123STA T . 2 74PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9(B)inpar a g rap h ( 2 ) , a s s o r ed esigna t ed — (i)ins ub paragraph ( A ),b y stri k ing ‘ ‘in subpara - graph (B), a pena l ty m ay not be imposed under sub- se c tion (a) i f’ ’ and all that follo w s through ‘‘the failure to comply is corrected’’ and inserting ‘‘in subparagraph (B) or subsection (a)( 1 )( C ), a penalty may not be imposed under subsection (a) if the failure to comply is corrected’’
and (ii) in subparagraph (B), by striking ‘‘(A)(ii)’’ and inserting ‘‘(A)’’ each place it appears . ( 4 ) EF F ECTIV E DA TE.— T he amendments made by this sub- section shall apply to v iolations occurring after the date of the enactment of this title. (e) E N F OR CE M ENT T H RO UG H S TATE ATTORNE YSG ENERA L .— (1) I N GENERAL.—Section 11 76 of the Social Security Act (42 U .S.C. 1 3 2 0 d –5 ) is amended by adding at the end the following new subsection
‘‘(d) ENFORCEMENT B Y STATE ATTORNEYS GENERAL.— ‘‘(1) CIVIL ACTION.—E x cept as provided in subsection (b), in any case in which the attorney general of a State has reason to believe that an interest of one or more of the residents of that State has been or is threatened or adversely affected by any person who violates a provision of this part, the attorney general of the State, as parens patriae, may bring a civil action on behalf of such residents of the State in a district court of the United States of appropriate j urisdiction— ‘‘(A) to enjoin further such violation by the defendant; or ‘‘(B) to obtain damages on behalf of such residents of the State, in an amount e q ual to the amount determined under paragraph (2). ‘‘(2) STATUTORY DAMAGES.— ‘‘(A) IN GENERAL.— F or purposes of paragraph (1)(B), the amount determined under this paragraph is the amount calculated by multiplying the number of violations by up to $ 100. For purposes of the preceding sentence, in the case of a continuing violation, the number of violations shall be determined consistent with the H I P AA privacy regulations (as defined in section 11 8 0(b)(3)) for violations of subsection (a). ‘‘(B) L IMITATION.—The total amount of damages imposed on the person for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000. ‘‘(C) R EDUCTION OF DAMAGES.—In assessing damages under subparagraph (A), the court may consider the factors the Secretary may consider in determining the amount of a civil money penalty under subsection (a) under the HIPAA privacy regulations. ‘‘(3) ATTORNEY FEES.—In the case of any successful action under paragraph (1), the court, in its discretion, may award the costs of the action and reasonable attorney fees to the State. ‘‘(4) N OTICE TO SECRETARY.—The State shall serve prior written notice of any action under paragraph (1) upon the Secretary and provide the Secretary with a copy of its com- plaint, except in any case in which such prior notice is not Records.
