Manifesto, read the manifesto
Screenata
All answers

Beyond SOC 2

Can a person go to jail for violating HIPAA?

September 14, 20262 min read

Can you go to jail for violating HIPAA?

Yes. HIPAA has criminal penalties, including prison sentences of up to ten years, for knowingly obtaining or disclosing individually identifiable health information without authorization. They are set out in 42 U.S.C. 1320d-6 and prosecuted by the Department of Justice. Criminal cases are rare, and they require a knowing act. Most HIPAA enforcement is civil, run by the HHS Office for Civil Rights, and ends in fines and corrective action plans rather than prison.

The criminal penalty tiers

These tiers apply to individuals as well as organizations. The HITECH Act of 2009 made clear that employees of covered entities, not just the entities themselves, can be prosecuted. The first federal prison sentence for a HIPAA violation came in 2010: a former UCLA Health System researcher received four months after pleading guilty to misdemeanor counts of reading patient records without authorization. He had not sold or used the information.

Civil penalties, where most enforcement happens

Civil penalties do not require intent. They scale with culpability, from violations the organization could not have known about to willful neglect that was never corrected.

The annual caps apply per identical violation type per calendar year, and the lower caps for tiers 1 to 3 come from OCR's 2019 notice of enforcement discretion. HHS adjusts all amounts for inflation each year; the 2026 figures apply to penalties assessed on or after January 28, 2026. In practice, most OCR investigations close with technical assistance or a resolution agreement: a payment plus a multi-year corrective action plan that OCR monitors.

What actually gets organizations penalized

The pattern in OCR's published resolution agreements is consistent. The most common finding is the absence of an accurate, current risk analysis, followed by missing access controls, no audit logging, and no business associate agreement with a vendor handling PHI. These are documentation and process failures more often than technical breaches.

For a SaaS company handling PHI as a business associate, the practical exposure is civil and contractual: OCR penalties, breach notification costs, and a covered-entity customer terminating the contract. Criminal liability attaches to people who knowingly misuse the data. For which obligations apply to a SaaS vendor, see what HIPAA compliance means for a SaaS company.

Related questions

Beyond SOC 2

How do fintech companies handle SOC 2 plus PCI DSS evidence?

Fintech companies handle dual SOC 2 and PCI DSS compliance by building a shared control foundation (access controls, encryption, change management) and adding PCI-specific requirements on top, cardholder data environment scoping, network segmentation, vulnerability scanning, and PCI-specific encryption standards.

Beyond SOC 2

How do I add HIPAA to my existing SOC 2 program?

Adding HIPAA to an existing SOC 2 program takes 1-2 months. Your SOC 2 controls already cover most HIPAA Security Rule requirements. The main additions are a Business Associate Agreement template, PHI data mapping, breach notification procedures, and privacy-specific controls for patient data handling.

Beyond SOC 2

How do I automate evidence collection across multiple frameworks?

Automate cross-framework evidence collection by collecting evidence once and mapping it to multiple frameworks. A single MFA screenshot satisfies SOC 2 CC6.1, ISO 27001 A.9.4, and HIPAA §164.312(d). Use tools that support multi-framework mapping to avoid collecting the same evidence multiple times.

Connect and see

See your SOC 2 with your real systems.

Connect GitHub and cloud read-only. Vera shows your control matrix, policy gaps, and prioritized next actions before you commit to anything.