0945-AA04 202004 Unified Agenda of Federal Regulatory and Deregulatory Actions 0945 Office for Civil Rights OCR 0900 Department of Health and Human Services HHS HIPAA Enforcement and Privacy Rules: Annual Penalty Limits and Sharing Civil Money Penalties or Monetary Settlements With Harmed Individuals and Accounting of Disclosures Under the HITECH Act

This proposed rule would solicit tthe public's views on proposals to modify the HIPAA Enforcement Rule by adjusting some annual limits on CMPs under the HITECH Act and establishing a methodology for the distribution of civil money penalties and monetary settlements with those harmed by an offense under HIPAA relating to privacy or security.  It also would propose to modify the HIPAA Privacy Rule as necessary to implement the accounting of disclosures provisions of section 13405(c) of the Health Information Technology for Economic and Clinical Health Act (title XIII of the American Recovery and Reinvestment Act of 2009). We plan to withdraw the current Accounting of Disclosures NPRM that was issued in 2011 when the new NPRM is issued.

]]> Other Significant Previously Published in The Unified Agenda Proposed Rule Stage No No Other 45 CFR 160 45 CFR 164 Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L. 111-5, sec. 13410(c)(3) & (4) Social Security Act, sec. 1776 42 U.S.C. 1320d-5, as amended by HITECH Act sec. 13410(a), (d), and (f) PL 111-5, sec 13405(c) Statutory Final 02/17/2012 The statutory deadline for issuing a rule on sharing of civil monetary penalties or monetary settlements was 2/17/2012. Statutory Final 06/01/2010 Issuing a rule on Accounting of Disclosures is statutory not later than 6 months after the Secretary adopts standards on accounting of disclosures described in HITECH section 13101. The statutory deadline to issue a rule on the requirements on the sharing of civil monetary penalties (CMP) or monetary settlements with individuals harmed by the actions for which CMPs were imposed was February 17, 2012, pursuant to the HITECH Act. Issuing a rule on Accounting of Disclosures is statutory not later than 6 months after the Secretary adopts standards on accounting of disclosures described in HITECH section 13101. No NPRM 05/31/2011 76 FR 31426 NPRM Comment Period End 08/01/2011 Second NPRM 04/00/2021 No No None No No www.hhs.gov/ocr/privacy No No Marissa Gordon-Nguyen Senior Advisor for Health Information Privacy, Data, and Cybersecurity Policy 0945 Office for Civil Rights OCR 800 368-1019 800 537-7697 ocrprivacy@hhs.gov 200 Independence Avenue SW, Washington DC 20201