Browse Arkansas Code titles and sections
42 U.S.C. § 17940 — Improved enforcement
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general**
(1) **Omitted**
(2) **Enforcement under Social Security Act** — Any violation by a covered entity under thus 11 So in original. Probably should be “this”. subchapter is subject to enforcement and penalties under section 22 So in original. Probably should be “sections”. 1176 and 1177 of the Social Security Act [[42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim), 1320d–6].
**(b) Effective date; regulations**
(1) The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009.
(2) Not later than 18 months after February 17, 2009, the Secretary of Health and Human Services shall promulgate regulations to implement such amendments.
**(c) Distribution of certain civil monetary penalties collected**
(1) **In general** — Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Security Act ([42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim)) insofar as such section relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
(2) **GAO report** — Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommendations for a methodology under which a
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17940
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: b166d6776741c59119110d8c1e343138d9c9496b21fa5defce91d5876bf3b24d. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_73eea05dad8f548125505231
Source file: Laws/federal/codes/united-states-code/title-42/section-17940-improved-enforcement--55c79a58bb.md
Pages: Not recorded – Not recorded
Passage SHA-256: 5babd54bc0e2fc52cebfdf205df52b896ed190afcf824db8fa00094520ea7b2c
Source location: Title 42, Chapter 156, § 17940; chapter-156-health-information-technology.md
Stored source content
**(a) In general**
(1) **Omitted**
(2) **Enforcement under Social Security Act** — Any violation by a covered entity under thus 11 So in original. Probably should be “this”. subchapter is subject to enforcement and penalties under section 22 So in original. Probably should be “sections”. 1176 and 1177 of the Social Security Act [[42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim), 1320d–6].
**(b) Effective date; regulations**
(1) The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009.
(2) Not later than 18 months after February 17, 2009, the Secretary of Health and Human Services shall promulgate regulations to implement such amendments.
**(c) Distribution of certain civil monetary penalties collected**
(1) **In general** — Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Security Act ([42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim)) insofar as such section relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
(2) **GAO report** — Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommendations for a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense.
(3) **Establishment of methodology to distribute percentage of CMPS collected to harmed individuals** — Not later than 3 years after February 17, 2009, the Secretary shall establish by regulation and based on the recommendations submitted under paragraph (2), a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense.
(4) **Application of methodology** — The methodology under paragraph (3) shall be applied with respect to civil monetary penalties or monetary settlements imposed on or after the effective date of the regulation.
**(d) Tiered increase in amount of civil monetary penalties**
(1) **to (3) Omitted**
(4) **Effective date** — The amendments made by this subsection shall apply to violations occurring after February 17, 2009.
**(e) Enforcement through State attorneys general**
(1) **, (2) Omitted**
(3) **Effective date** — The amendments made by this subsection shall apply to violations occurring after February 17, 2009.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
In this subchapter, except as specified otherwise:
(1) **Breach**
(A) *In general* — The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) *Exceptions* — The term “breach” does not include—
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at 11 So in original. Probably should be followed by “the”. same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.
(2) **Business associate** — The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(3) **Covered entity** — The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(4) **Disclose** — The terms “
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17931
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Report on compliance**
(1) **In general** — For the first year beginning after February 17, 2009, and annually thereafter, the Secretary shall prepare and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report concerning complaints of alleged violations of law, including the provisions of this subchapter as well as the provisions of subparts C and E of part 164 of title 45, Code of Federal Regulations, (as such provisions are in effect as of February 17, 2009) relating to privacy and security of health information that are received by the Secretary during the year for which the report is being prepared. Each such report shall include, with respect to such complaints received during the year—
(A) the number of such complaints;
(B) the number of such complaints resolved informally, a summary of the types of such complaints so resolved, and the number of covered entities that received technical assistance from the Secretary during such year in order to achieve compliance with such provisions and the types of such technical assistance provided;
(C) the number of such complaints that have resulted in the imposition of civil monetary penalties or have been resolved through monetary settlements, including the nature of the complaints involved and the amount paid in each penalty or settlement;
(D) the number of compliance reviews conducted and the outcome of each such review;
(E) the number of subpoenas or inquiries issued;
(F) the Secretary’s plan for improving compliance with and enforcement of such provisions for the following year; and
(G) the number of audits performed and a summary of audit findings purs
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17921
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** Consistent with the authority of the Secretary under sections 1320d–5 and 1320d–6 of this title, when making determinations relating to fines under such section 1320d–5 (as amended by section 13410 of Pub. L. 111–5) or such section 1320d–6, decreasing the length and extent of an audit under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim), or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may—
(1) mitigate fines under [section 1320d–5 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim) (as amended by section 13410 of Pub. L. 111–5);
(2) result in the early, favorable termination of an audit under [section 17940 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17940&num=0&edition=prelim); and
(3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Department of Health and Human Services.
**(b) Definition and miscellaneous provisions**
(1) **Recognized security practices** — The term “recognized security practices” means the standards, guidelines, best practices, methodologies, procedures, and processes developed under [section 272(c)(15) of title 15](https://uscode.house.gov/view.xhtml?req=granuleid:USC-preli
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17951
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
For purposes of this part:
(1) **Code set** — The term “code set” means any set of codes used for encoding data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes.
