OCR Seeks Comments Related To Recognized Security Practices And Distribution Of Civil Monetary Penalties Under The HITECH Act

On April 6, 2022, the Office for Civil Rights ("OCR") at the Department of Health and Human Services ("HHS") published a request for information ("RFI") seeking public comment on implementing certain provisions of the Health Information Technology for Economic and Clinical Health ("HITECH") Act, indicating that a rulemaking or further guidance related to the HITECH Act may be forthcoming.  Specifically, the RFI seeks input as to how covered entities and business associates are voluntarily implementing recognized security practices.  OCR will consider the implementation of such practices when making certain determinations relating to the resolution of potential violations of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Security Rule.  The RFI also seeks input on the process for distributing to harmed individuals a percentage of civil monetary penalties ("CMPs") or monetary settlements collected pursuant to the HITECH Act.  Although HIPAA