I 
116TH CONGRESS 
1ST SESSION H. R. 5386 
To amend the Health Information Technology for Economic and Clinical 
Health Act to require consideration, in certain circumstances, of whether 
a covered entity or business associate has adequately demonstrated that 
it had recognized security practices, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 10, 2019 
Mr. MCNERNEY (for himself and Mr. BUCSHON) introduced the following bill; 
which was referred to the Committee on Energy and Commerce, and in 
addition to the Committee on Ways and Means, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To amend the Health Information Technology for Economic 
and Clinical Health Act to require consideration, in cer-
tain circumstances, of whether a covered entity or busi-
ness associate has adequately demonstrated that it had 
recognized security practices, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Promoting Better Pa-
tient Data Security Act of 2019’’. 
VerDate Sep 11 2014 
00:25 Dec 14, 2019
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5386.IH
H5386
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 2. RECOGNITION OF SECURITY PRACTICES. 
Part 1 of subtitle D of the Health Information Tech-
nology for Economic and Clinical Health Act (42 U.S.C. 
17931 et seq.) is amended by adding at the end the fol-
lowing: 
‘‘SEC. 13412. RECOGNITION OF SECURITY PRACTICES. 
‘‘(a) IN GENERAL.—Consistent with the authority of 
the Secretary under sections 1176 and 1177 of the Social 
Security Act, when making determinations relating to 
fines under section 13410, decreasing the length and ex-
tent of an audit under section 13411, or remedies other-
wise agreed to by the Secretary, the Secretary shall con-
sider whether the covered entity or business associate has 
adequately demonstrated that it had, for not less than the 
previous 12 months, recognized security practices in place 
that may— 
‘‘(1) mitigate fines under section 13410; 
‘‘(2) result in the early, favorable termination 
of an audit under section 13411; and 
‘‘(3) mitigate the remedies that would otherwise 
be agreed to in any agreement with respect to re-
solving potential violations of the HIPAA Security 
rule (part 160 of title 45 Code of Federal Regula-
tions and subparts A and C of part 164 of such 
title) between the covered entity or business asso-
VerDate Sep 11 2014 
00:25 Dec 14, 2019
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5386.IH
H5386
pamtmann on DSKBC07HB2PROD with BILLS
ciate and the Department of Health and Human 
Services. 
‘‘(b) DEFINITION
AND
MISCELLANEOUS
PROVI-
SIONS.— 
‘‘(1) RECOGNIZED SECURITY PRACTICES.—The 
term ‘recognized security practices’ means the stand-
ards, guidelines, best practices, methodologies, pro-
cedures, and processes developed under section 
2(c)(15) of the National Institute of Standards and 
Technology Act, the approaches promulgated under 
section 405(d) of the Cybersecurity Act of 2015, and 
other programs and processes that address cyberse-
curity and that are developed, recognized, or promul-
gated through regulations under other statutory au-
thorities. Such practices shall be determined by the 
covered entity or business associate. 
‘‘(2) LIMITATION.—Nothing in this section 
shall be construed as providing the Secretary author-
ity to increase fines under section 13410, or the 
length, extent or quantity of audits under section 
13411, due to a lack of compliance with the recog-
nized security practices. 
‘‘(3) NO LIABILITY FOR NONPARTICIPATION.— 
Subject to paragraph (4), nothing in this section 
shall be construed to subject a covered entity or 
VerDate Sep 11 2014 
00:25 Dec 14, 2019
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5386.IH
H5386
pamtmann on DSKBC07HB2PROD with BILLS
business associate to liability for electing not to en-
gage in the recognized security practices defined by 
this section. 
‘‘(4) RULE
OF
CONSTRUCTION.—Nothing in 
this section shall be construed to limit the Sec-
retary’s authority to enforce the HIPAA Security 
rule (part 160 of title 45 Code of Federal Regula-
tions and subparts A and C of part 164 of such 
title), or to supersede or conflict with an entity or 
business associate’s obligations under the HIPAA 
Security rule.’’. 
Æ 
VerDate Sep 11 2014 
00:25 Dec 14, 2019
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H5386.IH
H5386
pamtmann on DSKBC07HB2PROD with BILLS