The HITECH Act mandates that the Department of Health and Human Services share money collected from HIPAA settlements and penalties with breach victims. Rulemaking on the issue has been stalled since 2012. OCR has announced plans to issue an advanced notice of proposed rulemaking 12 previous times – every spring and fall since 2012 – since then. Lawyer: “How do you measure the value of harm to an individual whose PHI was disclosed? What types of harm would qualify for sharing?” OCR: “With resources already stretched razor thin, how would OCR administer a new program?””]
Source: https://www.careersinfosecurity.com/sharing-hipaa-fines-victims-will-ever-happen-a-11023