Selling Medicare Patient Data Is Now Its Own Federal Crime: What a New Miami Indictment Means for Insiders and Buyers

A federal grand jury in the Southern District of Florida has charged a Miami woman with running a multi-year operation to buy and resell the Medicare beneficiary identifiers of more than 6,000 patients. The same case charges the insider who fed her the data, a former employee at a regional South Florida health-care network who, according to court filings, photographed patient records off a work screen and sent them through an encrypted messaging app. If you work inside a clinic, a billing company, or a provider network, this case should have your attention. The government is charging the theft and sale of Medicare numbers as a standalone federal crime, not a footnote to a billing case.

Key Takeaways

• The government can charge buying, selling, or distributing Medicare beneficiary identifiers as a standalone conspiracy under 18 U.S.C. 371 backed by the criminal HIPAA provision at 42 U.S.C. 1320d-6.
• The insider who disclosed patient records was charged as a defendant, not treated as a cooperating witness.
• Aggravated identity theft under 18 U.S.C. 1028A adds mandatory years that run consecutive to the underlying fraud sentence.
• Loss amount tied to more than $5 million in billed claims and 6,000-plus affected beneficiaries puts the guideline range high before enhancements.
• Pre-indictment is when charging decisions, cooperation options, and loss theories are still open.

A Miami federal grand jury charged the buying and selling of Medicare beneficiary identifiers as a standalone federal crime — the act of trafficking the data, not just billing fraud.

What Actually Happened

According to the indictment and a related criminal information filed in the Southern District of Florida, a Miami woman paid a former employee of a Miami-based regional provider network for confidential patient information, including names, dates of birth, and Medicare beneficiary identifier numbers. The filings allege the insider accessed protected records on a work computer, photographed the screen with a personal phone, and transmitted the images through an encrypted app between January 2022 and February 2025.

The price structure tells the story. Court records allege the buyer paid roughly $500 for each list of about 100 Medicare beneficiaries, then resold those lists for as much as $7,000 apiece to people running fraud schemes. In total, the conduct allegedly exposed the Medicare information of more than 6,000 patients. The buyer is also alleged to have used the stolen identifiers in a durable medical equipment scheme that billed Medicare more than $5 million, with more than $460,000 in proceeds run through a company account.

One co-participant has already been sentenced in the same district on related charges. The new charges were announced by the U.S. Attorney for the Southern District of Florida, HHS-OIG Miami, and the FBI Miami Field Office. An indictment is only an allegation, and every defendant is presumed innocent.

What the Government Is Actually Building

Read the charging theory and you see the shift. Prosecutors are treating the patient data itself as the product, and the billing fraud as a downstream consequence. That matters because it means the government does not have to wait for a clean billing-fraud case to bring charges. The act of selling Medicare numbers is enough.

It also means insiders are exposed. For years, the clinic or network employee who leaked patient lists was often treated as a witness who could be flipped against the organizers. Here, the insider is a charged defendant. That is a deliberate message to anyone with access to protected health information: the access is the crime when you sell it.

The timing is not random. The Department of Justice announced a dedicated Fraud Division in April 2026, and federal health care fraud enforcement in South Florida has only intensified. HHS-OIG and the FBI are using provider cooperation, encrypted-message recovery, and recorded meetings to build these cases. In this matter, the filings even quote instructions to a witness to deny everything and to use code words, the kind of consciousness-of-guilt evidence prosecutors look for.

Exposure and the Charges

The charging package here is a useful map of how the government layers counts to drive up exposure. The standalone data conspiracy, charged as conspiracy to buy, sell, and distribute beneficiary identifiers, carries up to five years under the general federal conspiracy statute, 18 U.S.C. Section 371. The privacy backbone behind that conduct is the wrongful-disclosure prohibition in 42 U.S.C. Section 1320d-6, the criminal HIPAA provision.

On top of that, conspiracy to commit health care fraud and each substantive health care fraud count carry up to ten years under 18 U.S.C. Section 1347 and 18 U.S.C. Section 1349. Money laundering counts add up to ten years each under 18 U.S.C. Section 1957. And aggravated identity theft under 18 U.S.C. Section 1028A is the count that changes the math: it adds a mandatory two years that must run consecutive to whatever else the court imposes. Stack four of those and you have added eight mandatory years before the guideline calculation even begins.

For sentencing, loss amount drives the guideline range in fraud cases. A scheme tied to more than $5 million in billed claims and more than 6,000 affected beneficiaries puts a defendant in a high offense level before enhancements. This is why an experienced federal criminal defense attorney looks at the count structure and the loss theory first, not the headline.

