Conn. Gen. Stat. § 38a-999a: Disclosure of individually identifiable medical record information with malicious intent prohibited. Penalty.

(a) No person shall disclose individually identifiable medical record information, as defined in subsection (r) of section 38a-976, with the malicious intent to damage an individual's reputation or character.

(b) Any person who violates subsection (a) of this section shall be fined not more than five hundred dollars or imprisoned not more than three months or both for the first offense and shall be fined not more than two thousand dollars or imprisoned not more than one year or both for each subsequent offense.