Combining an "unwholesome criminal trilogy" of identity theft, medical privacy violations and health-care fraud, two cousins stole the personal information of more than 1,100 Cleveland Clinic patients and billed more than $2.8 million in Medicare charges, federal prosecutors said Friday.
Isis Machado, a coordinator at the Weston clinic, printed out information from electronic files that included Social Security numbers, dates of birth, addresses and other details about Medicare patients at the clinic's Naples location, prosecutors said.
She then sold the information to her cousin, Fernando Ferrer Jr., owner of Advanced Medical Claims in Naples, who let the information be used to file fraudulent Medicare claims, prosecutors said.
Both were indicted earlier this week in Fort Lauderdale on charges of conspiracy to commit computer fraud, conspiracy to commit identity theft and conspiracy to wrongfully disclose individually identifiable health information.
They are also charged with fraud in connection with computers and violations related to the Health Insurance Portability and Accountability Act, or HIPAA, which forbids the unauthorized release of private patient information.
"Medical files have some of our most private information," said U.S. Attorney R. Alexander Acosta. "Each of us rightly trusts that our health-care providers will keep them confidential."
In June, another Weston employee alerted clinic officials to the scheme, which prosecutors say began sometime after Machado began working there in May 2005.
The officials contacted law enforcement, fired Machado and cooperated with the investigation, said Cleveland Clinic spokeswoman Eileen Sheil. Health Management Associates bought the Naples clinic in May, but the facility was still in a transition period in June when officials learned of the identity theft allegations.
"The Cleveland Clinic Florida ... is also conducting an internal risk assessment to prevent such an event from happening again," clinic officials stated Friday.
On Friday, the Cleveland Clinic sent letters to patients who might have been affected. It also set up a hotline, 1-866-907-0675, for patients with questions or concerns.
Machado, 22, and Ferrer, 29, had their initial appearances in federal court Friday and were released on bond, prosecutors said. If convicted, Machado and Ferrer could be sentenced to 10 years in prison and fined $250,000 on the most serious of the charges. They could not be reached for comment Friday.
The indictment of Machado and Ferrer is the first HIPAA prosecution in the Southern District of Florida and the third in the nation. Acosta said he expects more prosecutions under the act as more patients' records become available electronically.
Acosta said patients can help combat health-related identity theft by checking their health care statements carefully.
"Patients need to be very vigilant," he said. "If there are charges that should not appear, if there are charges that are fraudulent, then the patient needs to call Medicare or Medicaid or a health-care provider that is trusted to ensure that the billings are accurate and not the result of fraud."