### Congress Enacts HIPAA: A Complex Legacy of Privacy and Responsibility

The **Health Insurance Portability and Accountability Act (HIPAA)** was enacted by Congress in 1996 to create vital safeguards for the privacy and protection of medical data. Essentially, HIPAA serves as a balancing mechanism between securing **protected health information (PHI)** and facilitating the necessary exchange of information to promote effective healthcare delivery. Nonetheless, years later, the law’s implementation has shown considerable discrepancies. Medical professionals encounter stringent penalties for infractions, while widespread failures amid significant data breaches often go largely unpunished.

—

### Understanding HIPAA Violations: What Do They Involve?

Infractions of HIPAA are categorized as either civil or criminal offenses, with the law specifying hefty penalties for breaches. **Civil penalties** can vary from **$25,000 to $100,000 per violation**, while criminal penalties may entail incarceration for up to **10 years**, particularly in cases of malicious intent or monetary gain.

Interestingly, historical enforcement seems to focus on **individual practitioners**, predominantly physicians, facing criminal charges, whereas corporations—including hospitals, healthcare systems, and insurers—that experience substantial data breaches due to negligence or inadequate cyber security generally evade similar consequences. This marked difference in accountability has sparked intense discussion within the healthcare and legal domains.

—

### The Surge of Data Breaches: An Ongoing Trend with Limited Accountability

Over the last five years, instances of breaches in electronic health records have surged alarmingly. Incidents of cyberattacks targeting medical facilities, health networks, and insurers occur nearly every day. While HIPAA categorizes such breaches as violations, the **magnitude and recurrence of these events have led government agencies to implement new strategies to manage them**—primarily through mandatory public reporting instead of punitive measures.

These breaches, often divulging **highly confidential patient data**, frequently lead to minimal repercussions for the organizations involved.

#### Case Study: The 2024 UnitedHealth Group Breach
In 2024, **UnitedHealth Group**, after purchasing Change Healthcare in 2023, endured the largest data breach ever recorded. This incident compromised the PHI of **191 million Americans**, exposing personal data like names, addresses, birth dates, and Social Security numbers on the dark web.

The breach was linked to **inadequate security measures** during the integration of the two companies. Additionally, it was reported that UnitedHealth Group paid tens of millions of dollars in ransom to hackers employing ransomware to penetrate their systems. Ironically, the situation was marred by hackers arguing amongst themselves over ransom distribution instead of holding the company accountable.

In spite of the breach’s severity, **no executives from Change Healthcare or UnitedHealth Group faced civil or criminal charges.** In contrast, affected individuals were merely sent legal notifications regarding the breach, while the corporations continued their operations without visible repercussions.

—

### Physicians Facing Scrutiny: A History of Legal Action

While systemic breaches involving hospitals, insurers, and healthcare organizations seldom result in criminal prosecution, **individual healthcare providers have been rigorously pursued for even minor offenses.**

#### Early Incidents
– In **2010**, **Dr. Huping Zhou**, previously a researcher at UCLA, became the first individual to serve jail time related to HIPAA violations. Dr. Zhou was found guilty of improperly accessing the medical records of colleagues and high-profile individuals out of sheer curiosity. Despite no evidence of misuse, he received a four-month prison sentence.

– In **2018**, **Dr. Rita Luthra**, a gynecologist from Massachusetts, faced prosecution for allegedly disclosing PHI to a pharmaceutical representative to facilitate medication pre-authorizations. Although there was no harm to patients, her conviction resulted in the loss of her medical license. Critics contended that the absence of a **business associate agreement**, rather than malicious intent, was the crux of her prosecution.

#### A Recent Dispute
In 2024, surgical resident **Dr. Eithan Haim** was charged with criminal HIPAA violations after providing a reporter with anonymized medical records from Texas Children’s Hospital. Dr. Haim contended that no PHI was disclosed, as patient-identifying information was redacted from the documents. His actions revealed the hospital’s misleading public position on halting gender transition care for minors while still offering these services privately.

While Dr. Haim’s case sparked considerable debate about whistleblower protections, the Department of Justice under the new administration of **President Donald Trump** ultimately dismissed the indictment in January 2025.

—

### HIPAA’s “Toothless” Nature in the Digital Age

The rapid expansion of healthcare digitization highlights the current inadequacies of HIPAA. Breaches involving PHI have impacted the majority of Americans, with **experts estimating an 85 percent probability that your personal health information is already on the dark web**.

While medical practitioners face severe penalties…