View Rule

This proposed rule would solicit tthe public's views on proposals to modify the HIPAA Enforcement Rule by adjusting some annual limits on CMPs under the HITECH Act and establishing a methodology for the distribution of civil money penalties and monetary settlements with those harmed by an offense under HIPAA relating to privacy or security.  It also would propose to modify the HIPAA Privacy Rule as necessary to implement the accounting of disclosures provisions of section 13405(c) of the Health Information Technology for Economic and Clinical Health Act (title XIII of the American Recovery and Reinvestment Act of 2009). We plan to withdraw the current Accounting of Disclosures NPRM that was issued in 2011 when the new NPRM is issued.

Overall Description of Deadline: The statutory deadline to issue a rule on the requirements on the sharing of civil monetary penalties (CMP) or monetary settlements with individuals harmed by the actions for which CMPs were imposed was February 17, 2012, pursuant to the HITECH Act. Issuing a rule on Accounting of Disclosures is statutory not later than 6 months after the Secretary adopts standards on accounting of disclosures described in HITECH section 13101.