(2) **Health care clearinghouse** — The term “health care clearinghouse” means a public or private entity that processes or facilitates the processing of nonstandard data elements of health information into standard data elements.
(3) **Health care provider** — The term “health care provider” includes a provider of services (as defined in [section 1395x(u) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1395x/u&num=0&edition=prelim)), a provider of medical or other health services (as defined in [section 1395x(s) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1395x/s&num=0&edition=prelim)), and any other person furnishing health care services or supplies.
(4) **Health information** — The term “health information” means any information, whether oral or recorded in any form or medium, that—
(A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
(5) **Health plan** — The term “health plan” means an individual or group plan that provides, or pays the cost of, medical care (as such term is defined in [section 300gg–91 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section300gg-9
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 1320d
Stored review status: release_metadata_unconfirmed. The source passage cites 42 U.S.C. § 1320d. This identifies an authority to review, not proof of applicability.
Federal law — U.S. Code and appendices · legal_authorities
Page 2746
TITLE 42—THE PUBLIC HEALTH AND WELFARE
§ 1320c–20
1 So in original. Probably should be ‘‘Part’’.
tions between Professional Standards Review Organiza-
tions and administrative instrumentalities.
Section 1320c–15, act Aug. 14, 1935, ch. 531, title XI,
§ 1166, as added Oct. 30, 1972, Pub. L. 92–603, title II,
§ 249F(b), 86 Stat. 1443; amended Oct. 25, 1977, Pub. L.
95–142, § 5(h), 91 Stat. 1189, related to general prohibi-
tion against disclosure of data or information and ex-
ceptions to such prohibition. See section 1320c–9 of this
title.
Section 1320c–16, act Aug. 14, 1935, ch. 531, title XI,
§ 1167, as added Oct. 30, 1972, Pub. L. 92–603, title II,
§ 249F(b), 86 Stat. 1443; amended Oct. 25, 1977, Pub. L.
95–142, § 5(i), (n), 91 Stat. 1190, 1191, related to limitation
of liability of persons providing information to Profes-
sional Standards Review Organizations and Statewide
Professional Standards Review Councils. See section
1320c–6 of this title.
Section 1320c–17, act Aug. 14, 1935, ch. 531, title XI,
§ 1168, as added Oct. 30, 1972, Pub. L. 92–603, title II,
§ 249F(b), 86 Stat. 1444; amended Dec. 31, 1975, Pub. L.
94–182, title I, § 112(c), 89 Stat. 1055; Oct. 25, 1977, Pub. L.
95–142, § 5(j), 91 Stat. 1190; Aug. 13, 1981, Pub. L. 97–35,
title XXI, § 2113(j), 95 Stat. 795, related to authorization
for use of funds for administering professional review
program, transfer of moneys between funds, and pay-
ments for Professional Standards Review Organiza-
tions. See section 1320c–8 of this title.
Section 1320c–18, act Aug. 14, 1935, ch. 531, title XI,
§ 1169, as added Oct. 30, 1972, Pub. L. 92–603, title II,
§ 249F(b), 86 Stat. 1444, related to technical assistance
given to organizations desiring to be designated as Pro-
fessional Stand
Source: Supplied 2024 U.S. Code historical extraction · 42 U.S.C. § 1320d
Stored review status: historical_2024_not_currentness_verified. The source passage cites 42 U.S.C. § 1320d. This identifies an authority to review, not proof of applicability.
Federal law — U.S. Code and appendices · legal_authorities
Page 9077
TITLE 42—THE PUBLIC HEALTH AND WELFARE
§ 17940
1 So in original. Probably should be ‘‘this’’.
2 So in original. Probably should be ‘‘sections’’.
164.308(b) of such title, with such entity and
shall be treated as a business associate of the
covered entity for purposes of the provisions of
this subchapter and subparts C and E of part 164
of title 45, Code of Federal Regulations, as such
provisions are in effect as of February 17, 2009.
(Pub. L. 111–5, div. A, title XIII, § 13408, Feb. 17,
2009, 123 Stat. 271.)
Editorial Notes
REFERENCES IN TEXT
This subchapter, referred to in text, was in the origi-
nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.)
of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123
Stat. 258, which is classified principally to this sub-
chapter. For complete classification of subtitle D to
the Code, see Tables.
Statutory Notes and Related Subsidiaries
EFFECTIVE DATE
Section effective 12 months after Feb. 17, 2009, except
as otherwise specifically provided, see section 13423 of
Pub. L. 111–5, set out as a note under section 17931 of
this title.
§ 17939. Improved enforcement
(a) In general
(1) Omitted
(2) Enforcement under Social Security Act
Any violation by a covered entity under
thus 1 subchapter is subject to enforcement
and penalties under section 2 1176 and 1177 of
the Social Security Act [42 U.S.C. 1320d–5,
1320d–6].
(b) Effective date; regulations
(1) The amendments made by subsection (a)
shall apply to penalties imposed on or after the
date that is 24 months after February 17, 2009.
(2) Not later than 18 months after February 17,
2009, the Secretary of Health and Human Serv-
ices shall promulgate regulations to implement
such amendments.
(c) Distribution of certain civil monetary pen
Source: Supplied 2024 U.S. Code historical extraction · 42 U.S.C. § 17940
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.