§17941 Recognition of security practices

Summary

When deciding whether to lower fines, shorten an audit, or reduce other penalties for violations of the HIPAA Security Rule, the Secretary must look at whether the covered entity or business associate had recognized security practices in place for at least the previous 12 months. If those practices are shown, they can help reduce fines, allow an audit to end sooner on good terms, or lead to smaller agreed remedies. Recognized security practices — standards, guidelines, best practices, methods, or processes for cybersecurity developed or accepted under federal programs — are chosen by the covered entity or business associate but must be consistent with the HIPAA Security Rule. The Secretary cannot raise fines or expand audits because an organization did not follow these practices, and choosing not to use them does not by itself create liability. This does not limit the Secretary’s power to enforce the HIPAA Security Rule or change an entity’s obligations under that rule.