Fines or penalties can rise to $250,000 for violations or imprisonment up to 10 years for knowing abuse or mishandling of individual health information.