P.R. Laws tit. 26, § 9245
(a) Civil sanctions.—
(1) Whenever the Commissioner has reason to believe that a person has committed negligence in violation of the provisions of this chapter and that an action is in the public interest, the Commissioner may bring an action to enjoin such violations. An injunction issued under this section shall be issued without bond.
(2) In addition to the relief available pursuant to clause (1) of this subsection, the Commissioner may request and the court may order any other temporary or permanent relief as may be in the public interest, including any of the following, or any combination of the following:
(A) A civil penalty of not more than the thousand dollars ($10,000) for each violation, not to exceed fifty thousand dollars ($50,000) in the aggregate for multiple violations;
(B) a civil penalty of not more than two hundred fifty thousand dollars ($250,000) if the court finds that violations of this chapter have occurred with sufficient frequency, and
(C) reasonable attorney fees, investigation and court costs.
(b) Criminal sanctions.—
(1) The penalties described below shall apply to any natural or juridical person that collects, uses, or discloses protected health information in knowing violation of this chapter and the applicable privacy laws and regulations.
(2)
(A) A fine of not more than fifty thousand dollars ($50,000), imprisonment for not more than one (1) year; or both;
(B) If the violation is committed under false pretenses, a fine of not more than two hundred fifty thousand dollars ($250,000), imprisonment for not more than five (5) years, or any combination of these penalties, or
(C) if the violation is committed with the intent to sell, transfer or use protected health information for malicious harm, a fine of not more than five hundred thousand dollars ($500,000), imprisonment for not more than ten (10) years, or any combination of these penalties.
(c) In the event that a health insurance organization or issuer is being sued in connection with an unauthorized disclosure under a theory of vicarious liability for the actions or omissions of the health insurance organization or issuer's employees, it shall be an affirmative defense that the health insurance organization or issuer substantially met the requirements of § 9235 of this title.
History —Aug. 29, 2011, No. 194, added as § 14.150 on Aug. 23, 2012, No. 203, § 1, eff. 90 days after Aug. 23, 2012.