2

Years ago (about 2001) I read a USC statute that stated that the fine for negligent storage of social security number could result in a $10k 'per record' fine.

I have been looking for this USC or anything like it now and find nothing.

What is the CFR code or USC federal statute that implements a fine for negligent storage social security numbers (private personal data) on a database or computer, especially pertaining to HIPAA?

Improve this question

1 Answer 1

Reset to default
0

It's hard to prove nonexistence when it comes to federal law, but as far as I can tell there is no federal fine for negligently storing a social security number. States are another matter, though most state laws pertain to sending material with a social security number on it (see this report on Connecticut law and associated fines). HIPAA also requires that personal information be stored securely, and a social security number (and all sorts of other information) would be an example of protected information. There is a civil penalty of $100 for an unknowing violation, a disclosure that the entity is unaware of and could not have realistically avoided, had a reasonable amount of care had been taken to abide by HIPAA Rules. For "willful neglect" the penalty is $10K minimum (here is the rule, and the part of CFR that gives these amounts is 45 CFR 160.404).

Improve this answer
3
  • 1
    See law.cornell.edu/cfr/text/45/102.3 - some of those penalties have been adjusted for inflation and are now slightly higher. $100 has been increased to $112 and $10,000 has been increased to $11,182, and will probably go up again once the government figures out what the COL increase was for last year. (As a side note, I find it amazing that there is ANY fine when "it is established that the covered entity or business associate did not know and by exercising reasonable diligence, would not have known that the covered entity or business associate violated such a provision.")
    – D M
    Commented Jan 1, 2018 at 23:38
  • Thats what i was looking for. I'm still curious about the old statute i read years ago. I remember the context very vividly. It was a little hash. I suppose thats why it got tossed.
    – NIX
    Commented Jan 1, 2018 at 23:39
  • @DM Thank you! I recall when they first wrote the early laws, they were just trying to find a way to plug the hole and many non technical people were writing the laws. Lots of changes since.
    – NIX
    Commented Jan 1, 2018 at 23:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .