Title: Describe penalties related to data breaches.
Course: Health Informatics (14157-I) > Section: Exploring Laws and Requirements Regarding Data Breaches

Description should include

- civil penalties for
  - violations that the entity did not know about and would not have known about by exercising reasonable diligence
  - violations due to “reasonable cause”
  - violations due to “willful neglect” corrected within 30 days
  - violations due to “willful neglect” not corrected within 30 days

- criminal penalties pursuant to HIPAA, resulting from
  - knowing misuse of unique health identifiers
  - knowing and unpermitted acquisition or disclosure of PHI

- professional consequences (e.g., loss of license, certifications, etc.).

Teacher Resource: Chapter 7: Breach Notification, HIPAA Enforcement, and Other Laws and Requirements (https://www.healthit.gov/sites/default/files/pdf/privacy/privacy-and-security-guide-chapter-7.pdf), The Office of the National Coordinator for Health Information Technology

Process/Skill Questions:

- What are the penalties for violating HIPAA?
- What is the difference between civil and criminal law?
- What is the difference between intentional and inadvertent disclosure of healthcare information?