Anyone who discloses an individual's nonpublic personal information maintained by a government agency is subject to civil action and penalties by the individual.
A licensed dentist who fails to release the dental records of a patient (accompanied by that patient's written authorization for release of record to the board) within 15 days of receiving the request and authorization, shall pay to the board a civil penalty unless the licensee is unable to provide the documents within this time period for good cause.
If a clinic, health facility, home health agency, or hospice fails to report any unlawful or unauthorized access to, use or disclosure of a patient's medical information to the Department of Public Health or to the affected patient, the department may assess the licensee a penalty in the amount of one hundred dollars ($100) for each day that the unlawful or unauthorized access is not reported, following the initial five-day period. The total combined penalty assessed by the department shall not exceed two hundred fifty thousand dollars ($250,000) per reported event.
The Director of the Department of Managed Health Care may suspend or revoke any license issued to a health care service plan or assess administrative penalties if the licensee has committed any of the acts or omissions constituting grounds for disciplinary action, including (1) violating the Confidentiality of Medical Information Act or (2) violating the legal requirements for post-stabilization care, which includes providing relevant information reasonably necessary for the health care service plan to authorize post-stabilization care or assume management of the patient's care by prompt trans
