{"identifier":"/us/usc/t42/s1320d\u20136","title":42,"num":"\u00a7\u202f1320d\u20136.","heading":"Wrongful disclosure of individually identifiable health information","text":"\u00a7\u202f1320d\u20136.\nWrongful disclosure of individually identifiable health information\n(a)\nOffense\nA person who knowingly and in violation of this part\u2014\n(1) uses or causes to be used a unique health identifier;\n(2) obtains individually identifiable health information relating to an individual; or\n(3) discloses individually identifiable health information to another person,\nshall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in\nsection 1320d\u20139(b)(3) of this title\n(b)\nPenalties\nA person described in subsection (a) shall\u2014\n(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;\n(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and\n(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.","url":"https://projectusc.org/usc/t42/s1320d\u20136.html","content":[{"t":"sec","id":"/us/usc/t42/s1320d\u20136","children":[{"t":"num","text":"\u00a7\u202f1320d\u20136."},{"t":"heading","text":"Wrongful disclosure of individually identifiable health information"},{"t":"subsec","id":"/us/usc/t42/s1320d\u20136/a","children":[{"t":"num","text":"(a)"},{"t":"heading","text":"Offense"},{"t":"chapeau","text":"A person who knowingly and in violation of this part\u2014"},{"t":"para","id":"/us/usc/t42/s1320d\u20136/a/1","children":[{"t":"num","text":"(1)"},{"t":"content","text":" uses or causes to be used a unique health identifier;","tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s1320d\u20136/a/2","children":[{"t":"num","text":"(2)"},{"t":"content","text":" obtains individually identifiable health information relating to an individual; or","tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s1320d\u20136/a/3","children":[{"t":"num","text":"(3)"},{"t":"content","text":" discloses individually identifiable health information to another person,","tail":"\n"}],"tail":"\n\n"},{"t":"continuation","text":"shall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in ","children":[{"t":"ref","text":"section 1320d\u20139(b)(3) of this title","href":"/us/usc/t42/s1320d\u20139/b/3","tail":") and the individual obtained or disclosed such information without authorization."}],"tail":"\n"}],"tail":"\n"},{"t":"subsec","id":"/us/usc/t42/s1320d\u20136/b","children":[{"t":"num","text":"(b)"},{"t":"heading","text":"Penalties"},{"t":"chapeau","text":"A person described in subsection (a) shall\u2014"},{"t":"para","id":"/us/usc/t42/s1320d\u20136/b/1","children":[{"t":"num","text":"(1)"},{"t":"content","text":" be fined not more than $50,000, imprisoned not more than 1 year, or both;","tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s1320d\u20136/b/2","children":[{"t":"num","text":"(2)"},{"t":"content","text":" if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and","tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s1320d\u20136/b/3","children":[{"t":"num","text":"(3)"},{"t":"content","text":" if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"text","text":"\n"},{"t":"text","text":"\n"}]}]}