What is the maximum fine for those who wrongfully disclose individually identifiable health information with the intent to sell it?

Answer 1

HIPAA'S CRIMINAL PENALTIES

Congress intended the so-called administrative simplification provisions of HIPAA (3) to simplify and reduce administrative costs in the delivery of health care. (4) To that end, HIPAA required the Secretary of HHS to adopt national standards for the electronic transmission of reimbursement transactions. This requirement led to the adoption of the standard transactions and code sets regulation. The Secretary also had to adopt other standards, such as security, privacy, and unique identifiers. (5)

HIPAA contains a broad range of penalties, from civil fines to criminal penalties. The statute punishes noncompliance with the security standards with a civil penalty of $100 per violation up to a maximum of $25,000 per person for all identical violations in a calendar year. (6)

As to criminal penalties, if a person knowingly obtains or discloses individually identifiable health information, (7) the statute establishes a fine of up to $50,000 and imprisonment up to one year as potential penalties. If the offender commits such offenses under false pretenses, the fine goes up to $100,000, and the period of imprisonment may be as many as five years.

HIPAA reserves the most draconian penalties for those offenses in which the offender has the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm. In such cases, the maximum fine is $250,000, and the maximum period of imprisonment is 10 years. (8)