Increased civil penalties for failure to comply with security standards and requirements for health information

(a) Increased civil penalties Section 1176 of the Social Security Act (42 U.S.C. 1320d–5) is amended— (1) in subsection (a)(1), in the matter preceding subparagraph (A), by striking subsection (b) and inserting subsections (b) and (d); (2) by redesignating subsections (d) and (e) as subsections (e) and (f); and (3) by inserting after subsection (c) the following new subsection: (d) Special rules for failure To comply with security standards and requirements for health information (1) In general In the case of a violation of the security standards and requirements under section 1173(d) that occurs after the effective date of the requirements under paragraph (1)(B) of such section, the following rules shall apply: (A) Subsection (a)(1)(A) shall be applied by substituting that is at least $500 for that is at least the amount described in paragraph (3)(A) but not to exceed the amount described in paragraph (3)(D). (B) Subsection (a)(1)(B) shall be applied by substituting that is at least $5,000 for that is at least the amount described in paragraph (3)(B) but not to exceed the amount described in paragraph (3)(D). (C) Subsection (a)(1)(C)(i) shall be applied by substituting that is at least $50,000 for that is at least the amount described in paragraph (3)(C) but not to exceed the amount described in paragraph (3)(D). (D) Subsection (a)(1)(C)(ii) shall be applied by substituting that is at least $250,000 for that is at least the amount described in paragraph (3)(D). (E) In addition to the factors described in the second sentence of subsection (a)(1), in determining the amount of a penalty under this section for a violation of the security standards and requirements under section 1173(d), the Secretary shall also base such determination on— (i) the size of the covered entity or business associate (as such terms are defined in section 1173(d)(1)(B)(vi)) subject to the penalty; (ii) the full compliance history of the covered entity or business associate; (iii) good faith efforts to comply with the security standards and requirements; and (iv) such other matters as the Secretary determines appropriate. (F) Subsection (a)(3) shall not apply. (2) Distribution of certain civil monetary penalties collected (A) In general Subject to the regulation promulgated pursuant to subparagraph (B), any civil monetary penalty or monetary settlement collected with respect to a violation of the security standards and requirements under section 1173(d) that occurs after the effective date of such requirements under paragraph (1)(B) of such section shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for the purposes of enforcing the provisions of this part and subparts C and E of part 164 of title 45, Code of Federal Regulations (or any successor regulation). (B) Establishment of methodology to distribute percentage of CMPs collected to harmed individuals Not later than 18 months after the date of the enactment of this subparagraph, the Secretary shall establish by regulation a methodology under which an individual who is harmed by an act that constitutes a violation referred to in subparagraph (A) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such violation. (C) Application of methodology The methodology under subparagraph (B) shall be applied to any civil monetary penalty or monetary settlement collected with respect to a violation of the security standards and requirements under section 1173(d) that occurs after the effective date of such requirements under paragraph (1)(B) of such section.. (b) Striking amendment to the Health Information Technology for Economic and Clinical Health Act related to fines and audits (1) In general Part 1 of subtitle D of the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17931 et seq.), as amended by Public Law 116–321, is amended by striking section 13412. (2) Effective date The amendment made by this subsection shall take effect on the date of enactment of this Act, and apply to determinations made on or after such date.