§17941 Recognition of Security Practices

Summary

When deciding fines, audits, or other penalties under HIPAA, the Secretary must look at whether a health care organization or its business partner has had recognized security practices in place for at least the previous 12 months. If the organization can show it used those practices, that may reduce fines, lead to an early favorable end to an audit, or lessen other remedies agreed with the Department of Health and Human Services. Recognized security practices are cybersecurity standards, guidelines, and procedures from federal programs that the organization adopts while following the HIPAA Security Rule. The Secretary may not raise fines or make audits longer, larger, or more frequent just because an organization did not follow those practices. Choosing not to follow them does not by itself create liability, but the Secretary still can enforce the HIPAA Security Rule and an organization’s duties under that rule.