Yes, it is highly illegal to steal medical records. Stealing, hacking, or accessing medical files without authorization violates multiple federal and state criminal laws, privacy regulations, and civil statutes. [1, 2, 3]

Federal Criminal Violations

• HIPAA Violations: The Health Insurance Portability and Accountability Act dictates strict rules for Protected Health Information (PHI). Knowingly obtaining or disclosing PHI without permission carries criminal penalties of up to $50,000 and one year in prison. If the theft is done under false pretenses, the penalty rises to $100,000 and five years. If done for commercial advantage, personal gain, or malicious harm, the penalty jumps to $250,000 and 10 years. [1, 2, 3, 4, 5]
• Identity Theft: Stealing health data to obtain medical services or insurance payouts constitutes medical identity theft. This triggers federal identity theft charges, adding mandatory minimum prison sentences.[1, 2, 3]
• Cybercrime Laws: If records are stolen via computer hacking or malware, perpetrators face prosecution under the Computer Fraud and Abuse Act (CFAA). [1]

State Criminal and Civil Laws

• Grand and Petty Larceny: Physical theft of paper records or hospital equipment containing electronic data constitutes property theft.
• State Felonies: Many states have passed individual laws explicitly criminalizing health data theft. For example, Colorado classifies the theft or unauthorized disclosure of a medical record as a Class 6 felony. [1, 2]
• Civil Lawsuits: Victims can sue perpetrators for financial damages. Courts routinely recognize torts like “intrusion upon seclusion” or breach of privacy for unauthorized medical record snooping. [1, 2]

Hospital Staff Restrictions

Medical personnel cannot look at records out of curiosity. Healthcare employees who view records without a direct medical reason face immediate termination, loss of their professional license, and criminal prosecution. Healthcare staff can even face prosecution for improperly opening their own medical files without following standard request protocols. [1, 2, 3, 4, 5]

If you are looking into a specific situation, let me know:

• Was the theft committed by an employee or an outside hacker?
• Are the stolen files digital or physical paper records?
• Do you need to know how to report a breach or check for identity fraud?

I can provide the exact legal avenues or recovery steps for your scenario.