New Jersey Statutes Title 52. State Government, Departments and Officers 52 § 9YY-9

a. A person or entity whom the department determines has violated the provisions of section 6 of P.L.2001, c. 192 (C.52:9YY-6), regarding the disclosure of health data shall be subject, in addition to any other penalties that may be prescribed by law, to:  a civil penalty of not more than $10,000 for each such violation, but not to exceed $50,000 in the aggregate for multiple violations;  or a civil penalty of not more than $250,000, if the department finds that these violations have occurred with such frequency as to constitute a general business practice.

The penalty shall be sued for and collected in the name of the department in a summary proceeding in accordance with the “Penalty Enforcement Law of 1999,” P.L.1999, c. 274 (C.2A:58-10 et seq.).

b. The department or an entity acting on its behalf shall be liable to a person or entity injured by the intentional or negligent violation of the provisions of section 6 of P.L.2001, c. 192 (C.52:9YY-6), in an amount equal to the damages sustained by the person or entity, together with the cost of the action and reasonable attorney's fees, as determined by the court.