§ 52:9YY-9 — Penalties for unauthorized disclosures; liability of department.

9. a. A person or entity whom the department determines has violated the provisions of section 6 of P.L.2001, c.192 (C.52:9YY-6), regarding the disclosure of health data shall be subject, in addition to any other penalties that may be prescribed by law, to: a civil penalty of not more than $10,000 for each such violation, but not to exceed $50,000 in the aggregate for multiple violations; or a civil penalty of not more than $250,000, if the department finds that these violations have occurred with such frequency as to constitute a general business practice. The penalty shall be sued for and collected in the name of the department in a summary proceeding in accordance with the "Penalty Enforcement Law of 1999," P.L.1999, c.274 (C.2A:58-10 et seq.). b. The department or an entity acting on its behalf shall be liable to a person or entity injured by the intentional or negligent violation of the provisions of section 6 of P.L.2001, c.192 (C.52:9YY-6), in an amount equal to the damages sustained by the person or entity, together with the cost of the action and reasonable attorney's fees, as determined by the court. L.2001, c.192, s.9; amended 2010, c.87, s.17.