Doctor Jailed for HIPAA Violations

Press Release

Illegally Viewed the Medical Records of Women Who Were Not His Patients at Multiple Iowa Hospitals

An Iowa emergency room doctor and medical resident, who violated the Health Insurance Portability and Accountability Act ("HIPAA") by viewing the medical records of multiple women who were not his patients, was sentenced today to a month in jail. Dr. Gabriel Alejandro Hernandez-Roman, age 31, from Isla Verde, Puerto Rico, received the term of incarceration after a June 28, 2024, guilty plea to one count of wrongfully obtaining individually identifiable health information relating to an individual under false pretenses.

At his plea and sentencing hearings, Dr. Hernandez-Roman admitted that, between 2020 and 2022, he knowingly and without authorization obtained the protected health information of multiple women at hospitals in Cedar Rapids and Iowa City. Dr. Hernandez-Roman was working as a resident doctor in Iowa emergency rooms at the time, including at "Hospital-1" in Cedar Rapids and "Hospital-2" in Iowa City.

In January 2022, Dr. Hernandez-Roman viewed the medical records of "K.F." at Hospital-1 in Cedar Rapids without her knowledge or consent. K.F. was never Dr. Hernandez Roman's patient and was not a patient in Hospital-1's emergency department at the time. When K.F. discovered what Dr. Hernandez-Roman had done, Dr. Hernandez-Roman asked K.F. to tell Hospital-1, falsely, that K.F. had given Dr. Hernandez-Roman permission to look at her medical records.

Dr. Hernandez Roman also admitted to accessing K.F.'s medical records at Hospital-2 in March 2021, as well as the medical records of "M.C." at Hospital-2 in October 2020. After receiving an anonymous complaint about Dr. Hernandez-Roman being romantically involved with patients, accessing their medical records, and threatening them, Hospital-2 discovered that Dr. Hernandez-Roman had illegally accessed K.F. and M.C.'s records. The records included M.C.'s health records when she was a minor and her adult psychological records.

Dr. Hernandez Roman also admitted that, in January 2022, he sent a photograph of one of Hospital-1's patients in Cedar Rapids to another individual via SnapChat. The photograph showed the patient in a hospital setting, wearing a gown, with the patient's rectum clearly hanging out of the body. Dr. Hernandez Roman had no legitimate medical purpose for taking this photograph or, further, for sending it via SnapChat to the individual.

Finally, Dr. Hernandez Roman admitted that, in June 2023, he mailed a letter to the Iowa Board of Medicine in which he admitted accessing the confidential medical records of K.F. and M.C. and also to sharing the photograph of the prolapsed rectum. In his plea agreement, Dr. Hernandez Roman admitted he falsely wrote in the letter that he had sent the photograph of the prolapsed rectum to his mother to remind her of the importance of fiber intake.

Dr. Hernandez-Roman was sentenced in Cedar Rapids by United States District Court Chief Judge C.J. Williams. Dr. Hernandez Roman was sentenced to a month of imprisonment and fined $1,000. He must also serve a three-year term of supervised release after the prison term. There is no parole in the federal system.

Dr. Hernandez-Roman is being held in the United States Marshal's custody. The case was prosecuted by Assistant United States Attorney Timothy L. Vavricek and investigated by the Iowa Medicaid Fraud Control Unit.

Court file information at https://ecf.iand.uscourts.gov/cgi-bin/login.pl.

The case file number is 24-CR-34.

Follow us on X @USAO_NDIA.

Updated January 17, 2025