§17939 Improved Enforcement

Summary

Covered entities that violate the privacy or security rules must be punished and paid under the enforcement rules in sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6). The changes to how penalties work apply to penalties imposed on or after 24 months after February 17, 2009. The Secretary of Health and Human Services must write rules to carry out these changes within 18 months after February 17, 2009. Fines or settlements for privacy or security offenses must be sent to the HHS Office for Civil Rights to use for enforcing the subchapter and subparts C and E of 45 C.F.R. part 164 as they stood on February 17, 2009, once required regulations are in place. The Comptroller General must give the Secretary recommendations within 18 months after February 17, 2009 for a method to let harmed individuals receive a share of such fines or settlements. The Secretary must adopt a regulation, based on those recommendations, within 3 years after February 17, 2009; that method applies to penalties or settlements imposed on or after the regulation’s effective date. The listed amendments apply to violations occurring after February 17, 2009.