In the US as well, there are severe civil penalties under the Health Insurance Portability Accountability Act (HIPAA) of up to $50,000 for single incident, as well as potential criminal penalties. Unfortunately, you have to rely on the Department of Health & Human Services (DHHS) or Justice Department to enforce the HIPAA, there is no private right of action under federal law and you don't get any part of the money recovered, it's a fine that goes the Treasury, so you don't get anything to compensate you for the injury. However, there may be claims under state law as well, depending on the state.
DeeDee