In April 2016, the HHS Office for Civil Rights (OCR) and NewYork-Presbyterian (NYP) Hospital signed a $2.2 million settlement agreement stemming from the “unauthorized” filming of a reality TV series, New York Med, that had been on the air a few years earlier.^[1]

Anita Chanko was watching a rerun of the show when she recognized the voice of her husband, Mark Chanko, who died in 2011 after being hit by a truck; his last moments were broadcast, albeit with his face blurred.

His family was in a waiting room and had not only not agreed to the filming, they had no idea it was happening and had themselves not been permitted to be with Chanko. His son filed a complaint, which led to the OCR settlement. But because HIPAA provides no private right of action—and OCR was late developing a congressionally mandated rule—his family received none of the $2.2 million.

In fact, no individual or family member who suffered distress—or financial losses—due to HIPAA violations has ever shared in the millions of dollars in penalties OCR has collected.

Seven years before the NYP settlement, Congress told OCR to write regulations so that it could share the penalties it collects from enforcement actions with individuals “harmed by an act that constitutes an offense” under laws relating to privacy or security so that they “may receive a percentage of any CMP [civil monetary penalty] or monetary settlement collected by OCR with respect to such offense.”^[2]