Congress Passes Bill To Mitigate Penalties For Potential HIPAA Violations

On December 19, the Senate passed H.R.7898, which the House of Representatives had previously passed on December 9. This law amends the Health Information Technology for Economic and Clinical Health (HITECH) Act to require the Secretary of Health and Human Services (HHS) to consider certain "recognized security practices" of covered entities and business associates when making determinations to issue fines or penalties under the HIPAA Security Rule. 

The law defines "recognized security practices" as "the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the [NIST] Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities." It is likely that HHS will further specify what security practices meet these standards