Privacy & Cybersecurity Law Blog

The Department of Health and Human Services (“HHS”) recently published two advance notices of proposed rulemaking that address the accounting of disclosures and the potential distribution of civil monetary penalties to affected individuals.

The first notice of proposed rulemaking would solicit the public’s views on modifying the HIPAA Privacy Rule as necessary to implement the accounting of disclosures provisions of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. HHS had previously published a notice of proposed rulemaking on these provisions in 2011, which is finally being withdrawn.

The second notice of proposed rulemaking would solicit the public’s views on “establishing a methodology under which an individual who is harmed by an offense punishable under HIPAA may receive a percentage of any civil money penalty or monetary settlement collected with respect to the offense.” This is required under Section 13410(c)(3) of the HITECH Act, but has not been implemented. HHS has collected almost $40 million since it began imposing civil monetary penalties, a considerable sum that could be distributed to affected individuals.