I must respectfully disagree with your conclusions regarding the NYT and violations of HIPAA.
First and foremost, the NYT is neither a “covered entity” nor a “business associate” of a covered entity. HIPAA’s Privacy Rule doesn’t apply.
Second, even if the NYT were a covered entity (and it’s not) the possibility of increased newspaper sales or advertising revenue, or helping in the election of the newspaper’s favorite son (as if the newspaper had a vote) is not what HIPAA means by commercial advantage, personal gain, or malicious harm.
Other healthcare privacy laws (most states had state privacy laws before the enactment of HIPAA) are unlikely to affect the NYT given its First Amendment protections unless the NYT retained somebody to obtain the information. If the NYT simply received it and published it . . . the NYT is unlike to be in violation of any state healthcare privacy law.
However, the human slimewad who accessed the medical records and passed on the information violated state and federal privacy laws.
HIPAA rules can’t be washed like drug money.
The NYT can not violate via proxie any more than a thief can legitimatly sell stolen property. If the NYT obtained the information via a violation of the HIPAA rules the first amendment does not give NYT cart blanche for stupidity.
I went back and looked and I’m not sure I agree with you. Lots of places it talks about covered persons and entities and there are other penalty sections. This penalty section is different especially since it applies to “any person”. Not any person who is covered by the act or works for a covered entity. If I don’t work for a covered entity and I steal your medical records and sell them to the NY Times then by your logic I’d be home free except for the theft angle. The actual value of the paper file is questionable especially if I copied it rather than taking the file itself.
Drudge BTW has changed his link it no longer uses the word expose. It now says: “NYT PREPARES TO FRONT DETAILED STORY ON PALIN’S BABY, NEWSROOM SOURCES TELL DRUDGE... DEVELOPING...” That takes away the negative connotation of expose, but it still might include medical record info maybe on the baby.