Back to Index of HIPAA Changes

HIPAA Changes in H.R. 1
The American Recovery and Reinvestment Act of 2009

Clarification of Application of Wrongful Disclosures Criminal Penalties
House bill Sec. 4409
Senate bill Sec. 13409
Conference agreement Sec. 13409

This text is from the Conference Committee Report

Current Law

The HIPAA criminal penalties include fines of up to $250,000 and up to 10 years in prison for disclosing or obtaining health information with the intent to sell, transfer or use it for commercial advantage, personal gain, or malicious harm. In July 2005, the Justice Department Office of Legal Counsel (OLC) addressed which persons may be prosecuted under HIPAA and concluded that only a covered entity could be criminally liable.

House Bill

The House bill clarifies that criminal penalties for wrongful disclosure of PHI apply to individuals who without authorization obtain or disclose such information maintained by a covered entity, whether they are employees or not.

Senate Bill

Same provision.

Conference Agreement

Same provision.