After a Columbia University Medical Center investigator notified the institutional review board (IRB) that, due to the actions of a study coordinator, the email addresses of 145 individuals involved in HIV/AIDS research were cc’d in a recruitment pitch for a related upcoming study, Columbia took a number of actions, including terminating the coordinator and sending subjects an apology for any “inconvenience” they suffered.^[1]

But what if, in this instance or in another where protected health information has been breached, the loss or exposure of the data results in more than an inconvenience?

More than a decade ago, Congress asked the HHS Office for Civil Rights (OCR) to figure out how to share the penalties it collects from enforcement actions with individuals “harmed by an act that constitutes an offense” under laws relating to privacy or security so that they “may receive a percentage of any CMP [civil monetary penalty] or monetary settlement collected by OCR with respect to such offense.”

OCR is finally getting started with that task, and research institutions, universities and academic medical centers—which have all felt the agency’s wrath—have until June 6 to weigh in. The agency recently published, “Considerations for Implementing the Health Information Technology for Economic and Clinical Health (HITECH) Act, as Amended,” formally a request for information (RFI) that serves two regulatory purposes.^[2]