The criminal penalties for improperly disclosing patient health information can be as high as fines of $250,000 and prison sentences of up to 10 years.

Under HIPAA's criminal enforcement provisions (42 U.S.C. 1320d-6), intentional disclosure of PHI for personal gain or malicious harm can result in fines up to $250,000 and imprisonment up to 10 years. These tiered criminal penalties escalate based on the intent and severity of the violation, with the highest tier applying to offenses committed with intent to sell, transfer, or use PHI for commercial advantage or malicious harm.

This is false because federal statute explicitly authorizes criminal penalties of up to $250,000 and 10 years imprisonment for the most serious HIPAA violations involving wrongful disclosure of PHI.