1. (a) In an action or proceeding to impose an administrative penalty or assess a civil penalty for actions related to the disclosure of individually identifiable health information, a covered entity may introduce, as mitigating evidence, evidence of the entity's good faith efforts to comply with:

   1. (1) state law related to the privacy of individually identifiable health information; or
   2. (2) the Health Insurance Portability and Accountability Act and Privacy Standards.

2. (b) In determining the amount of a penalty imposed under other law in accordance with Section 181.202, a court or state agency shall consider the following factors:

   1. (1) the seriousness of the violation, including the nature, circumstances, extent, and gravity of the disclosure;
   2. (2) the covered entity's compliance history;
   3. (3) whether the violation poses a significant risk of financial, reputational, or other harm to an individual whose protected health information is involved in the violation;
   4. (4) whether the covered entity was certified at the time of the violation as described by Section 182.108;
   5. (5) the amount necessary to deter a future violation; and
   6. (6) the covered entity's efforts to correct the violation.
3. (c) On receipt of evidence under Subsections (a) and (b), a court or state agency shall consider the evidence and mitigate imposition of an administrative penalty or assessment of a civil penalty accordingly.

Added by Acts 2003, 78th Leg., ch. 924, Sec. 7, eff. Sept. 1, 2003.

Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 10, eff. September 1, 2012.