(2) A licensee or insurance-support organization that discloses information in violation of ORS 746.665 or a health insurer that uses or discloses information in violation of ORS 746.607 (1) or (2) is liable for damages sustained by the individual about whom the information relates. However, an individual is not entitled to a monetary award that exceeds the actual damages sustained by the individual as a result of the violation of ORS 746.607 (1) or (2) or 746.665.
(3) In any action brought pursuant to this section, the court may award the cost of the action and reasonable attorney fees to the prevailing party.
(4) An action under this section must be brought within two years from the date the alleged violation is or should have been discovered.
(5) Except as specifically provided in this section, there shall be no remedy or recovery available to individuals, in law or in equity, for occurrences constituting a violation of any provision of ORS 746.600 to 746.690. [1981 c.649 §18; 1987 c.490 §56; 1995 c.618 §131; 2001 c.377 §28a; 2003 c.87 §18; 2003 c.364 §165a]