Common use of HIPAA Violation Clause in Contracts

HIPAA Violation. The U.S. Department of Health and Human Services (HHS) may impose civil money penalties on a covered entity of up to $50,000 per failure to comply with a Privacy Rule requirement, up to an annual calendar year limit of $1,500,000 for multiple violations of the identical Privacy Rule requirement. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA faces criminal penalties ranging from $50,000 and up to one-year imprisonment to up to $250,000 and up to ten years imprisonment, in circumstances where the wrongful conduct involves the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm. Criminal enforcement is conducted by the Department of Justice.