Are you suggesting that invasion of privacy become a criminal offense? Effectively, that's what happened here, and even though its Uber, its individuals who did it. Your neighbor could do it to you as well. This seems like a slippery slope of criminalizing far too much.

For example, maybe Nick Denton should have gone to jail for invasion of privacy against Hulk Hogan? I don't agree with that either.

Except in this case we're talking about private medical records. There is no way for them to have gotten those legally. They had to have bribed someone or coerced someone to get them, and that certainly is a crime.

Violating HIPAA and PII when your a company carries steep penalties; why not against individuals as well?

HIPAA's civil and criminal penalties already apply to individuals.

OTOH, Uber and it's employees are not HIPAA covered entities, nor, generally, are doctors in India. So I don't see how anyone could have violated HIPAA here.

I appreciate you taking the time to point out loopholes that need fixing.

I don't think that HIPAA not applying outside of the United States is a loophole. Each country is a different environment, and the laws need to be tailored for the environment.

There seems to be an insatiable need for Americans or Westerners to project their laws/moralities to other countries, and then refuse the accept the reverse, except for certain cultural minorities logical inconsistencies.

The US extends sex trafficking laws outside the country. Why not other laws?

How exactly do they do that? Do they extend the american laws outside our borders and let our police raid international sites without international knowledge/assistance?

Mainly because our laws are voted on by our own citizens and because the rest of the world doesn't accept our laws and doesn't have a say in creating them. Your statement seems nonsensical.

If there is an action that breaks the law of two countries there can be joint law enforcement activities. The US cannot punish actions that are legal in one country but illegal in the United States by acting in that foreign country.

If you leave the US and engage in underage sex tourism, you will be prosecuted upon return.

https://www.justice.gov/criminal-ceos/extraterritorial-sexua...

Also, the US government will arrest you on US soil or while transiting an airport in the US for certain crimes that take place outside the US.

My post you replied to said "sex trafficking"; I meant sex tourism. Mea culpa.

Sure, and the point is that HIPAA is only applicable to the health organization. If you were to sue somebody under HIPAA, it would be the records organization, for exposing information it shouldn't have, or not logging the access to information properly.

However, in this case, HIPAA wouldn't apply to a purely Indian health organization, or the records of a foreign national in a foreign organization.

Note that in your situation (sex tourism) all prosecution/wrong doing is based on being a US citizen doing stuff and then returning to US soil. It does not apply to any sort of foreign national - you cannot be prosecuted for sex tourism under the US statute while on US soil if you are not a US national and the crime did not occur on US soil.

Why mention individuals? This wasn't something dudeface did for his own entertainment. It was done specifically because the rapist was an uber driver. This was a company mishandling HIPAA data in that they never should have had access to it in the first place, let alone been sharing it around the exec staff like a pulp comic.

I will say this clearly and I mean it: If you use uber, or you work for uber, you are morally wrong. You are choosing to enrich people and a company who have shown you multiple times that they are terrible human beings who lack even the concept of a moral compass.