The criminal consequences possible with a Tier 3 violation – wrongfully and knowingly obtaining PHI for personal gain, commercial advantage, or with malicious intent – are up to ten years in jail and/or a fine of up to $250,000. These penalties are pursued by the Department of Justice rather than HHS´ Office for Civil Rights.