(a) The attorney general may institute an action for injunctive relief to restrain a violation of this chapter.
(b) In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter. A civil penalty assessed under this section may not exceed:
(1) $5,000 for each violation that is committed negligently and that occurs in a single year, regardless of how long the violation continues during that year;
(2) $25,000 for each violation that is committed knowingly or intentionally and that occurs in a single year, regardless of how long the violation continues during that year; or
(3) $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.