§ 90-113.75.  Civil penalties; other remedies; immunity from liability.

(a) A person who intentionally, knowingly, or negligently releases, obtains, or attempts to obtain information from the system in violation of a provision of this Article or a rule adopted pursuant to this Article shall be assessed a civil penalty by the Department not to exceed ten thousand dollars ($10,000) per violation and shall be temporarily barred from accessing the system until further findings by the Department. The clear proceeds of penalties assessed under this section shall be deposited to the Civil Penalty and Forfeiture Fund in accordance with Article 31A of Chapter 115C of the General Statutes. The Commission shall adopt rules establishing the factors to be considered in determining the amount of the penalty to be assessed.

(b) In addition to any other remedies available at law, an individual whose prescription information has been disclosed in violation of this Article or a rule adopted pursuant to this Article may bring an action against any person or entity who has intentionally, knowingly, or negligently released confidential information or records concerning the individual for either or both of the following:

(1) Nominal damages of one thousand dollars ($1,000). In order to recover damages under this subdivision, it shall not be necessary that the plaintiff suffered or was threatened with actual damages.

(2) The amount of actual damages, if any, sustained by the individual.

(c) Notwithstanding the foregoing, G.S. 8-53, G.S. 75-65, or any other provision of international, federal, State, or local law, a practitioner as defined in G.S. 90-87, a dispenser, or other person or entity permitted access to or required or permitted to submit or transmit reports or other records, data, or information, including, without limitation, any protected health information or any other individually identifying or personal information, under this Article that, in good faith, submits or transmits such reports or other records, data, or information as required or allowed by this Article is immune from civil or criminal liability that might otherwise be incurred or imposed as a result of submitting or transmitting such reports or other records, data, or information, or as a result of any subsequent actual or attempted access to or use or disclosure of such reports or other records, data, or information, whether by the Department, any law enforcement officer or agency, or any other person or entity. (2005-276, s. 10.36(a); 2013-152, s. 4; 2013-410, s. 18.5; 2018-44, s. 12.)