SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-criminal-penalties

What is the maximum prison time for criminal HIPAA violations?

Up to 10 years, when done to sell or use the information for gain or to cause harm.

Start playing free

  1. Up to 10 years ✔
  2. Up to 1 year
  3. Up to 5 years

Why: A person who knowingly gets or shares health information in violation of HIPAA can face prison. The top tier, up to 10 years, applies when it is done to sell or use the data for gain or to cause harm.

Huh, didn't know that: The law says an employee who gets or shares a covered entity's health information without authorization can be prosecuted personally.

The dad joke
Why did the clerk keep the patient files to herself? She did not want ten years of free room and board.
Like this card?
Play the game

References

Answer: Up to 10 years. A person who knowingly gets or shares health information in violation of HIPAA can face prison. The top tier, up to 10 years, applies when it is done to sell or use the data for gain or to cause harm.

  1. 42 USC 1320d-6 (govinfo.gov) www.govinfo.gov/content/pkg/USCODE-2018-title42/html/USCODE-2018-title42-chap7-subchapXI-partC-sec1320d-6.htm
    imprisoned not more than 10 years, or both
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.