There are 4 categories of violations that reflect increasing levels of culpability. There are also several levels of penalties. A maximum penalty of $1.5 million for all violations. The penalties are provided for in the HIPAA Administrative Simplification: Enforcement, located at 45 CFR Part 160.
If the violation was due to reasonable cause and not to willful neglect, the penalty is at least one thousand dollars ($1,000) per violation not exceeding one hundred thousand dollars ($100,000) per calendar year, but not more than fifty thousand dollars ($50,000) per violation with the total not exceeding one million five hundred thousand dollars ($1,500,000). Finally, if the violation was due to willful neglect and the violation is corrected, a penalty that is at least ten thousand dollars ($10,000) per violation with the total not exceeding two hundred fifty thousand dollars ($250,000) per calendar year but not more than fifty thousand dollars ($50,000) per violation and the total may not exceed one million five hundred thousand dollars ($1,500,000). On the other hand, if the violation is not corrected, the penalty amount will be at least two hundred fifty thousand dollars ($250,000) per violation with the total not exceeding one million five hundred thousand dollars ($1,500,000).
The criminal penalty provisions, a person will be guilty if that person knowingly and in violation of wrongful disclosure of IIHI (1) uses or causes to be used a unique health identifier; (2) obtains IIHI relating to an individual; and (3) discloses IIHI to another person. 42 U.S.C. § 1320d-6. That person can be fined not more than fifty thousand dollars ($50,000), imprisoned not more than 1 year, or both. If the crime was committed under false pretenses, that person can be fined not more than one hundred thousand dollars ($100,000), imprisoned not more than 5 years, or both. The most severe criminal penalty is imposed when an offense is committed with intent to sell, transfer, or use IIHI for commercial advantage where that person can be fined not more than two hundred fifty thousand dollars ($250,000), imprisoned not more than 10 years, or both.
For more information, see here: https://www.ftc.gov/legal-library/browse/statutes/health-information-technology-hitech-provisions-american-recovery-reinvestment-act-2009-title-xiii
These materials were obtained directly from the Federal Government public websites and are posted here for your review and reference only. No Claim to Original U.S. Government Works. This may not be the most recent version. The U.S. Government may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.