HIPAA violations may be punished with fines or criminally prosecuted, which could mean jail time if an individual is found guilty.
Any penalties would likely be limited to health workers or the hospital — U.S. courts have held that members of the media may publish documents even knowing they were obtained illegally.
"HIPAA does not apply to news organizations," ESPN said in a statement.