Prosecutors Allege Both Doctors Aimed to Help Russia in Ukraine War
A Maryland anesthesiologist and her U.S. Army physician spouse face federal indictment for an alleged conspiracy to provide the Russian government with military medical records.
See Also: Now OnDemand | C-Suite Round-up: Connecting the Dots Between OT and Identity
The Department of Justice on Thursday announced that a federal grand jury returned an indictment charging Anna Gabrielian, 36, and U.S. Army Maj. Jamie Lee Henry, 39, with conspiracy and criminal violations of HIPAA involving wrongful disclosure of individually identifiable health information.
Prosecutors allege the conspiracy centered on a plot by Gabrielian and Henry to assist Russia in its conflict with Ukraine by providing Moscow with insights into the medical conditions of Pentagon and military officials.
The couple conspired to provide information to an individual they believed to be working for the Russian government. The supposed Russian spy was actually an undercover FBI agent. Gabrielian told the undercover agent she was motivated by patriotism toward Russia and meant to provide all the assistance she could, “even if it meant being fired or going to jail.”
The indictment was returned on Wednesday and unsealed Thursday after the arrest of Henry and Gabrielian.
The Justice Department says Gabrielian worked at a Baltimore, Maryland-based medical facility not identified in court documents but known to be John Hopkins Medicine. Henry previously came to national attention as the first known active-duty Army officer to come out as transgender. Henry held a secret-level security clearance, and during the time of the alleged conspiracy, worked as a staff internist stationed at South Carolina’s Fort Bragg, the home of the Army’s XVIII Airborne Corps, headquarters of the U.S. Army Special Operations Command, and the Womack Army Medical Center.
The eight-count indictment includes conspiracy and multiple counts of wrongful disclosure of individually identifiable health information, or IIHI.
“The allegations against these medical professionals serve as a stark reminder that healthcare organizations cannot let their guard down against the threat posed to health information by insiders,” says privacy attorney David Holtzman of the consultancy HITprivacy LLC.
State and federal regulations require that data owners implement risk-based policies, procedures and controls designed to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by authorized users.
Plot Details
Court papers allege after the U.S. implemented sanctions earlier this year against Russia related to its military invasion of Ukraine, Gabrielian contacted the Russian Embassy by email and phone, offering the Kremlin the couple’s assistance.
Around Aug. 17, an FBI undercover agent approached Gabrielian, telling her she had been asked to contact her about the assistance she had offered the Russian embassy.
When Gabrielian and the agent met in a Baltimore hotel, the anesthesiologist told the FBI agent that Henry would be useful for espionage. Henry joined the meeting shortly after 8 p.m.
A week later, when Gabrielian and the agent again met in a Baltimore hotel room, Gabrielian said her spouse was a “coward” concerned about violating HIPAA. Gabrielian said she “had no such concerns and violated HIPAA ‘all the time,'” the indictment states.
On Aug. 31, when the three met again in a hotel in Gaithersburg, Maryland, Henry delivered information pertaining to the spouse of an employee of the Office of Naval Intelligence, an Air Force veteran, and five patients treated Fort Bragg. The ONI employee’s spouse has a medical condition that Russia could exploit, Henry suggested.
If convicted, Henry and Gabrielian face a maximum sentence of five years in federal prison for the conspiracy and a maximum of 10 years in federal prison for each count of disclosing individually identifiable information.
Gabrielian and Henry are represented by separate attorneys. They remain in home detention “on lockdown,” Henry attorney David Walsh-Little told Information Security Media Group.
Former federal prosecutor Andrew Wirmani, an attorney at law firm Reese Marketos LLP, tells ISMG that prosecution of HIPAA criminal cases are pretty rare.
“The violations are usually handled on the civil side. But given the intended use of the information – assisting the Russian government and potentially in its war against Ukraine – it is not surprising that prosecutors went the criminal route,” he says.