• Tabloids will often pay money for the medical records of stars.newspaper image by Photoeyes from Fotolia.com
  
  The malicious act of violating Health Insurance Portability and Accountability Act (HIPAA) regulations is a type of "willful neglect" as defined by the Act. The violation of HIPAA regulations is a serious crime, especially in the case of willful neglect or malicious intent. Like every crime, this carries penalties, both civil and criminal. If you have any questions concerning HIPAA violations, please contact a lawyer that specializes in HIPAA.
  
  

Fines

• The fine for willful neglect is $50,000 per violation with an annual maximum of $1.5 million. Persons who commit offenses under false pretenses can be fined $100,000 per violation. Violations of HIPAA regulations for commercial advantage or for payment are punishable with a $250,000 fine.
  
  

Imprisonment

• Certain persons can prosecuted for the release of information. These persons are the directors and employees of any organization that is required by HIPAA to protect information, such as hospitals and insurance companies. If any person releases HIPAA-protected information, he can be imprisoned for up to a year. Persons who commit offenses under false pretenses can be imprisoned for up to five years. Violations of HIPAA regulations that are made for commercial advantage or for payment are punishable with up to 10 years in prison.
  
  

Correction of Malicious Offenses

• The state Secretary of State usually has the ability to waive civil penalties in the case of HIPAA violations, except in the case of willful neglect. In order for the Secretary of State to waive the penalties, the health care provider or insurance company has to correct the circumstance within 30 days. For the malicious release of information in violation of HIPAA regulations, there is no period in which the offense can be corrected. Therefore, no penalties can be waived.
  
  

Definition of Malicious Offenses

• A malicious offense is any offense where a person willfully and with the intent to harm releases information that is required to be protected under HIPAA regulations. This does not extend to any information that is accidentally leaked because of computer or employee error. It is not required that a person or organization know that their actions are in direct violation of an HIPAA regulation.