Amend CSHB 300 (senate committee printing) as follows:
(1)  In SECTION 7 of the bill, strike proposed Sections 181.201(b) and (b-1), Health and Safety Code (page 4, lines 18 through 45), and substitute the following:
(b)  In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter. A civil penalty assessed under this section may not exceed:
(1)  $5,000 [$3,000] for each violation that occurs in one year, regardless of how long the violation continues during that year, committed negligently;
(2)  $25,000 for each violation that occurs in one year, regardless of how long the violation continues during that year, committed knowingly or intentionally; or
(3)  $250,000 for each violation in which the covered entity knowingly or intentionally uses protected health information for financial gain.
(b-1)  The total amount of a penalty assessed against a covered entity under Subsection (b) in relation to a violation or violations of Section 181.154 may not exceed $250,000 annually if the court finds that the disclosure was made only to another covered entity and only for a purpose described by Section 181.154(c) and the court finds that:
(1)  the protected health information disclosed was encrypted or transmitted using encryption technology designed to protect against improper disclosure;
(2)  the recipient of the protected health information did not use or release the protected health information; or
(3)  at the time of the disclosure of the protected health information, the covered entity had developed, implemented, and maintained security policies, including the education and training of employees responsible for the security of protected health information.
(2)  In SECTION 10 of the bill, in added Section 181.206(a)(1), Health and Safety Code (page 5, line 48), between "entity" and "in", insert ", as that term is defined by 45 C.F.R. Section 160.103,".
(3)  Add the following appropriately numbered SECTIONS to the bill and renumber subsequent SECTIONS of the bill accordingly:
SECTION ____.  Section 522.002(b), Business & Commerce Code, is amended to read as follows:
(b)  An offense under this section is a Class B misdemeanor, except that the offense is a state jail felony if the information accessed, read, scanned, stored, or transferred was protected health information as defined by the Health Insurance Portability and Accountability Act and Privacy Standards, as defined by Section 181.001, Health and Safety Code.
SECTION ____.  The change in law made by Section 522.002(b), Business & Commerce Code, as amended by this Act, applies only to an offense committed on or after the effective date of this Act. An offense committed before the effective date of this Act is governed by the law in effect at the time the offense was committed, and the former law is continued in effect for that purpose. For purposes of this section, an offense was committed before the effective date of this Act if any element of the offense was committed before that date.