for the latest on HIPAA enforcement statistics by OCR click over to Mike Cassidy's post at the Med Law Blog: HIPAA Criminal Verdict and Enforcement Statistics. The post also contains some stats on the number of matters reported to the DOJ for investigation.
The post includes a summary of United States v. Ferrer, S.D. Fla., No. 06-CR-60261-CR-Cohn, the first criminal HIPAA verdict entered in January 2007. The case involved the wrongful disclosure of individually identifiable health information and identity theft of 1,100 patients from the Cleveland Clinic which were used to fraudulently bill Medicare claims to the tune of $7M.