WASHINGTON — The conviction of a Seattle health-care worker who ran up credit-card bills using the identity of a cancer patient is in jeopardy because of a recent ruling by the U.S. Justice Department.

Richard W. Gibson, who worked at the Seattle Cancer Care Alliance, had been sentenced in November to 16 months in federal prison for violating a medical-privacy law known as the Health Insurance Portability and Accountability Act (HIPAA). It was the first conviction nationwide under the law, which took effect in 2003.

But in a June 1 memo, the Justice Department ruled that most health-care employees can't be prosecuted for stealing personal data under the HIPAA law. The ruling could stop federal prosecutors from pursuing some of the more than 13,000 complaints that have been filed alleging violations of those rules.

Hospitals, insurers, doctors and other health-care providers that bill for their services are subject to criminal prosecution under the law, according to the memo, signed by Steven Bradbury, the Justice lawyer who heads the office of legal counsel.

But a hospital clerk, for example, and other employees cannot face criminal penalties because the law doesn't apply to them, Bradbury wrote.

Gibson was a technician who drew blood.

Gibson had stolen the identity of Eric Drew, a mortgage banker from the San Francisco area, who came to the Seattle for cancer treatment in the fall of 2003, according to his lawyer.

It wasn't long before Drew began getting notices that credit cards had been issued in his name. Receiving little help from authorities, Drew conducted an investigation from his sickbed, which eventually led to Gibson.

Authorities later determined that Gibson bought $9,100 worth of jewelry, video games and a barbecue grill using the cards.

U.S. Attorney John McKay prosecuted Gibson under the HIPAA law, and spokeswoman Emily Langlie said that the office received permission from the Justice Department to do so.

"As prosecutors in the field, we're disappointed with the opinion," Langlie said.

The memo does not mean Gibson will be released immediately; instead, it's up to Gibson to challenge his conviction and a federal judge to overturn it. If that happens, Langlie said, prosecutors will look at other laws to "hold Mr. Gibson accountable."

The health-care industry has long sought to limit the effect of the rules and the HIPAA privacy law on which they are based, though officials at several industry trade groups said yesterday they did not lobby the Justice Department on this topic.

The memo was the subject of extensive internal debate in the Bush administration, with at least one federal prosecutor voicing opposition to its conclusion.

Peter Swire, who was the Clinton administration's top privacy-law expert, called the opinion bad law and public policy.

"It looks like they decided on the outcome for political reasons, namely the health-care industry's desire to get out from criminal prosecution," said Swire, a law professor at Ohio State University.

Officials at the Justice and Health and Human Services departments declined to comment yesterday. The existence of the memo was first reported by The New York Times.

Robert Gellman, a consultant on privacy and information policy, said the memo leaves the bulk of the health-care work force outside that interpretation.

"In terms of the misuse of records, it's not health-care professionals who are the likely problems," Gellman said. "This didn't seem to be such a big issue just a few months ago, when they had the prosecution. I find it puzzling."

Seattle Times staff reporter Maureen O'Hagan contributed to this report.