...up to 25 years and be required to pay fines of up to $250,000 if they disclose protected health information for maliciouspurposes or for financial gain. The HIPAA regulation covers two basic elements, privacy and security and compliance deadlines...
http://www.findwhitepapers.com/whitepaper697/