Models for the Distribution of Civil Monetary Penalties

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, strengthened requirements for the protection of health information and included provisions to improve enforcement. Among other things, it required the Secretary of Health and Human Services to establish a methodology under which an individual who is harmed by a violation of requirements related to the privacy and security of health information may receive a percentage of any civil monetary penalty collected or of any monetary settlement. It also required the Comptroller General to submit recommendations for such a methodology to the Secretary. In response to this requirement, we identified several models that may inform the design of a methodology for the distribution of civil monetary penalties or monetary settlements to aggrieved individuals.