Bill > AB439

This bill amends Section 56.36 of the Civil Code to clarify and strengthen penalties for violations related to health care information. It allows individuals to sue for damages if their confidential health information is negligently released, and establishes significant administrative fines and civil penalties for entities and individuals who knowingly and willfully obtain, disclose, or use medical information improperly, especially for financial gain. The bill also introduces an affirmative defense for covered entities and business associates, as defined by federal law (HIPAA), if they demonstrate they took reasonable steps to protect information, followed notification obligations, and took corrective actions after a breach, provided the release was not due to medical identity theft. This affirmative defense can limit liability, though it does not preclude the recovery of actual damages and attorney's fees. The bill also outlines how civil penalties are assessed and collected by various legal authorities and specifies that these penalties do not prevent other legal sanctions.