Enhancing recognition of security practices

(a) Recognized security practices Section 13412(b)(1) of the HITECH Act (42 U.S.C. 17941(b)(1)) is amended, in the first sentence, by inserting, investments, after other programs. (b) Regulation Not later than 1 year after the date of enactment of this Act, the Secretary shall promulgate regulations implementing section 13412 of the HITECH Act (42 U.S.C. 17941), which shall include— (1) recognized security practices that the Secretary may consider when determining fines under such section; (2) the extent to which such recognized security practices should be in place for consideration by the Secretary; (3) procedural requirements or information that shall be submitted by a covered entity or business associate to the Secretary for consideration; and (4) how the Secretary will take into account such recognized security practices when determining fines, earlier favorable termination of audits, or mitigating remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or successor regulations) (commonly known as the HIPAA Security Rule) between the covered entity or business associate and the Department of Health and Human Services. (c) Annual report Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Secretary shall include in the annual report required under section 13424(a) of the HITECH Act (42 U.S.C. 17953(a)) information on implementation of section 13412 of such Act (42 U.S.C. 17941), including an accounting of every case in which the Secretary considered recognized security practices when effectuating audits and assessing fines under such section.