Unauthorized Disclosure of Confidential Information: Nevada Laws

Unauthorized disclosure of confidential information in Nevada can be prosecuted as a crime and sued over in civil court, often at the same time. Criminal exposure ranges from a misdemeanor for a basic computer disclosure to a category B felony with one to twenty years in prison when stolen personal information is used for fraud. On the civil side, a victim can recover money damages, get a court order stopping further disclosure, and in some cases collect punitive or exemplary damages. Which rules apply depends on what kind of information was shared, who shared it, and whether they had a legal duty to keep it quiet.

Criminal Charges for Disclosing Confidential Information

Nevada has several statutes that criminalize unauthorized disclosure, and federal law adds more when health information is involved.

Computer-Related Disclosures

NRS 205.4765 makes it a misdemeanor to knowingly access a computer system without authorization and disclose data from it. The charge jumps to a category C felony when the disclosure was part of a fraud scheme, caused more than $500 in damages, or disrupted a public service such as a water system or government function. A category C felony under the computer-crime statute carries one to five years in prison and fines up to $100,000, which is well above the $10,000 cap that applies to most category C felonies. The court also has to order restitution to the victim.¹²

Identity Theft

NRS 205.463 covers people who obtain someone else’s personal identifying information and use it to harm the person, impersonate them, get into their private records, or commit fraud. This is a category B felony punishable by one to twenty years in prison and fines up to $100,000. When the offense involves five or more victims, the minimum prison term rises to three years.³

Recording or Sharing Private Conversations

NRS 200.650 makes it a crime to secretly listen to, record, or disclose a private conversation without authorization from at least one participant. This matters in confidentiality disputes because a recording of a private discussion — say, between business partners, an attorney and client, or a doctor and patient — can itself trigger criminal liability if it was obtained or shared without consent.⁴

HIPAA

Federal law adds a second layer for health information. Knowingly obtaining or disclosing individually identifiable health information under HIPAA carries fines up to $50,000 and one year in prison. If the offense involves false pretenses, the fine climbs to $100,000 with up to five years. When the intent is to sell the information or use it for personal gain, penalties rise to $250,000 and up to ten years. HIPAA cases are handled by the U.S. Department of Justice, not Nevada state courts.

Civil Lawsuits and Damages

A victim of unauthorized disclosure can sue on several theories. The right one depends on the relationship between the parties and the kind of information involved.

Breach of an NDA or Confidentiality Clause

A signed non-disclosure agreement or a confidentiality clause in an employment contract gives the clearest path to a lawsuit. When someone signs an NDA and then shares protected information, the other party can sue for breach of contract and recover financial losses caused by the disclosure and, where applicable, any profits the defendant gained from it. Corporate officers, attorneys, and others in positions of trust owe fiduciary duties that create similar liability even without a written agreement, and sharing privileged information in violation of those duties can also trigger professional discipline.

Trade Secret Misappropriation

Under the Nevada Uniform Trade Secrets Act, a business owner can recover actual losses plus any unjust enrichment the defendant gained. As an alternative, a court can impose a reasonable royalty for the unauthorized use or disclosure. When the misappropriation was willful, wanton, or reckless, the court may add exemplary damages of up to twice the total damages award.⁵

To qualify as a trade secret, information has to derive economic value from not being generally known, and the owner has to take reasonable steps to keep it secret. The definition is broad enough to cover formulas, processes, customer lists, software code, and designs. Nevada gives owners a useful presumption: marking documents “Confidential” or “Private” in a reasonably noticeable way is presumed to be a reasonable effort to maintain secrecy, and an opponent has to overcome that presumption with clear and convincing evidence.⁶

Invasion of Privacy and Injunctions

Nevada courts also recognize invasion-of-privacy claims when confidential information is shared without consent. These claims don’t need a contract; they rest on the principle that people have a right to keep certain facts private. Courts have awarded compensation for emotional distress and reputational harm when private facts were disclosed publicly. Beyond money, a plaintiff can seek a temporary restraining order or a permanent injunction to stop further dissemination, and Nevada courts grant that relief where continued disclosure would cause irreparable harm.

Punitive Damages

In non-contract cases involving fraud, malice, or oppression, Nevada allows punitive damages on top of compensatory damages. The plaintiff has to prove those elements by clear and convincing evidence. The award is capped at three times the compensatory damages when compensatory damages are $100,000 or more, or at $300,000 when compensatory damages are less than $100,000.⁷ These caps are separate from the trade secret statute’s exemplary damages, which follow their own formula.

Personal Information and Data Breach Rules

NRS 603A applies to any business or government agency that collects personal information about Nevada residents. Under the statute, “personal information” means a person’s name combined with at least one sensitive identifier: a Social Security number, driver’s license number, financial account number with its access code, medical identification number, or login credentials for an online account. Truncated data like the last four digits of a Social Security number and publicly available government records are excluded.⁸

Any data collector maintaining these records has to implement and maintain reasonable security measures against unauthorized access, destruction, use, or disclosure. Contracts that involve giving personal information to a third party must require that third party to maintain the same reasonable security measures.⁸

When a breach happens and unencrypted personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person, the data collector has to notify affected Nevada residents as quickly as possible without unreasonable delay. Law enforcement can request a temporary hold if notification would compromise a criminal investigation.⁸

A violation of NRS 603A is classified as a deceptive trade practice. The Attorney General or any affected person can bring a civil action seeking an injunction and reasonable attorney’s fees, and the court can order restitution for actual damages. There is no separate private right of action for money damages beyond restitution.⁸

Special Rules for Financial and Medical Records

Financial Records

NRS 239A restricts how government agencies can access customers’ financial records held by banks and other financial institutions. An agency can’t request the records unless the inquiry relates to a lawful investigation, the records are described with specificity, and the agency provides a customer authorization, subpoena, or search warrant. Financial institution employees who know or suspect that records are being requested for an investigation are prohibited from handing them over without one of those authorizations.⁹

When a subpoena is used, the agency has to serve a copy on the customer and give them ten days to move to quash before the institution can comply. A court can shorten or waive that notice, but only on a showing that a law was or is about to be violated, and the court must eventually require the agency to notify the customer, typically within 90 days.¹⁰ If an institution unlawfully releases a customer’s financial information, the customer can sue for damages, including compensation for fraudulent transactions that resulted from the disclosure.

