Penalty for obtaining or disclosing individually identifiable health information under the privacy rule?

Penalty for obtaining or disclosing individually identifiable health information under the privacy rule?

• A. $50,000 fine and up to 1 year in jail
• B. $100,000 fine and up to 5 years
• C. $250,000 fine and up to 10 years
• D. $500,000 fine and up to 20 years

Answer: (A)

The main idea is the criminal penalties set by HIPAA for improperly obtaining or disclosing protected health information. For someone who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule, the penalties start at a $50,000 fine and up to one year in jail. Higher penalties apply only in more serious cases: up to $100,000 and up to five years if the offense is committed under false pretenses, and up to $250,000 and up to ten years if the act is done with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm. Since the question targets the basic act without those aggravating factors, the baseline of $50,000 and up to one year is the correct framework.

The main idea is the criminal penalties set by HIPAA for improperly obtaining or disclosing protected health information. For someone who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule, the penalties start at a $50,000 fine and up to one year in jail. Higher penalties apply only in more serious cases: up to $100,000 and up to five years if the offense is committed under false pretenses, and up to $250,000 and up to ten years if the act is done with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm. Since the question targets the basic act without those aggravating factors, the baseline of $50,000 and up to one year is the correct framework.