42 U.S.C. § 1320d–6: Wrongful disclosure of…

Summary

You can be punished if you knowingly use a person's special health ID, get private health information that identifies someone from a covered entity without permission, or share that identifying health information with others. A covered entity is an organization that keeps health records under the HIPAA privacy rules. Penalties depend on what you did and why. For a basic knowing violation: fine up to $50,000, up to 1 year in prison, or both. If done under false pretenses: fine up to $100,000, up to 5 years in prison, or both. If done to sell, transfer, or use the information for commercial advantage, personal gain, or to harm someone: fine up to $250,000, up to 10 years in prison, or both.

Title 42, §1320d–6

The Public Health and Welfare, Source: USLM XML via OLRC

(a)Offense

A person who knowingly and in violation of this part—

(1)uses or causes to be used a unique health identifier;

(2)obtains individually identifiable health information relating to an individual; or

(3)discloses individually identifiable health information to another person,

shall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d–9(b)(3) of this title) and the individual obtained or disclosed such information without authorization.

(b)Penalties

A person described in subsection (a) shall—

(1)be fined not more than $50,000, imprisoned not more than 1 year, or both;

(2)if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and

(3)if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.

Notes & Related Subsidiaries

Editorial Notes

Amendments

2009—Subsec. (a). Pub. L. 111–5 inserted at end “For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d–9(b)(3) of this title) and the individual obtained or disclosed such information without authorization.”

Statutory Notes and Related Subsidiaries

Effective Date

of 2009 AmendmentAmendment by Pub. L. 111–5 effective 12 months after Feb. 17, 2009, see section 13423 of Pub. L. 111–5, set out as an

Effective Date

note under section 17931 of this title.

§1320d–6 Wrongful Disclosure of Individually Identifiable Health Information

Summary

Title 42, §1320d–6

Notes & Related Subsidiaries

Editorial Notes

Amendments

Statutory Notes and Related Subsidiaries

Effective Date

Effective Date

Citations & Metadata