Enhancing recognition of security practices

(a) Recognized security practices Section 13412(b)(1) of the HITECH Act (42 U.S.C. 17941(b)(1)) is amended, in the first sentence, by inserting, investments, after other programs. (b) Guidance Not later than 1 year after the date of enactment of this Act, the Secretary shall issue guidance on the implementation of section 13412 of the HITECH Act (42 U.S.C. 17941), which shall include— (1) recognized security practices (as defined in subsection (b)(1) of such section) that the Secretary may consider when determining fines under such section; (2) the extent to which such recognized security practices should be in place for consideration by the Secretary; and (3) procedural requirements or information that shall be submitted by a covered entity or business associate (as such terms are defined in section 13400 of the HITECH Act (42 U.S.C. 17921)) to the Secretary for consideration. (c) Annual report Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Secretary shall include in the annual report required under section 13424(a) of the HITECH Act (42 U.S.C. 17953(a)) information on implementation of section 13412 of such Act (42 U.S.C. 17941), including an accounting of every case in which the Secretary considered recognized security practices (as defined in subsection (b)(1) of such section) when effectuating audits and assessing fines under such section.

(a) Recognized security practices Section 13412(b)(1) of the HITECH Act (42 U.S.C. 17941(b)(1)) is amended, in the first sentence, by inserting, investments, after other programs. (b) Guidance Not later than 1 year after the date of enactment of this Act, the Secretary shall issue guidance on the implementation of section 13412 of the HITECH Act (42 U.S.C. 17941), which shall include— (1) recognized security practices (as defined in subsection (b)(1) of such section) that the Secretary may consider when determining fines under such section; (2) the extent to which such recognized security practices should be in place for consideration by the Secretary; and (3) procedural requirements or information that shall be submitted by a covered entity or business associate (as such terms are defined in section 13400 of the HITECH Act (42 U.S.C. 17921)) to the Secretary for consideration. (c) Annual report Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Secretary shall include in the annual report required under section 13424(a) of the HITECH Act (42 U.S.C. 17953(a)) information on implementation of section 13412 of such Act (42 U.S.C. 17941), including an accounting of every case in which the Secretary considered recognized security practices (as defined in subsection (b)(1) of such section) when effectuating audits and assessing fines under such section.