Printer Friendly, PDF & Email

After a Privacy Violation, Who Should Be Paid?

After a Columbia University Medical Center investigator notified the institutional review board (IRB) that, due to the actions of a study coordinator, the email addresses of 145 individuals involved in HIV/AIDS research were cc’d in a recruitment pitch for a related upcoming study, Columbia took a number of actions, including terminating the coordinator and sending subjects an apology for any “inconvenience” they suffered.[1]

But what if, in this instance or in another where protected health information has been breached, the loss or exposure of the data results in more than an inconvenience?

More than a decade ago, Congress asked the HHS Office for Civil Rights (OCR) to figure out how to share the penalties it collects from enforcement actions with individuals “harmed by an act that constitutes an offense” under laws relating to privacy or security so that they “may receive a percentage of any CMP [civil monetary penalty] or monetary settlement collected by OCR with respect to such offense.”

OCR is finally getting started with that task, and research institutions, universities and academic medical centers—which have all felt the agency’s wrath—have until June 6 to weigh in. The agency recently published, “Considerations for Implementing the Health Information Technology for Economic and Clinical Health (HITECH) Act, as Amended,” formally a request for information (RFI) that serves two regulatory purposes.[2]

This document is only available to subscribers. Please log in or purchase access.

Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field