116TH CONGRESS 

2D SESSION H. R. 7898 

AN ACT 

To amend the Health Information Technology for Economic 

and Clinical Health Act to require the Secretary of 

Health and Human Services to consider certain recognized security practices of covered entities and business 

associates when making certain determinations, and for 

other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•HR 7898 EH

1 SECTION 1. RECOGNITION OF SECURITY PRACTICES. 

2 Part 1 of subtitle D of the Health Information Tech3 nology for Economic and Clinical Health Act (42 U.S.C. 

4 17931 et seq.) is amended by adding at the end the fol5 lowing: 

6 ‘‘SEC. 13412. RECOGNITION OF SECURITY PRACTICES. 

7 ‘‘(a) IN GENERAL.—Consistent with the authority of 

8 the Secretary under sections 1176 and 1177 of the Social 

9 Security Act, when making determinations relating to 

10 fines under such section 1176 (as amended by section 

11 13410) or such section 1177, decreasing the length and 

12 extent of an audit under section 13411, or remedies other13 wise agreed to by the Secretary, the Secretary shall con14 sider whether the covered entity or business associate has 

15 adequately demonstrated that it had, for not less than the 

16 previous 12 months, recognized security practices in place 

17 that may— 

18 ‘‘(1) mitigate fines under section 1176 of the 

19 Social Security Act (as amended by section 13410); 

20 ‘‘(2) result in the early, favorable termination 

21 of an audit under section 13411; and 

22 ‘‘(3) mitigate the remedies that would otherwise 

23 be agreed to in any agreement with respect to re24 solving potential violations of the HIPAA Security 

25 rule (part 160 of title 45 Code of Federal Regula26 tions and subparts A and C of part 164 of such 
3 

•HR 7898 EH

1 title) between the covered entity or business asso2 ciate and the Department of Health and Human 

3 Services. 

4 ‘‘(b) DEFINITION AND MISCELLANEOUS PROVI5 SIONS.— 

6 ‘‘(1) RECOGNIZED SECURITY PRACTICES.—The 

7 term ‘recognized security practices’ means the stand8 ards, guidelines, best practices, methodologies, pro9 cedures, and processes developed under section 

10 2(c)(15) of the National Institute of Standards and 

11 Technology Act, the approaches promulgated under 

12 section 405(d) of the Cybersecurity Act of 2015, and 

13 other programs and processes that address cyberse14 curity and that are developed, recognized, or promul15 gated through regulations under other statutory au16 thorities. Such practices shall be determined by the 

17 covered entity or business associate, consistent with 

18 the HIPAA Security rule (part 160 of title 45 Code 

19 of Federal Regulations and subparts A and C of 

20 part 164 of such title). 

21 ‘‘(2) LIMITATION.—Nothing in this section 

22 shall be construed as providing the Secretary author23 ity to increase fines under section 1176 of the Social 

24 Security Act (as amended by section 13410), or the 

25 length, extent or quantity of audits under section 
4 

•HR 7898 EH

1 13411, due to a lack of compliance with the recog2 nized security practices. 

3 ‘‘(3) NO LIABILITY FOR NONPARTICIPATION.— 

4 Subject to paragraph (4), nothing in this section 

5 shall be construed to subject a covered entity or 

6 business associate to liability for electing not to en7 gage in the recognized security practices defined by 

8 this section. 

9 ‘‘(4) RULE OF CONSTRUCTION.—Nothing in 

10 this section shall be construed to limit the Sec11 retary’s authority to enforce the HIPAA Security 

12 rule (part 160 of title 45 Code of Federal Regula13 tions and subparts A and C of part 164 of such 

14 title), or to supersede or conflict with an entity or 

15 business associate’s obligations under the HIPAA 

16 Security rule.’’. 

17 SEC. 2. TECHNICAL CORRECTION. 

18 (a) IN GENERAL.—Section 3022(b) of the Public 

19 Health Service Act (42 U.S.C. 300jj–52(b)) is amended 

20 by adding at the end the following new paragraph: 

21 ‘‘(4) APPLICATION OF AUTHORITIES UNDER IN22 SPECTOR GENERAL ACT OF 1978.—In carrying out 

23 this subsection, the Inspector General shall have the 

24 same authorities as provided under section 6 of the 

25 Inspector General Act of 1978 (5 U.S.C. App.).’’. 
5 

•HR 7898 EH

1 (b) EFFECTIVE DATE.—The amendment made by 

2 subsection (a) shall take effect as if included in the enact3 ment of the 21st Century Cures Act (Public Law 114– 

4 255). 

Passed the House of Representatives December 9, 

2020. 

Attest: 

Clerk. 
116TH CONGRESS 

2D SESSION H. R. 7898 

AN ACT 

To amend the Health Information Technology for 

poses. ing certain determinations, and for other purered entities and business associates when maksider certain recognized security practices of covSecretary of Health and Human Services to conEconomic and Clinical Health Act to require the