Fines can be up to $250,000 for violations or imprisonment up to 10 years for knowing abuse or misuse of individual health information.