New Jersey § 52:9yy-9

§ 52:9yy-9.

a. A person or entity whom the department determines has violated the provisions of section 6 of P.L.2001, c. 192 ( C.52:9YY-6 ), regarding the disclosure of health data shall be subject, in addition to any other

penalties that may be prescribed by law, to: a civil penalty of not more than $10,000

for each such violation, but not to exceed $50,000 in the aggregate for multiple violations;

or a civil penalty of not more than $250,000, if the department finds that these violations have occurred with such frequency as to constitute a

general business practice. The penalty shall be sued for and collected in the name of the department in a summary proceeding in accordance with the “Penalty Enforcement Law of 1999,” P.L.1999, c. 274 ( C.2A:58-10 et seq. ). b. The department or an entity acting on its behalf shall be liable to a person or entity injured by

the intentional or negligent violation of the provisions of section 6 of P.L.2001, c. 192 ( C.52:9YY-6 ), in an amount equal to the damages sustained by the person or entity, together with

the cost of the action and reasonable attorney's fees, as determined by the court.