The attorney general of a state may bring a civil action in federal district court on behalf of residents whose interests are threatened or adversely affected by a HIPAA violation, to enjoin the violation and to obtain statutory damages of up to $100 per violation capped at $25,000 per calendar year for violations of an identical requirement, with the court able to award costs and attorney fees; the state gives the Secretary prior notice and the Secretary may intervene, a state may not sue while a federal action on the same violation is pending, and the civil money penalty limitation period applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.