.F.'s knowledge or consent. At no time did K.F. consent to Dr. Hernandez Roman accessing K.F.'s medical records. Dr. Hernandez Roman accessed K.F.'s medical records while working a shift in Hospital-1's emergency department. K.F. was never Dr. Hernandez Roman's patient and was not a patient in Hospital-1's emergency department at the time defendant accessed K.F.'s medical records.

In his plea agreement, Dr. Hernandez Roman also admitted to accessing K.F.'s medical records at Hospital-2 in March 2021, as well as the medical records of "M.C." at Hospital-2 in October 2020. Dr. Hernandez Roman also admitted that, in January 2022, he sent a photograph of one of Hospital-1's patients to another individual via SnapChat. The photograph showed the patient in a hospital setting, wearing a gown, with the patient's rectum clearly hanging out of the body. Dr. Hernandez Roman had no legitimate medical purpose for taking this photograph or, further, for sending it via SnapChat to the individual.

Finally, Dr. Hernandez Roman admitted that, in June 2023, he mailed a letter to the Iowa Board of Medicine in which he admitted accessing the confidential medical records of K.F. and M.C. and to sharing the photograph of the prolapsed rectum. In his plea agreement, Dr. Hernandez Roman admitted he falsely wrote in the letter that he had sent the photograph of the prolapsed rectum to his mother to remind her of the importance of fiber intake.

Sentencing before United States District Court Judge C.J. Williams will be set after a presentence report is prepared. Dr. Hernandez Roman remains free on bond previously set pending sentencing. Dr. Hernandez Roman faces a possible maximum sentence of five years' imprisonment, a $250,000 fine, and three years of supervised release following any imprisonment.

The case is being prosecuted by Assistant United States Attorney Timothy L. Vavricek and was investigated by the Iowa Medicaid Fraud Control Unit.

Court file information at https://ecf.iand.uscourts.gov/cgi-bin/login.pl.

The case file number is 24-CR-34.

Follow us on Twitter @USAO_NDIA.

Updated July 1, 2024