Yes, it is highly illegal to steal medical records. [1]

Depending on how they are taken and used, stealing medical records violates multiple federal and state criminal laws, leading to massive fines and multi-year prison sentences. [1, 2]

Federal Criminal Violations

• HIPAA Violations: Under the Health Insurance Portability and Accountability Act (HIPAA), knowingly obtaining or disclosing protected health information without authorization is a federal crime. Criminal penalties can reach up to 10 years in prison and a $250,000 fine if the records are stolen for commercial advantage, personal gain, or malicious harm. [1, 2, 3, 4, 5]
• Healthcare Fraud: Falsifying, altering, or stealing records to improperly secure payments from programs like Medicare constitutes a felony under 18 U.S. Code § 1035, carrying up to five years in prison. [1]
• Cybercrimes: If the records are stolen via a digital hack or malware, the perpetrator can be prosecuted under the Computer Fraud and Abuse Act (CFAA). [1]
• Identity Theft: Stealing medical records to obtain fraudulent care or prescriptions constitutes medical identity theft, which carries heavy federal identity theft penalties. [1, 2, 3, 4]

State-Level Offenses

• Theft of Medical Records: Many states have laws explicitly criminalizing this act. For instance, in Colorado (CRS 18-4-412), knowingly stealing, copying, or disclosing someone else’s medical records without authority is classified as a felony. [1, 2, 3]
• General Theft Statutes: Physically stealing paper records or a hospital laptop constitutes traditional theft, burglary, or grand larceny based on the cash value of the stolen physical property.

Professional & Civil Consequences

• Loss of License: Healthcare workers who “snoop” or steal patient files routinely face immediate termination, suspension, or permanent revocation of their medical/nursing licenses. [1, 2]
• Civil Lawsuits: Victims can sue perpetrators for financial or reputation damages under common-law torts like “intrusion upon seclusion” or serious invasion of privacy. [1, 2]