Required provision of access to data

(a) Access to data For purposes of an institute of higher education conducting a research project under section 4(a), a covered entity shall provide access to any data and information requested by such institution under such section. (b) Privacy In providing access to data and information under subsection (a), a covered entity shall remove any identifiable information from such data and information. (c) Civil penalty (1) In general The Attorney General shall assess a civil penalty against a covered entity in an amount of not more than $10,000,000 for each violation of subsection (a). (2) Activity constituting violation For purposes of paragraph (1), failure to comply under subsection (a) with any request with respect to a single research project shall be considered as one violation. (d) Injunctive relief The Attorney General may bring an action in an appropriate United States district court against a covered entity that violates subsection (a) for such relief as may be appropriate, including injunctive relief.