I'm not sure we needed HIPAA in order to prosecute the conduct described in this press release, but that's the statute that was used by the US Attorney in Seattle to convict Richard Gibson, who admitted that he "obtained a cancer patient's name, date of birth and social security number while [he] was employed at the Seattle Cancer Care Alliance, and that he disclosed that information to get four