PUBLIC LAW 104-191—AUG. 21, 1996 110 STAT. 2029 exercising reasonable diligence would not have known, that such person violated the provision. "(3) FAILURES DUE TO REASONABLE CAUSE.— "(A) IN GENERAL.— Except as provided in subparagraph (B), a penalty may not be imposed under subsection (a)if— "(i) the failure to comply was due to reasonable cause and not to willful neglect; and "(ii) the failure to comply is corrected during the 30-day period beginning on the first date the person Uable for the penalty knew, or by exercising reasonable dihgence would have known, that the failure to comply occurred. "(B) EXTENSION OF PERIOD.— "(i) No PENALTY.— The period referred to in subpar^raph (A)(ii) may be extended as determined appropriate by the Secretary based on the nature and extent of the failure to comply. "(ii) ASSISTANCE.— I f the Secretary determines that a person failed to comply because the person was unable to comply, the Secretary may provide technical assistsuice to the person during the period described in subpgiragraph (A)(ii). Such assistance shall be provided in any manner determined appropriate by the Secretary. "(4) REDUCTION.— In the case of a failure to comply which is due to reasonable cause and not to willful neglect, any penalty under subsection (a) that is not entirely waived under paragraph (3) may be waived to the extent that the payment of such penalty would be excessive relative to the compliance failure involved. " WRONGFUL DISCLOSURE OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION "SEC. 1177. (a) OFFENSE.— A person who knowingly and in 42 USC i320d-6. violation of this part— "(1) uses or causes to be used a unique health identifier; "(2) obtains individually identifiable health information relating to an individual; or "(3) discloses individually identifiable health information to another person, shall be pimished as provided in subsection (b). "(b) PENALTIES. —^A person described in subsection (a) shall— "(1) be fined not more than $50,000, imprisoned not more than 1 year, or both; "(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and "(3) if the offense is committed with intent to sell, trginsfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both. "EFFECT ON STATE LAW "SEC. 1178. (a) GENERAL EFFECT.— 42 USC i320d-7.
�
