us-constitution federal-courts statutes digital-forensics
what are the fines for negligent administration of social security numbers?
<p>Years ago (about 2001) I read a USC statute that stated that the fine for negligent storage of social security number could result in a $10k 'per record' fine.</p>
<p>I have been looking for this USC or anything like it now and find nothing.</p>
<p>What is the CFR code or USC federal statute that implements a fine for negligent storage social security numbers (private personal data) on a database or computer, especially pertaining to HIPAA?</p>

<p>It's hard to prove nonexistence when it comes to federal law, but as far as I can tell there is no federal fine for negligently storing a social security number. States are another matter, though most state laws pertain to sending material with a social security number on it (see <a href="https://www.cga.ct.gov/2011/rpt/2011-R-0369.htm" rel="nofollow noreferrer">this report</a> on Connecticut law and associated fines). HIPAA also requires that personal information be stored securely, and a social security number (and all sorts of other information) would be an example of protected information. There is a civil penalty of $100 for an unknowing violation, a disclosure that the entity is unaware of and could not have realistically avoided, had a reasonable amount of care had been taken to abide by HIPAA Rules. For "willful neglect" the penalty is $10K minimum (here is <a href="https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf" rel="nofollow noreferrer">the rule</a>, and the part of CFR that gives these amounts is <a href="https://www.law.cornell.edu/cfr/text/45/160.404" rel="nofollow noreferrer">45 CFR 160.404</a>).</p>
