Bill > HR5386

This bill amends the Health Information Technology for Economic and Clinical Health Act to require the Secretary of Health and Human Services to consider whether a covered entity or business associate has adequately demonstrated that it had recognized security practices in place for at least the previous 12 months when making determinations related to fines, audits, or other remedies under the HIPAA Security rule. The bill defines "recognized security practices" as standards, guidelines, best practices, and other procedures developed under various federal authorities. The bill also specifies that the Secretary cannot use a lack of these recognized security practices to increase fines or the length or extent of audits, and that entities are not liable for electing not to engage in these practices, while clarifying that the Secretary's authority to enforce the HIPAA Security rule is not limited.

Business and Industry, Health and Social Services

https://www.congress.gov/bill/116th-congress/house-bill/5386/all-info