HITECH Act 13412: Section 13412 (added by Public Law 116-321, 2021): recognized security practices in place for the prior twelve months are considered in fines, audits and settlements

When determining fines under section 1176 or 1177, decreasing the length and extent of an audit under 13411, or agreeing remedies for potential Security Rule violations, the Secretary must consider whether the covered entity or business associate has adequately demonstrated that it had recognized security practices in place for not less than the previous twelve months. Recognized security practices are the standards, guidelines, best practices, methodologies, procedures and processes developed under section 2(c)(15) of the NIST Act (the Cybersecurity Framework), the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015 (the Health Industry Cybersecurity Practices), and other programmes recognized through regulation, chosen by the entity consistent with the Security Rule; the section gives no authority to increase fines or audits for not adopting them and creates no liability for non-participation.