Section 16. Unauthorized access to or disclosure of individually identifiable patient health information by or through the statewide health information exchange or by or through any technology grantees or implementing organizations funded in whole or in part from the from the e–Health Institute Fund established in section 6E of chapter 40J or the Massachusetts Health Information Exchange Fund established in section 10, or any associated businesses managing or in possession of such information, the operator of such exchange or grantee or contractor shall be subject to fines or penalties as determined by the executive office. The executive office shall promulgate regulations to assess fair and reasonable fines or penalties.