Sec. 181.205. MITIGATION. (a) In an action or proceeding to impose an administrative penalty or assess a civil penalty for actions related to the disclosure of individually identifiable health information, a covered entity may introduce, as mitigating evidence, evidence of the entity's good faith efforts to comply with:
(1) state law related to the privacy of individually identifiable health information; or
(2) the Health Insurance Portability and Accountability Act and Privacy Standards.
(b) In determining the amount of a penalty imposed under other law in accordance with Section 181.202, a court or state agency shall consider the following factors:
(1) the seriousness of the violation, including the nature, circumstances, extent, and gravity of the disclosure;
(2) the covered entity's compliance history;
(3) whether the violation poses a significant risk of financial, reputational, or other harm to an individual whose protected health information is involved in the violation;
(4) whether the covered entity was certified at the time of the violation as described by Section 182.108;
(5) the amount necessary to deter a future violation; and
(6) the covered entity's efforts to correct the violation.
(c) On receipt of evidence under Subsections (a) and (b), a court or state agency shall consider the evidence and mitigate imposition of an administrative penalty or assessment of a civil penalty accordingly.
Added by Acts 2003, 78th Leg., ch. 924, Sec. 7, eff. Sept. 1, 2003.
Amended by:
Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 10, eff. September 1, 2012.