CA AB439

Establishes an affirmative defense against nominal damages ($1,000) in lawsuits brought on or after January 1, 2013, if the defendant is a covered entity or business associate that has complied with notification obligations and taken appropriate preventive actions under HIPAA.

Requires the defendant to demonstrate it took reasonable preventive measures including developing security policies, designating a security official, encrypting information, and taking corrective action to have confidential information destroyed or returned promptly after unauthorized release.

Limits liability to one judgment on the merits for releases arising from the same event, transaction, or occurrence when the affirmative defense is established.

Permits courts to consider the defendant's prior violations of medical information confidentiality laws when deciding whether to allow the affirmative defense, with discretion to deny it based on equity considerations.

Allows plaintiffs to recover reasonable attorney's fees and costs without regard to whether they receive actual or nominal damages when the defendant establishes the affirmative defense.