D.C. Mun. Regs. tit. 29, r. 29-3005
A person who negligently uses or discloses HHSI in a manner not authorized by the Act or other District law shall be liable in an amount of five hundred dollars ($500) for each violation.
For purposes of this section, "negligently" means that a person guided by ordinary considerations should have known, and by exercising reasonable diligence would have known, that the use or disclosure was not authorized.
A person who willfully uses or discloses HHSI in a manner not authorized by the Act or other District law shall be liable in an amount of one thousand dollars ($1,000) for each violation.
A person who knowingly obtains, uses, or discloses HHSI in a manner not authorized by the Act or other District law shall be guilty of a misdemeanor, and upon conviction, shall be fined not more than two thousand five hundred dollars ($2,500), imprisoned not more than sixty (60) days, or both. If the offense is committed through deception or theft, the person shall be guilty of a misdemeanor and shall be fined not more than five thousand dollars ($5,000), imprisoned for not more than one hundred eighty (180) days, or both.
If a civil or criminal penalty imposed by another law applies to an action that is also subject to a civil or criminal penalty under the Act, the greater penalty shall apply.
D.C. Mun. Regs. tit. 29, r. 29-3005