To date, the penalties imposed on Covered Entities have been civil penalties. The only criminal penalties for violations of HIPAA have been for the individuals responsible for the violations; and, although these are rare, there have been cases in which employees of Covered Entities have been sentenced to up to six years in jail. Nonetheless, in extreme circumstances of willful neglect, it is possible that the Office for Civil Rights refer a case to the Department of Justice.