The privacy and security of health information is recognized as a critical element of transforming the health care system through the use of health information technology. As part of H.R. 1 , the American Recovery and Reinvestment Act of 2009, the 111 th Congress is considering legislation to promote the widespread adoption of health information technology (HIT), and the bill includes provisions dealing with the privacy and security of health records, and specifically authorizes state attorneys general to file lawsuits in federal court on behalf of state residents, seeking injunctive relief or civil damages against "any person" who violates HIPAA's privacy provisions. In 1996, Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to "improve portability and continuity of health insurance coverage in the group and individual markets." Congress enacted HIPAA to guarantee the availability and renewability of health insurance coverage and limit the use of pre-existing condition restrictions. HIPAA also included tax provisions related to health insurance and administrative simplification provisions requiring issuance of national standards to facilitate the electronic transmission of health information. Part C of HIPAA requires "the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." Such standards are required to be consistent with the objective of reducing the administrative costs of providing and paying for health care. These Administrative Simplification provisions require the Secretary of HHS to adopt national standards to facilitate the electronic exchange of information for certain financial and administrative transactions; select or establish code sets for data elements; protect the privacy of individually identifiable health information; maintain administrative, technical, and physical safeguards for the security of health information; provide unique health identifiers for individuals, employers, health plans, and health care providers; and to adopt procedures for the use of electronic signatures. Health plans, health care clearinghouses, and health care providers who transmit financial and administrative transactions electronically are required to use standardized data elements and comply with the national standards and regulations promulgated pursuant to Part C. Failure to comply with the regulations may subject the covered entity to civil or criminal penalties. Under HIPAA, the Secretary is required to impose a civil monetary penalty (CMP) on any person failing to comply with the Administrative Simplification provisions in Part C. The maximum civil money penalty (i.e., the fine) for a violation of an administrative simplification provision is $100 per violation and up to $25,000 for all violations of an identical requirement or prohibition during a calendar year. A number of procedural requirements that are relevant to the imposition of CMP's for violations of the Administrative Simplification standards are incorporated by reference in HIPAA from the general civil money penalty provision in 42 U.S.C. § 1320a-7a. The Secretary may not initiate a CMP action "later than six years after the date" of the occurrence that forms the basis for the CMP action. The Secretary may initiate a CMP by serving notice in a manner authorized by Rule 4 of the Federal Rules of Civil Procedure (Commencement of Action). The Secretary must give written notice to the person on whom he wishes to impose a CMP and an opportunity for a determination to made "on the record after a hearing at which the person is entitled to be represented by counsel, to present witnesses, and to cross-examine witnesses against the person." Judicial review of the Secretary's determination and the issuance and enforcement of subpoenas is available in the United States Court of Appeals. A CMP may not be imposed with respect to an act that constitutes criminal disclosure of individually identifiable information "if it is established to the satisfaction of the Secretary that the person liable for the penalty did not know, and by exercising reasonable diligence would not have known, that such person violated the provisions"; or if "the failure to comply was due to reasonable cause and not to willful neglect" and is corrected within 30 days after learning of the violation. The Secretary may provide technical assistance during such period. A CMP may be reduced or waived "to the extent that the payment of such penalty would be excessive relative to the compliance failure involved." Three specific affirmative defenses bar the imposition of civil money penalties: (1) the act is a criminal offense under HIPAA's criminal penalty provision—wrongful disclosure of individually identifiable health information; (2) the covered entity did not have actual or constructive knowledge of the violation; and (3) the failure to comply was due to reasonable cause and not to willful neglect, and the failure to comply was corrected during a 30-day period beginning on the first date the person liable for the penalty knew, or by exercising reasonable diligence would have known, that the failure to comply occurred. The Office of Civil Rights (OCR) in HHS is responsible for enforcing the Privacy Rule. OCR has said that any civil penalties imposed will only affect covered entities; in other words, a member of a workforce who is not a covered entity appears not to be subject to civil sanctions by OCR. HIPAA establishes criminal penalties for any person who knowingly and in violation of the Administrative Simplification provisions of HIPAA uses a unique health identifier or obtains or discloses individually identifiable health information. Enhanced criminal penalties may be imposed if the offense is committed under false pretenses, with intent to sell the information or reap other personal gain. The penalties include (1) a fine of not more than $50,000 and/or imprisonment of not more than 1 year; (2) if the offense is "under false pretenses," a fine of not more than $100,000 and/or imprisonment of not more than 5 years; and (3) if the offense is with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of not more than $250,000 and/or imprisonment of not more than 10 years. These penalties do not affect any other penalties that may be imposed by other federal programs. In 2005, the Justice Department Office of Legal Counsel (OLC) addressed which persons may be prosecuted under HIPAA. Based on its reading of the plain terms of the statute, the privacy regulations, and Executive Order 13,141 (To Protect the Privacy of Protected Health Information in Oversight Investigations), OLC concluded that only a covered entity could be criminally liable "in violation of this part." Because Part C applies only to covered entities and mandates compliance only by covered entities, OLC concluded that direct liability for violations of section 1320d-6 was limited to covered entities (health plans, health care clearinghouses, those health care providers specified in the statute, and Medicare prescription drug card sponsors); and depending on the facts of a given case, certain directors, officers, and employees of these entities may be liable directly under section 1320d-6, based on general principles of corporate criminal liability. Other persons who obtain protected health information in a manner that causes a covered entity to release the information in violation of HIPAA, including recipients of protected information, may not be liable directly. The liability of persons for conduct that may not be prosecuted directly under section 1320d-6 is to be determined by principles of aiding and abetting liability under 18 U.S.C. § 2 and of conspiracy liability under 18 U.S.C. § 371. OLC also noted that such conduct may also be punishable under other federal laws, such as the identity theft under 18 U.S.C. § 1028 and fraudulent access of a computer under 18 U.S.C. § 1030. The Office of Legal Counsel also considered what the "knowingly" element of the offense requires and concluded that the "knowingly" element is best read, consistent with its ordinary meaning, to require only proof of knowledge of the facts that constitute the offense. To carry out the requirements of Part C, the HIPAA Privacy Rule, 45 C.F.R. Parts 160 and 164, was adopted as the national standard for the protection of individually identifiable health information. Enforcement of the Privacy Rule began on April 14, 2003, except that for small health plans with annual receipts of $5 million or less enforcement began April 2004. The Office of Civil Rights (OCR) in HHS is responsible for enforcing the Privacy Rule. The Centers for Medicare and Medicaid Services (CMS) has delegated authority to enforce the non-privacy HIPAA standards, including the Security Rule. Because of the explicit language of HIPAA, the Privacy Rule applies only to a specified set of "covered entities": (1) health plans, (2) health care clearinghouses, and (3) health care providers who transmit information in electronic form in connection with standard transactions governed by the Administrative Simplification provisions. Medicare prescription drug sponsors were added to the list of "covered entities" in 2003. Excluded from the definition of covered entities are employees of covered entities. Business associates of covered entities are subject to certain aspects of the Privacy Rule. The Privacy Rule applies to protected health information that is individually identifiable health information "created or received by a health care provider, health plan, or health care clearinghouse" that "[r]elates to the ... health or condition of an individual" or to the provision of or payment for health care. The HIPAA Privacy Rule governs the use and disclosure of protected health information by HIPAA-covered entities (health plans, health care providers, and health care clearinghouses). The Rule requires a covered entity to obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. A covered entity is required to disclose protected health information in two situations: (1) to individuals when they request access to or an accounting of disclosures of their protected health information; and (2) to HHS for compliance review or enforcement action.