46 PENALTIES - FAILURE TO COMPLY Civil $100 per violation per person up to a maximum of $25,000 per person per year per standard violated Criminal Up to $50,000, 1 year in prison, or both, for inappropriate use of PHI Up to $100,000, 5 years in prison, or both for using PHI under false pretenses Up to $250,000, 10 years in prison or both, for the intent to sell or use PHI for commercial advantage, personal gain, or malicious harm  Copyright 2002 HIPAA COW Press for Glossary
{}