Medical Records

Patient confidentiality in Nevada is mainly governed by HIPAA. NRS 629.061 handles a narrower issue: who is allowed to inspect and copy a patient’s health records. That list includes the patient or an authorized representative, the personal representative of a deceased patient’s estate, and investigators for the Attorney General or a licensing board acting within an authorized investigation. Records shared with investigators can’t be used at public hearings without the patient’s written consent or procedures that protect their identity.¹¹

Healthcare facilities that store patient data electronically also fall under NRS 603A if that data includes personal information as the statute defines it. A medical identification number or health insurance identification number combined with a patient’s name qualifies, so a data breach at a medical facility triggers the same notification obligations as a breach at any other business.⁸

When Disclosure Is Allowed

Not every disclosure of confidential information is unlawful. Nevada recognizes several situations where sharing otherwise protected data is required or permitted.

Court Orders and Regulatory Mandates

Subpoenas, court orders, and regulatory requirements override most confidentiality obligations. Financial institutions have to turn over customer records when a valid subpoena meets the procedural requirements of NRS 239A, including customer notice. Healthcare providers can share records with Attorney General investigators, licensing boards, and coroners acting within their legal authority.¹¹

Government Whistleblowers

State and local government employees who report improper governmental action are protected from retaliation such as demotion, suspension, dismissal, poor evaluations, or undesirable transfers. Improper action means conduct that violates law, abuses authority, endangers public health or safety, or grossly wastes public money. This protection is specifically for government officers and employees; private-sector whistleblowers have to look to other federal or state protections.¹²

Sexual Misconduct Settlements

Since 2019, NRS 10.195 has prohibited settlement agreements from including confidentiality clauses that would prevent a party from disclosing factual information about claims involving sexual offenses that would qualify as felonies under Nevada law, sex discrimination, or retaliation for reporting sexual discrimination. Any such confidentiality provision is void, though the rest of the agreement stays enforceable. The alleged victim may request that their identity be kept confidential, and that request has to be honored unless a government agency is a party to the agreement.¹³

Good-faith disclosures under these exemptions are generally shielded from liability, but the protection has limits. A government employee who leaks information outside the scope of the whistleblower statute, or a party who breaks a lawful confidentiality clause in a settlement unrelated to sexual misconduct, can still be sued or prosecuted.

Deadlines to Sue

Nevada’s statutes of limitation are strict, and missing one ends the case regardless of its merits.

Breach of a written contract, including an NDA: six years from the date of the breach or its discovery.¹⁴
Personal injury torts, including invasion of privacy: two years from the date the injury occurred or was discovered.¹⁴
Trade secret misappropriation: three years from the date the misappropriation is discovered or should have been discovered with reasonable diligence. A continuing misappropriation counts as a single claim.⁵
Legal malpractice, including breach of attorney-client privilege: four years from the date the plaintiff suffers damage, or two years from discovering the material facts, whichever comes first. The two-year discovery deadline is a hard cutoff that can only shorten the window.¹⁵

1
Nevada Legislature. Nevada Code NRS 205.4765 – Unlawful Acts Regarding Computers: Generally
2
Nevada Legislature. Nevada Revised Statutes Chapter 193 – Criminality Generally
3
Nevada Legislature. Nevada Code NRS 205.463 – Obtaining and Using Personal Identifying Information of Another Person to Harm or Impersonate Person
4
Nevada Legislature. Nevada Revised Statutes 200.650 – Unauthorized Listening to or Recording of Private Conversations
5
Nevada Legislature. Nevada Revised Statutes Chapter 600A – Trade Secrets (Uniform Act)
6
Nevada Legislature. Nevada Revised Statutes 600A.030 – Definitions
7
Nevada Legislature. Nevada Code 42.005 – Exemplary and Punitive Damages
8
Nevada Legislature. Nevada Revised Statutes Chapter 603A – Security and Privacy of Personal Information
9
Nevada Legislature. Nevada Revised Statutes 239A.080 – Examination and Disclosure of Financial Records: Restrictions; Exception
10
Nevada Legislature. Nevada Revised Statutes Chapter 239A – Disclosure of Financial Information to Governmental Agencies
11
Nevada Legislature. Nevada Code 629.061 – Inspection; Copies and Related Charges; Use in Public Hearing; Immunity of Certain Persons From Civil Action for Disclosure
12
Nevada Legislature. Nevada Code 281.611 – Definitions
13
Nevada Legislature. Nevada Revised Statutes 10.195 – Prohibition of Provisions in Settlement Agreement Prohibiting or Restricting Disclosure of Certain Information
14
Nevada Legislature. Nevada Revised Statutes 11.190 – Periods of Limitation
15
Nevada Legislature. Nevada Code 11.207 – Malpractice Actions Against Attorneys and Veterinarians