Browse Arkansas Code titles and sections
42 U.S.C. § 1320d–6 — Wrongful disclosure of individually identifiable health information
Federal law — U.S. Code and appendices · legal_authorities
**(a) Offense** A person who knowingly and in violation of this part—
(1) uses or causes to be used a unique health identifier;
(2) obtains individually identifiable health information relating to an individual; or
(3) discloses individually identifiable health information to another person,
shall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in [section 1320d–9(b)(3) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d–9/b/3&num=0&edition=prelim)) and the individual obtained or disclosed such information without authorization.
**(b) Penalties** A person described in subsection (a) shall—
(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;
(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 1320d–6
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 44edd1cefcaf4362dd4e10461e3a6794e6932eec449e143007097b7a2c5bf7ab. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Record provenance
Stable record: federal_law:legal_authorities:record_usc_da9c73ce65829e4e3fa789de
Source file: Laws/federal/codes/united-states-code/title-42/section-1320d6-wrongful-disclosure-of-individually-identifiable-health-information--c4cfe0ca57.md
Pages: Not recorded – Not recorded
Passage SHA-256: 5fb7660c76af6ddef64471a2b91e03b49e0c19e5e50a2d97e2b19001d3f23d4d
Source location: Title 42, Chapter 7, § 1320d–6; chapter-007-social-security.md
Stored source content
**(a) Offense** A person who knowingly and in violation of this part—
(1) uses or causes to be used a unique health identifier;
(2) obtains individually identifiable health information relating to an individual; or
(3) discloses individually identifiable health information to another person,
shall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in [section 1320d–9(b)(3) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d–9/b/3&num=0&edition=prelim)) and the individual obtained or disclosed such information without authorization.
**(b) Penalties** A person described in subsection (a) shall—
(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;
(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
In this subchapter, except as specified otherwise:
(1) **Breach**
(A) *In general* — The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) *Exceptions* — The term “breach” does not include—
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at 11 So in original. Probably should be followed by “the”. same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.
(2) **Business associate** — The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(3) **Covered entity** — The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(4) **Disclose** — The terms “
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17931
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.