HITECH Act 13409: Section 13409: criminal penalties reach any person, including an employee, who obtains or discloses protected health information without authorization

Section 1177(a) of the Social Security Act is amended so that a person, including an employee or other individual, is considered to have obtained or disclosed individually identifiable health information in violation of the HIPAA criminal provision if the information is maintained by a covered entity and the individual obtained or disclosed it without authorization, closing the argument that the criminal provision applies only to covered entities.