Can a health plan be fined for leaking my health information?

Yes. As the statute is written, the civil penalty for violating the federal health privacy rules reaches $50,000 for each violation, up to $1,500,000 a year for violations of the same requirement (42 U.S.C. § 1320d-5(a)(3)(D)). And the health information the law protects is information “whether oral or recorded in any form or medium” (42 U.S.C. § 1320d(4)), so paper is covered as well as computers.