42 U.S.C. § 17940 — Audits

Page 9077 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17940 1 So in original. Probably should be ‘‘this’’. 2 So in original. Probably should be ‘‘sections’’. 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009. (Pub. L. 111–5, div. A, title XIII, § 13408, Feb. 17, 2009, 123 Stat. 271.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17939. Improved enforcement (a) In general (1) Omitted (2) Enforcement under Social Security Act Any violation by a covered entity under thus 1 subchapter is subject to enforcement and penalties under section 2 1176 and 1177 of the Social Security Act [42 U.S.C. 1320d–5, 1320d–6]. (b) Effective date; regulations (1) The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009. (2) Not later than 18 months after February 17, 2009, the Secretary of Health and Human Serv- ices shall promulgate regulations to implement such amendments. (c) Distribution of certain civil monetary pen- alties collected (1) In general Subject to the regulation promulgated pur- suant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Secu- rity Act (42 U.S.C. 1320d–5) insofar as such sec- tion relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provi- sions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regula- tions, as such provisions are in effect as of February 17, 2009. (2) GAO report Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommenda- tions for a methodology under which an indi- vidual who is harmed by an act that con- stitutes an offense referred to in paragraph (1) may receive a percentage of any civil mone- tary penalty or monetary settlement collected with respect to such offense. (3) Establishment of methodology to distribute percentage of CMPS collected to harmed individuals Not later than 3 years after February 17, 2009, the Secretary shall establish by regula- tion and based on the recommendations sub- mitted under paragraph (2), a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary set- tlement collected with respect to such offense. (4) Application of methodology The methodology under paragraph (3) shall be applied with respect to civil monetary pen- alties or monetary settlements imposed on or after the effective date of the regulation. (d) Tiered increase in amount of civil monetary penalties (1) to (3) Omitted (4) Effective date The amendments made by this subsection shall apply to violations occurring after Feb- ruary 17, 2009. (e) Enforcement through State attorneys general (1), (2) Omitted (3) Effective date The amendments made by this subsection shall apply to violations occurring after Feb- ruary 17, 2009. (Pub. L. 111–5, div. A, title XIII, § 13410, Feb. 17, 2009, 123 Stat. 271.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in subsecs. (a)(2) and (c)(1), was in the original ‘‘this subtitle’’, meaning sub- title D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this subchapter. For complete classifica- tion of subtitle D to the Code, see Tables. For reference to ‘‘the amendments made by sub- section (a)’’ in subsec. (b)(1) and ‘‘the amendments made by this subsection’’ in subsecs. (d)(4) and (e)(3), see Codification note below. CODIFICATION Section is comprised of section 13410 of Pub. L. 111–5. Subsecs. (a)(1), (d)(1)–(3), (e)(1), (2), and (f) of section 13410 of Pub. L. 111–5 amended section 1320d–5 of this title. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17940. Audits The Secretary shall provide for periodic audits to ensure that covered entities and business as- Page 9078 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17941 sociates that are subject to the requirements of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009, comply with such requirements. (Pub. L. 111–5, div. A, title XIII, § 13411, Feb. 17, 2009, 123 Stat. 276.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17941. Recognition of security practices (a) In general Consistent with the authority of the Secretary under sections 1320d–5 and 1320d–6 of this title, when making determinations relating to fines under such section 1320d–5 (as amended by sec- tion 13410 of Pub. L. 111–5) or such section 1320d–6, decreasing the length and extent of an audit under section 17940 of this title, or rem- edies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered en- tity or business associate has adequately dem- onstrated that it had, for not less than the pre- vious 12 months, recognized security practices in place that may— (1) mitigate fines under section 1320d–5 of this title (as amended by section 13410 of Pub. L. 111–5); (2) result in the early, favorable termination of an audit under section 17940 of this title; and (3) mitigate the remedies that would other- wise be agreed to in any agreement with re- spect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Depart- ment of Health and Human Services. (b) Definition and miscellaneous provisions (1) Recognized security practices The term ‘‘recognized security practices’’ means the standards, guidelines, best prac- tices, methodologies, procedures, and proc- esses developed under section 272(c)(15) of title 15, the approaches promulgated under section 1533(d) of title 6, and other programs and proc- esses that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the cov- ered entity or business associate, consistent with the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title). (2) Limitation Nothing in this section shall be construed as providing the Secretary authority to increase fines under section 1320d–5 of this title (as amended by section 13410 of Pub. L. 111–5), or the length, extent or quantity of audits under section 17940 of this title, due to a lack of com- pliance with the recognized security practices. (3) No liability for nonparticipation Subject to paragraph (4), nothing in this sec- tion shall be construed to subject a covered entity or business associate to liability for electing not to engage in the recognized secu- rity practices defined by this section. (4) Rule of construction Nothing in this section shall be construed to limit the Secretary’s authority to enforce the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or business associate’s obligations under the HIPAA Security rule. (Pub. L. 111–5, div. A, title XIII, § 13412, as added Pub. L. 116–321, § 1, Jan. 5, 2021, 134 Stat. 5072.) PART B—RELATIONSHIP TO OTHER LAWS; REGU- LATORY REFERENCES; EFFECTIVE DATE; RE- PORTS § 17951. Relationship to other laws (a) Application of HIPAA State preemption Section 1178 of the Social Security Act (42 U.S.C. 1320d–7) shall apply to a provision or re- quirement under this subchapter in the same manner that such section applies to a provision or requirement under part C of title XI of such Act [42 U.S.C. 1320d et seq.] or a standard or im- plementation specification adopted or estab- lished under sections 1172 through 1174 of such Act [42 U.S.C. 1320d–1 to 1320d–3]. (b) Health Insurance Portability and Account- ability Act of 1996 The standards governing the privacy and secu- rity of individually identifiable health informa- tion promulgated by the Secretary under sec- tions 262(a) and 264 of the Health Insurance Portability and Accountability Act of 1996 shall remain in effect to the extent that they are con- sistent with this subchapter. The Secretary shall by rule amend such Federal regulations as required to make such regulations consistent with this subchapter. (c) Construction Nothing in this subchapter shall constitute a waiver of any privilege otherwise applicable to an individual with respect to the protected health information of such individual. (Pub. L. 111–5, div. A, title XIII, § 13421, Feb. 17, 2009, 123 Stat. 276.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub-