(a) General rule. A person who discloses identifiable patient safety work product in knowing or reckless violation of the confidentiality provisions shall be subject to a civil money penalty for each act constituting such violation.

(b) Violation attributed to a principal. A principal is independently liable, in accordance with the federal common law of agency, for a civil money penalty based on the act of the principal's agent, including a workforce member, acting within the scope of the agency if such act could give rise to a civil money penalty in accordance with § 3.402(a) of this subpart.