I found out that a convict meth dealer became certified as a HIPAA auditor by one of those online institutions. Now this person manages the EMR of a few clinics, and does all of their HIPAA related services. This person is hired as a vendor by the healthcare facilities, and belongs to multiple healthcare, doctors, and medical associations. Gives speeches about how to "secure" medical information and moves freely in the medical market selling his services as a HIPAA auditor and EMR specialist. I am sure this person does not disclose to any client or potential client, that she is a convict who went to a federal prison for selling meth and other illegal drugs, like crack and cocaine. Is it legal for a convict not only to manage medical and personal records of patients, but also do HIPAA audits, meaningful use implementation, etc etc?