between US$100 to 50,000 per violation, with a total of $25,000 to 1.5 million for all
violations of a single requirement in one calendar year of up to $1.5 million on
covered entities (CEs)
266 that are found to have violated HIPAA Rules.
267
Like most U.S. data protection legislation, HIPAA is domain-specific. The rules
protect “individually identifiable health information” held by health care entities.
268
Because HIPAA targets health care entities and a narrow class of businesses that
contract with health care entities, rather than all individuals and businesses that
handle health care data, “most healthcare data controlled or processed by those
outside the traditional health care environment will not be subject to HIPPA
rules”.
269
The penalties levied against HIPPA violators are based on the level of negligence
involved. While the Office of Civil Rights (OCS) within HHS investigates civil
infractions, the Department of Justice is responsible for pursuing criminal actions
under the Act. Criminal penalties may range from a fine of up to $50,000 and
imprisonment up to 1 year for entities and individuals who “knowingly” obtain or
disclose individually identifiable health information.
270 At the top end of the punishment spectrum are offenses committed with the intent to sell, transfer or use
individually identifiable health information for commercial advantage, personal gain
or malicious harm-convictions under those provisions may result in fines of up to
$250,000 and imprisonment up to 10 years.
271
6.4 Consumer Civil Litigation
Consumers who have been victims of data breach often find it difficult to bring civil
claims in federal court in cases where they cannot identify any actual harm caused by
the misappropriation and purported misuse of data.
272 In several recent data security
breach class action cases, courts have held that the plaintiffs have failed to allege an
actual, cognizable harm arising from a data security breach.
273 This harm is required
to establish legal standing under U.S. Const. Article III to bring a lawsuit in federal
court.
274
266 CEs include healthcare providers, health plans, healthcare clearinghouses and all other CEs—
including Business Associates (BAs) of CEs.
267 42 U.S. Code § 1320d–5.
268 Terry (2017), p. 22.
269 Id.
270 Section 13410(D) of the HITECH Act.
271 42 U.S.C. § 1320d-6.
272 Tosi et al. (2016).
273 See, e.g., Whalen v. Michael Stores Inc., --- F. Supp. 3d ---, 2017 U.S. App. Lexis 7717; In re
Zappos.com, Inc., 108 F. Supp. 3d 949 (D. Nev. 2016); and Schwartz v. HSBC Bank USA, N.A.,
--- F. Supp. 3d --, U.S. Dist. Lexis 94019 (2017).
274 Tosi et al. (2016).
Data Protection in the United States: U.S. National Report
445
violations of a single requirement in one calendar year of up to $1.5 million on
covered entities (CEs)
266 that are found to have violated HIPAA Rules.
267
Like most U.S. data protection legislation, HIPAA is domain-specific. The rules
protect “individually identifiable health information” held by health care entities.
268
Because HIPAA targets health care entities and a narrow class of businesses that
contract with health care entities, rather than all individuals and businesses that
handle health care data, “most healthcare data controlled or processed by those
outside the traditional health care environment will not be subject to HIPPA
rules”.
269
The penalties levied against HIPPA violators are based on the level of negligence
involved. While the Office of Civil Rights (OCS) within HHS investigates civil
infractions, the Department of Justice is responsible for pursuing criminal actions
under the Act. Criminal penalties may range from a fine of up to $50,000 and
imprisonment up to 1 year for entities and individuals who “knowingly” obtain or
disclose individually identifiable health information.
270 At the top end of the punishment spectrum are offenses committed with the intent to sell, transfer or use
individually identifiable health information for commercial advantage, personal gain
or malicious harm-convictions under those provisions may result in fines of up to
$250,000 and imprisonment up to 10 years.
271
6.4 Consumer Civil Litigation
Consumers who have been victims of data breach often find it difficult to bring civil
claims in federal court in cases where they cannot identify any actual harm caused by
the misappropriation and purported misuse of data.
272 In several recent data security
breach class action cases, courts have held that the plaintiffs have failed to allege an
actual, cognizable harm arising from a data security breach.
273 This harm is required
to establish legal standing under U.S. Const. Article III to bring a lawsuit in federal
court.
274
266 CEs include healthcare providers, health plans, healthcare clearinghouses and all other CEs—
including Business Associates (BAs) of CEs.
267 42 U.S. Code § 1320d–5.
268 Terry (2017), p. 22.
269 Id.
270 Section 13410(D) of the HITECH Act.
271 42 U.S.C. § 1320d-6.
272 Tosi et al. (2016).
273 See, e.g., Whalen v. Michael Stores Inc., --- F. Supp. 3d ---, 2017 U.S. App. Lexis 7717; In re
Zappos.com, Inc., 108 F. Supp. 3d 949 (D. Nev. 2016); and Schwartz v. HSBC Bank USA, N.A.,
--- F. Supp. 3d --, U.S. Dist. Lexis 94019 (2017).
274 Tosi et al. (2016).
Data Protection in the United States: U.S. National Report
445