Jail is on the table if you purposefully steal the data. I was interested so searched for examples of actual HIPAA jail time, and in all the cases I could find the conduct was egregious and with clear intent (e.g. https://mazarsusa.com/ledger/jail-time-for-a-hipaa-violation... ). Misconfiguring your S3 buckets isn't going to hit that level, though that could still result in a hefty fine. This of course all assumes that the AI company got access to the data legally to begin with.

The article is about auto accident claims data, which is a great clue that HIPAA actually doesn't apply. From a different part of the Internet[1]:

"There are certain gaps [in HIPAA coverage], like if a person meets with an accident on a car; the health insurer as well as the auto insurer shall receive the medical bills of that person. The health insurer is responsible for protecting the health data of this person under HIPAA; the auto insurer on the other hand does not hold that duty."

[1] https://www.andrealopezv.com/new-age-security-solutions-to-p...

The company is almost certainly not a covered entity, and therefore HIPAA doesn't apply.

The amount of bullshit stated around HIPAA is ridiculous