MITIGATION.

(a) In an action or proceeding to impose an administrative penalty or assess a civil penalty for actions related to the disclosure of individually identifiable health information, a covered entity may introduce, as mitigating evidence, evidence of the entity's good faith efforts to comply with:

(1) state law related to the privacy of individually identifiable health information; or

(2) the Health Insurance Portability and Accountability Act and Privacy Standards.

(b) In determining the amount of a penalty imposed under other law in accordance with Section 181.202, a court or state agency shall consider the following factors:

(1) the seriousness of the violation, including the nature, circumstances, extent, and gravity of the disclosure;

(2) the covered entity's compliance history;

(3) whether the violation poses a significant risk of financial, reputational, or other harm to an individual whose protected health information is involved in the violation;

(4) whether the covered entity was certified at the time of the violation as described by Section 182.108;

(5) the amount necessary to deter a future violation; and

(6) the covered entity's efforts to correct the violation.

(c) On receipt of evidence under Subsections (a) and (b), a court or state agency shall consider the evidence and mitigate imposition of an administrative penalty or assessment of a civil penalty accordingly.