Senior Advisor for Health Information Privacy, Data, and Cybersecurity Policy

0945-AA04 202304 Unified Agenda of Federal Regulatory and Deregulatory Actions 0945 Office for Civil Rights OCR 0900 Department of Health and Human Services HHS Rulemaking Implementing Provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, as Amended

This rule would propose a methodology for the distribution of CMPs and monetary settlements to those harmed by an offense under the HIPAA Rules relating to privacy or security. The NPRM also would seek comment on a proposal to address in regulation the requirement for OCR to consider certain recognized security practices of covered entities and business associates when making certain HIPAA enforcement determinations.

]]> Other Significant Previously Published in The Unified Agenda Proposed Rule Stage No No 45 CFR 160 45 CFR 164 Social Security Act, sec. 1776 (42 U.S.C. 1320d-5) added by Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191, sec. 264 (August 21, 1996) Health Information Technology for Economic and Clinical Health (HITECH) Act (title XIII of the American Recovery and Reinvestment Act of 2009) Pub. L. 111-5, sec. 13410(c)(3) and (4) sec. 13412 as added by Pub. L. 116-321 (January 5, 2021) 42 U.S.C. 1320d-5, as amended Statutory Final 02/17/2012 The statutory deadline for issuing a rule on sharing of civil money penalties (CMPs) or monetary settlements was 2/17/2012. The statutory deadline for issuing a rule establishing a methodology for the distribution of CMPs and monetary settlements to those harmed by an offense under the HIPAA Rules relating to privacy or security is not later than three years after the enactment of the HITECH Act. No RFI 04/06/2022 87 FR 19833 RFI End of Comment Period 06/06/2022 NPRM 03/00/2024 No No Federal Local State Tribal No No www.hhs.gov/ocr/privacy No No Marissa Gordon-Nguyen Senior Advisor for Health Information Privacy, Data, and Cybersecurity Policy 0945 Office for Civil Rights OCR 800 368-1019 800 537-7697 ocrprivacy@hhs.gov 200 Independence Avenue SW, Washington DC 20201