§17939 Improved Enforcement

Summary

Covered entities that break these privacy or security rules must be handled under the Social Security Act penalty rules in sections 1176 and 1177 (42 U.S.C. 1320d–5, 1320d–6). The new penalty rules apply to penalties imposed on or after 24 months after February 17, 2009, and the HHS Secretary must create implementing regulations not later than 18 months after February 17, 2009. Civil money penalties or settlements for privacy or security offenses must be sent to the HHS Office for Civil Rights to enforce the privacy and security rules in 45 C.F.R. part 164, subparts C and E, as of February 17, 2009. The Comptroller General must give the Secretary recommendations within 18 months after February 17, 2009 on a way to let harmed individuals get a share of collected penalties. The HHS Secretary must adopt a regulation based on those recommendations not later than 3 years after February 17, 2009, and that method will apply to penalties or settlements imposed on or after the rule’s effective date. Amendments that raise penalty amounts and that let state attorneys general enforce the rules apply to violations occurring after February 17, 2009.