The penalty for knowingly releasing protected health information (PHI) in violation of HIPAA's Privacy Rule can range from a fine of up to $50,000 and up to one year in prison to $250,000 and up to 10 years in prison, depending on the nature and extent of the violation:
Tier 1
Deliberately obtaining and disclosing PHI without authorization
Penalty: Up to $50,000 fine and up to one year in prison
Tier 2
Obtaining PHI under false pretenses
Tier 3
Obtaining PHI for personal gain or with malicious intent