Failure to comply with HIPAA can result in substantial civil and criminal penalties.

Civil Penalties
Violations of the "Administrative Simplification Regulations" can result in civil monetary penalties of $100 per violation, up to $25,000 per year. Stated in these regulations is a requirement to protect the confidentiality of individually identifiable health information.

Criminal Penalties
In June 2005, the U.S. Department of Justice (DOJ) clarified who can be held criminally liable under HIPAA. Covered entities and specified individuals who "knowingly" obtain or disclose individually identifiable health information in violation of the Administrative Simplification Regulations face a fine of up to $50,000, as well as imprisonment up to one year. Offenses committed under false pretenses allow penalties to be increased to a $100,000 fine, with up to five years in prison. Finally, offenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000, and imprisonment for up to ten years.