The Department of Health and Human Services is seeking public input on two significant HIPAA questions. The questions include how regulators should consider the “recognized” security practices of organizations when making determinations about potential HIPAA enforcement actions. How to distribute a percentage of HIPAA fines and monetary settlements to individuals harmed by violations? Experts say the two regulatory matters are important – but challenging – tasks for HHS’ enforcement agency, the Office for Civil Rights, to address. “Both issues are pretty challenging – which is presumably why this is an RFI rather than a proposed rule,” an expert says.”]