§17939 Improved enforcement

Summary

If a covered entity breaks these rules, it can be punished under the enforcement rules found in sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6). The changes take effect for penalties imposed on or after 24 months after February 17, 2009. The Secretary of Health and Human Services must issue rules to put these changes into effect within 18 months after February 17, 2009. Any civil penalty or settlement for a privacy or security offense under this law (or under section 1176 as it relates to privacy or security) must be sent to the HHS Office for Civil Rights and used to enforce the privacy and security rules in this subchapter and in subparts C and E of part 164 of title 45, Code of Federal Regulations, as they were on February 17, 2009. The Comptroller General must give the Secretary a report, within 18 months after February 17, 2009, with ideas for a way to give harmed individuals a share of those penalties or settlements. The Secretary must make a rule, within 3 years after February 17, 2009 and based on that report, that sets how an injured person may receive a percentage of any penalty or settlement; that rule will apply to penalties or settlements imposed on or after the rule’s effective date. Certain amendments apply only to violations that happen after February 17, 2009.