An Iowa emergency room doctor has been sentenced to a month in jail for violating the Health Insurance Portability and Accountability Act (HIPAA). Dr. Gabriel Alejandro Hernandez-Roman, 31, from Isla Verde, Puerto Rico, pleaded guilty on June 28, 2024, to wrongfully obtaining individually identifiable health information under false pretenses.

During his plea and sentencing hearings, Dr. Hernandez-Roman admitted that between 2020 and 2022 he accessed protected health information of multiple women at hospitals in Cedar Rapids and Iowa City without authorization. He was working as a resident doctor in these hospitals' emergency rooms during this time.

In January 2022, Dr. Hernandez-Roman viewed the medical records of a woman identified as "K.F." at Hospital-1 in Cedar Rapids without her consent. K.F., who was not his patient or in the hospital's emergency department at the time, later discovered the breach. Dr. Hernandez-Roman then asked K.F. to falsely claim she had given him permission to access her records.

Dr. Hernandez-Roman also accessed K.F.'s records at Hospital-2 in March 2021 and those of another woman, "M.C.", in October 2020. Following an anonymous complaint about his romantic involvement with patients and unauthorized record access, Hospital-2 found that he had illegally accessed these women's records, including M.C.'s minor and adult psychological health records.

In January 2022, Dr. Hernandez-Roman sent a photograph via SnapChat showing a patient at Hospital-1 with their rectum exposed. He admitted there was no medical reason for taking or sharing this image.

By June 2023, Dr. Hernandez-Roman mailed a letter to the Iowa Board of Medicine admitting to accessing K.F.'s and M.C.'s confidential records and sharing the photograph mentioned earlier. In his plea agreement, he acknowledged falsely stating in the letter that he sent the photo to his mother as a reminder about fiber intake.

United States District Court Chief Judge C.J. Williams sentenced Dr. Hernandez-Roman in Cedar Rapids to one month of imprisonment and fined him $1,000. He is required to serve a three-year term of supervised release after completing his prison sentence since there is no parole in the federal system.

Dr. Hernandez-Roman is currently held by the United States Marshal’s custody following prosecution by Assistant United States Attorney Timothy L. Vavricek and investigation by the Iowa Medicaid Fraud Control Unit.