Browse Arkansas Code titles and sections
42 U.S.C. § 17951 — Recognition of security practices
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** Consistent with the authority of the Secretary under sections 1320d–5 and 1320d–6 of this title, when making determinations relating to fines under such section 1320d–5 (as amended by section 13410 of Pub. L. 111–5) or such section 1320d–6, decreasing the length and extent of an audit under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim), or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may—
(1) mitigate fines under [section 1320d–5 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim) (as amended by section 13410 of Pub. L. 111–5);
(2) result in the early, favorable termination of an audit under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim); and
(3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Department of Health and Human Services.
**(b) Definition and miscellaneous provisions**
(1) **Recognized security practices** — The term “recognized security practices” means the standards, guidelines, best practices, methodologies, procedures, and processes developed under [section 272(c)(15) of title 15](https://uscode.house.gov/view.xhtml?req=granuleid:USC-preli
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17951
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 7a42bf6728c614d7bd79507b7b2f4957ff21761ba6b156c3b1f81a6e024c4a10. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_0b0b417d0ef543c189bba2a9
Source file: Laws/federal/codes/united-states-code/title-42/section-17951-recognition-of-security-practices--234c805eee.md
Pages: Not recorded – Not recorded
Passage SHA-256: 70a9b961aba4a4f2794783fb81d84781b3a61d811a1141acd414f948cb464564
Source location: Title 42, Chapter 156, § 17951; chapter-156-health-information-technology.md
Stored source content
**(a) In general** Consistent with the authority of the Secretary under sections 1320d–5 and 1320d–6 of this title, when making determinations relating to fines under such section 1320d–5 (as amended by section 13410 of Pub. L. 111–5) or such section 1320d–6, decreasing the length and extent of an audit under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim), or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may—
(1) mitigate fines under [section 1320d–5 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim) (as amended by section 13410 of Pub. L. 111–5);
(2) result in the early, favorable termination of an audit under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim); and
(3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Department of Health and Human Services.
**(b) Definition and miscellaneous provisions**
(1) **Recognized security practices** — The term “recognized security practices” means the standards, guidelines, best practices, methodologies, procedures, and processes developed under [section 272(c)(15) of title 15](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section272/c/15&num=0&edition=prelim), the approaches promulgated under [section 1533(d) of title 6](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1533/d&num=0&edition=prelim), and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title).
(2) **Limitation** — Nothing in this section shall be construed as providing the Secretary authority to increase fines under [section 1320d–5 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim) (as amended by section 13410 of Pub. L. 111–5), or the length, extent or quantity of audits under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim), due to a lack of compliance with the recognized security practices.
(3) **No liability for nonparticipation** — Subject to paragraph (4), nothing in this section shall be construed to subject a covered entity or business associate to liability for electing not to engage in the recognized security practices defined by this section.
(4) **Rule of construction** — Nothing in this section shall be construed to limit the Secretary’s authority to enforce the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or business associate’s obligations under the HIPAA Security rule.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general**
(1) **Omitted**
(2) **Enforcement under Social Security Act** — Any violation by a covered entity under thus 11 So in original. Probably should be “this”. subchapter is subject to enforcement and penalties under section 22 So in original. Probably should be “sections”. 1176 and 1177 of the Social Security Act [[42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim), 1320d–6].
**(b) Effective date; regulations**
(1) The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009.
(2) Not later than 18 months after February 17, 2009, the Secretary of Health and Human Services shall promulgate regulations to implement such amendments.
**(c) Distribution of certain civil monetary penalties collected**
(1) **In general** — Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Security Act ([42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim)) insofar as such section relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
(2) **GAO report** — Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommendations for a methodology under which a
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17940
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 9078
TITLE 42—THE PUBLIC HEALTH AND WELFARE
§ 17941
sociates that are subject to the requirements of
this subchapter and subparts C and E of part 164
of title 45, Code of Federal Regulations, as such
provisions are in effect as of February 17, 2009,
comply with such requirements.
(Pub. L. 111–5, div. A, title XIII, § 13411, Feb. 17,
2009, 123 Stat. 276.)
Editorial Notes
REFERENCES IN TEXT
This subchapter, referred to in text, was in the origi-
nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.)
of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123
Stat. 258, which is classified principally to this sub-
chapter. For complete classification of subtitle D to
the Code, see Tables.
Statutory Notes and Related Subsidiaries
EFFECTIVE DATE
Section effective 12 months after Feb. 17, 2009, except
as otherwise specifically provided, see section 13423 of
Pub. L. 111–5, set out as a note under section 17931 of
this title.
§ 17941. Recognition of security practices
(a) In general
Consistent with the authority of the Secretary
under sections 1320d–5 and 1320d–6 of this title,
when making determinations relating to fines
under such section 1320d–5 (as amended by sec-
tion 13410 of Pub. L. 111–5) or such section
1320d–6, decreasing the length and extent of an
audit under section 17940 of this title, or rem-
edies otherwise agreed to by the Secretary, the
Secretary shall consider whether the covered en-
tity or business associate has adequately dem-
onstrated that it had, for not less than the pre-
vious 12 months, recognized security practices
in place that may—
(1) mitigate fines under section 1320d–5 of
this title (as amended by section 13410 of Pub.
L. 111–5);
(2) result in the early, favorable termination
of an audit under section 17
Source: Supplied 2024 U.S. Code historical extraction · 42 U.S.C. § 17951
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.