,,ii  #aafth ,,congress  #b;d ,session  
,h4 ,r4 #ghih  ,,in ,,the ,,senate ,,of 
,,the ,,united ,,states  ,december #aj1 
#bjbj,received  ,,an ,,act  ,to amend   
the ,health ,information ,technology for
 ,economic and ,clinical ,health ,act to
 require the ,secretary of ,health and  
,human ,services to consider certain    
recognized security practices of covered
 entities and business associates when  
making certain determinations1 and for  
other purposes4  #a4 ,recognition of    
security practices ,part #a of subtitle 
,d of the ,health ,information          
,technology for ,economic and ,clinical 
,health ,act 7#db ,u4,s4,c4 #agica et   
seq47 is amended by adding at the end   
the following3  #acdab4 ,recognition of 
security practices  7a7 ,in general     
,consistent with the authority of the   
,secretary under sections #aagf and     
#aagg of the ,social ,security ,act1    
when making determinations relating to  
fines under such section #aagf 7as      
amended by section #acdaj7 or such      

section #aagg1 decreasing the length and
 extent of an audit under section       
#acdaa1 or remedies otherwise agreed to 
by the ,secretary1 the ,secretary shall 
consider whether the covered entity or  
business associate has adequately       
demonstrated that it had1 for not less  
than the previous #ab months1 recognized
 security practices in place that may-- 
7#a7 mitigate fines under section #aagf 
of the ,social ,security ,act 7as       
amended by section #acdaj72  7#b7 result
 in the early1 favorable termination of 
an audit under section #acdaa2 and  7#c7
 mitigate the remedies that would       
otherwise be agreed to in any agreement 
with respect to resolving potential     
violations of the ,,hipaa ,security rule
 7part #afj of title #de ,code of       
,federal ,regulations and subparts ,a   
and ,c of part #afd of such title7      
between the covered entity or business  
associate and the ,department of ,health
 and ,human ,services4  7b7 ,definition 
and miscellaneous provisions  7#a7      

,recognized security practices ,the term
 recognized security practices means the
 standards1 guidelines1 best practices1 
methodologies1 procedures1 and processes
 developed under section #b7;c77#ae7 of 
the ,national ,institute of ,standards  
and ,technology ,act1 the approaches    
promulgated under section #dje7;d7 of   
the ,cybersecurity ,act of #bjae1 and   
other programs and processes that       
address cybersecurity and that are      
developed1 recognized1 or promulgated   
through regulations under other         
statutory authorities4 ,such practices  
shall be determined by the covered      
entity or business associate1 consistent
 with the ,,hipaa ,security rule 7part  
#afj of title #de ,code of ,federal     
,regulations and subparts ,a and ,c of  
part #afd of such title74  7#b7         
,limitation ,nothing in this section    
shall be construed as providing the     
,secretary authority to increase fines  
under section #aagf of the ,social      
,security ,act 7as amended by section   

#acdaj71 or the length1 extent or       
quantity of audits under section #acdaa1
 due to a lack of compliance with the   
recognized security practices4  7#c7 ,no
 liability for nonparticipation ,subject
 to paragraph 7#d71 nothing in this     
section shall be construed to subject a 
covered entity or business associate to 
liability for electing not to engage in 
the recognized security practices       
defined by this section4  7#d7 ,rule of 
construction ,nothing in this section   
shall be construed to limit the         
,secretary's authority to enforce the   
,,hipaa ,security rule 7part #afj of    
title #de ,code of ,federal ,regulations
 and subparts ,a and ,c of part #afd of 
such title71 or to supersede or conflict
 with an entity or business associate's 
obligations under the ,,hipaa ,security 
rule4  4  #b4 ,technical correction  7a7
 ,in general ,section #cjbb7;b7 of the  
,public ,health ,service ,act 7#db      
,u4,s4,c4 #cjj;jj-#eb7;b77 is amended by
 adding at the end the following new    

paragraph3  7#d7 ,application of        
authorities under ,inspector ,general   
,act of #aigh ,in carrying out this     
subsection1 the ,inspector ,general     
shall have the same authorities as      
provided under section #f of the        
,inspector ,general ,act of #aigh 7#e   
,u4,s4,c4 ,app474  4  7b7 ,effective    
date ,the amendment made by subsection  
7a7 shall take effect as if included in 
the enactment of the #bast ,century     
,cures ,act 7,public ,law #aad-bee74    
,passed the ,house of ,representatives  
,december #i1 #bjbj4;,cheryl ,l4        
,johnson1,clerk4