The Mistakes People Make Early

The damage in these cases is usually done before anyone hires counsel. The most common errors repeat across every South Florida health care fraud investigation.

Talking to agents without a lawyer. HHS-OIG and FBI agents are trained interviewers. A friendly doorstep conversation becomes a Section 1001 false-statement count when your recollection does not match their documents.

Producing records, or deleting them, on instinct. Handing over a phone or a laptop without counsel can waive protections and hand the government its best evidence. Deleting anything can convert a fraud case into an obstruction case.

Coordinating a story. The recorded instructions to deny everything in this case are a textbook example of how witness coordination becomes its own crime and destroys credibility.

Assuming silence from the government means safety. A target of a federal investigation often hears nothing for months while agents build the case. The quiet is not good news.

A Defense Approach That Works

Pre-indictment defense is where these cases are won or lost. The window to shape a federal investigation closes fast, and the most valuable work happens before any charge is filed.

First, control contact. Counsel becomes the single channel for the government, which ends the risk of an ill-advised interview. Second, get ahead of the data. In a patient-information case, the defense needs to understand what was accessed, what was actually disclosed, and whether the government can tie a specific defendant to specific identifiers, or whether it is relying on inference. Third, separate the insider question early. If the client is the employee with access, the analysis is different from the client who allegedly bought or resold lists, and the cooperation calculus is different too.

Cooperation versus litigation is a real decision, not a reflex. Sometimes the strongest move is an early, structured proffer that caps exposure. Sometimes it is forcing the government to prove a weak loss theory or a thin link between a defendant and the identifiers. A federal investigation defense lawyer maps both paths before the client commits to either. If charges proceed, sentencing positioning starts immediately, because loss amount, role, and acceptance of responsibility are shaped by what the defense does in the first weeks.

Why Timing Matters Right Now

Charging decisions are still fluid early in a federal investigation. Prosecutors decide who gets indicted, who gets an information with room to cooperate, and who is left as a witness. Those decisions are influenced by who shows up with counsel, a clear account, and a credible position before the grand jury votes.

In these cases out of the Southern District of Florida, the government moves quickly and charges insiders and buyers alike. If you have received a target letter, a grand jury subpoena, or even an informal call from HHS-OIG or the FBI, the time to act is now, not after the indictment.

Common Questions

Is selling Medicare beneficiary numbers a federal crime by itself?

Yes. The government can charge buying, selling, or distributing Medicare beneficiary identifiers as a standalone conspiracy under 18 U.S.C. Section 371, with the criminal HIPAA disclosure rule in 42 U.S.C. Section 1320d-6 behind it. You do not have to submit a single fraudulent claim to face charges. Trafficking the data is enough to expose you to federal prison.

I am an employee who shared patient lists. Am I a witness or a defendant?

Both are possible, and you cannot assume you are only a witness. In this Southern District of Florida case, the insider who allegedly disclosed patient records was charged, not merely interviewed. If you had access to protected health information and shared it, speak with a federal criminal defense attorney before you speak with any agent.

What is aggravated identity theft and why does it matter so much here?

Aggravated identity theft under 18 U.S.C. Section 1028A applies when someone uses another person's identifying information during certain felonies, including health care fraud. It carries a mandatory two-year sentence that runs consecutive to every other count. Multiple counts mean multiple mandatory years stacked on top of the underlying fraud sentence, which is why prosecutors charge it.

Why does South Florida see so many of these cases?

The Southern District of Florida has the most aggressive Medicare fraud enforcement infrastructure in the country, with dedicated HHS-OIG and FBI units in Miami and a long history of data-driven prosecutions. Durable medical equipment, telemedicine, and beneficiary-data schemes are all priorities. A South Florida federal criminal defense attorney sees these patterns regularly.

The agents have not charged me yet. Should I wait?

No. The pre-indictment stage is the most important period in a federal investigation. Charging decisions, cooperation options, and loss theories are still open. Waiting for an indictment surrenders the leverage that early, informed defense work can create. If you are a target or have been contacted, get counsel involved immediately.

Facing a Federal Healthcare Fraud or Patient-Data Investigation in Florida?

If you are under investigation, have received a target letter or grand jury subpoena, or have been contacted by HHS-OIG or the FBI in connection with Medicare or patient data, the decisions you make in the first days matter. AMC Defense Law represents clients in federal investigations and prosecutions in Florida and nationwide. Contact the firm for a confidential consultation.