1. (a) The attorney general may institute an action for injunctive relief to restrain a violation of this chapter.

2. (b) In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter. A civil penalty assessed under this section may not exceed:

   1. (1) $5,000 for each violation that is committed negligently and that occurs in a single year, regardless of how long the violation continues during that year;
   2. (2) $25,000 for each violation that is committed knowingly or intentionally and that occurs in a single year, regardless of how long the violation continues during that year; or
   3. (3) $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.

Added by Acts 2025, 89th Leg., R.S., Ch. 1002 (S.B. 1188), Sec. 1, eff. September 1, 2025.