1. Except as otherwise provided in subsection 2:

(a) A person responsible for overseeing a health care plan for a group purchaser shall not disclose data made available to the person pursuant to NRS 695C.326 to any other person except for a person responsible for making decisions about the health care plan.

(b) A person responsible for making decisions about a health care plan for a group purchaser shall not further disclose data disclosed to the person pursuant to paragraph (a) to any other person except for another person responsible for making decisions about the health care plan.

2. A person described in subsection 1 may disclose data made available to the person pursuant to that subsection or NRS 695C.326 to another person not described in that subsection if:

(a) The health maintenance organization that provided the data agrees to the disclosure; or

(b) The disclosure is ordered by a court of competent jurisdiction.

3. Except as otherwise provided in subsections 4 to 7, inclusive, the Commissioner shall impose against any person who violates the requirements of this section:

(a) If the person did not know of the violation and would not have known about the violation if he or she had exercised reasonable diligence, an administrative penalty of not less than $100 and not more than $50,000 per violation.

(b) If the person knew of the violation or should have known about the violation if he or she had exercised reasonable diligence but the violation is not due to willful neglect, an administrative penalty of not less than $1,000 and not more than $50,000 per violation.

(c) If the violation is due to willful neglect, an administrative penalty of $50,000 per violation.

4. If a person who violates the requirements of this section corrects the violation not later than 30 days after the person knew of the violation or should have known of the violation if he or she had exercised reasonable diligence, or another date determined by the Commissioner, the Commissioner:

(a) Shall not impose an administrative penalty if the violation is not due to willful neglect.

(b) Except as otherwise provided in subsection 5, shall impose an administrative penalty of not less than $10,000 and not more than $50,000 per violation if the violation is due to willful neglect.

5. Administrative penalties imposed pursuant to this section against a person must not exceed $1,500,000 in a calendar year.

6. The Commissioner:

(a) Shall make a determination of the amount of an administrative penalty imposed pursuant to this section based upon the nature and extent of the violation and the harm resulting from the violation; and

(b) May reduce any administrative penalty imposed for a violation of the requirements of this section, other than a violation due to willful neglect, if the Commissioner determines that the amount prescribed by subsection 3 is excessive.

7. The Commissioner shall not impose an administrative penalty for a violation for which a penalty has been imposed pursuant to subsection 8.

8. Any person who knowingly violates the requirements of this section:

(a) Except as otherwise provided in paragraphs (b) and (c), is guilty of a gross misdemeanor and may be fined not more than $50,000.

(b) If the violation is committed under false pretenses, is guilty of a category C felony and shall be punished as provided in NRS 193.130, and may be further punished by a fine of not more than $100,000.

(c) If the violation is committed with intent to sell, transfer or use the data for commercial advantage, personal gain or malicious harm, is guilty of a category B felony and shall be punished by imprisonment in the state prison for a minimum term of not less than 1 year and a maximum term of not more than 10 years, and may be further punished by a fine of not more than $250,000.

(Added to NRS by 2017, 2265)