§17941 Recognition of Security Practices

Summary

When deciding to lower fines, shorten an audit, or ease other penalties under HIPAA, the Secretary must look at whether the health organization or its partner had recognized security practices in place for at least the previous 12 months. If those practices were shown, the Secretary can consider them when reducing fines, ending audits early, or agreeing to smaller remedies. Recognized security practices means the standards, guidelines, or procedures from federal cybersecurity programs and other official sources that an organization chooses and follows, and that fit with the HIPAA Security Rule. The law does not let the Secretary raise fines or make audits bigger because an organization did not follow those recognized practices. Choosing not to use them does not by itself create new liability, but the Secretary can still enforce the HIPAA Security Rule and the organization must still meet its HIPAA duties.