• Establishes criminal and civil  penalties for improper use of medical records

  For intentional disclosure of records without consent of the patient -- up to $50,000 and one year in prison. For disclosure with intent to sell the data -- up to $250,000 and 10 years in prison. Also, civil penalties of $100 per person for unintentional disclosures and other violations (up to $25,000 per person per year). 
  
  

• Balances public safety with personal privacy

  Clearly, personal privacy must be balanced with concerns for public health, such as preventing the epidemic spread of serious or life-threatening infectious diseases. In response, the new regulations require that personal medical information may be disclosed only for public health priorities and responsible medical research purposes. In addition, the regulations encourage health care professionals to disclose records in forms that do not reveal the identities of the patients whenever possible.
  
  

• Since medical records are often necessary for investigation of criminal activity and protection of public safety, the regulations do allow for their disclosure to certified law enforcement agencies.

Good start, but more protections needed, President Clinton says
In announcing the medical information privacy rules, President Clinton issued a statement in which he called for Congress to extend the effectiveness of federal privacy protections by passing laws to: "strengthen penalties and to create a private right of action so citizens can hold health plans and providers accountable for inappropriate and harmful disclosures of information; extend privacy protections to cover other entities that routinely handle sensitive medical information, such as life insurers and worker's compensation programs; and to place appropriate limits on the re-use of medical information by other entities."