Criminal Sentencing for Unauthorized Disclosure of PHI

Historical analysis: this article examines information published by the source on March 20, 2025. Check the latest vendor guidance before acting.

What the agency reported

Federal authorities, including the U.S. Attorney’s Office for the Western District of New York, have announced the sentencing of Tonya D’Agostino, 53, of Farmington, NY. The case involved the unlawful acquisition and disclosure of individually identifying health information in violation of HIPAA.

Allegations, findings, and outcome

According to reports from the U.S. Attorney’s Office, D’Agostino pleaded guilty to charges related to the unauthorized handling of protected health information (PHI). The investigation, conducted by the FBI and the Health and Human Services Office of Inspector General, found that on March 23, 2023, D’Agostino mailed a USPS Priority Mail parcel to a recipient in Medina, NY. This parcel contained identifiable health information belonging to four individuals.

Findings indicate that D’Agostino lacked authorization to obtain or disclose this information and utilized the data in an attempt to obtain $216,000 from the recipient of the parcel. As a result of these actions, Chief U.S. District Judge Elizabeth A. Wolford sentenced D’Agostino to one year of probation and ordered her to pay $13,410.42 in restitution.

Potential breach-prevention strategy

The reported failure was the unauthorized acquisition and subsequent disclosure of PHI for financial gain. The source does not specify the entry path—whether the data was obtained via internal system access, physical theft, or social engineering—leaving the exact root cause unknown. Because the method of acquisition is unspecified, we must assume various scenarios ranging from insider threats to external exploitation.

Our conditional analysis suggests that a similar breach could have potentially been mitigated through the following prioritized actions:

1. Implementation of Least-Privilege Access Controls: To address the scenario where an individual obtains data they are not authorized to see, organizations should restrict PHI access based on specific job functions.
   • Responsible Role: IT Security Administrator / Privacy Officer.
   • Verification: Conduct a periodic access review (user entitlement audit) to ensure no unauthorized users have permissions to sensitive health records.
2. Enhanced Audit Logging for Sensitive Records: To improve detection of unauthorized acquisition, organizations could implement alerting for unusual patterns of data access or bulk exports.
   • Responsible Role: Security Operations Center (SOC) / Compliance Officer.
   • Verification: Review audit logs to confirm that access to high-risk records triggers a traceable event.
3. Physical and Digital Data Loss Prevention (DLP): To limit the damage of data leaving the environment, DLP tools could be used to identify and block the transmission of PHI via unauthorized channels.
   • Responsible Role: Network Security Engineer.
   • Verification: Perform a safe, authorized test by attempting to move a non-sensitive file containing simulated PHI patterns (e.g., fake IDs) to an external medium to verify the trigger.

Controls 1 and 3 are intended to prevent or limit initial unauthorized access and egress; control 2 is designed to improve detection and recovery. These measures could have reduced the likelihood of a breach but cannot guarantee prevention, as determined by the specific method used by the actor.

Security and governance lessons

This case highlights that HIPAA violations are not limited to civil penalties or organizational fines; they can result in federal criminal prosecution, probation, and personal financial restitution. For healthcare providers and business associates, this underscores the necessity of treating PHI as a high-value target for fraud. Governance frameworks must account for the risk of individuals leveraging health data for extortion or fraudulent financial schemes.

Practical response for organizations

Organizations should evaluate their current risk management strategies regarding internal and external access to PHI. A critical decision checkpoint is to determine if the organization can currently identify who accessed a specific patient’s record and why. If an organization cannot produce an audit trail for PHI access, it should prioritize the implementation of logging and monitoring as part of its HIPAA Security Rule risk management process.

Legal and factual limits

This analysis is based on reported sentencing and guilty pleas; it does not constitute legal advice or a certification of HIPAA compliance. The restitution amount mentioned reflects the court’s order and may not represent the total financial impact on all affected parties. This case represents a specific criminal outcome and should not be viewed as a standard sentence for all HIPAA-related violations.

Source and editorial note

Ontario county woman sentenced for HIPAA violation · Source date: March 20, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 23, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 17, 2026 at 00:37 UTC.

Request a healthcare security assessment