On January 5, 2021, an amendment to the Health Information Technology for Economic and Clinical Health (“HITECH”) Act was signed into law. The amendment requires the U.S. Department of Health and Human Services (“HHS”) to “consider certain recognized security practices of covered entities and business associates when making certain determinations” regarding fines, audit results, or other remedies for resolving potential violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). For organizations subject to HIPAA, the amendment provides substantial incentives to establish or improve their cybersecurity programs. While it does not establish a complete safe harbor from HIPAA enforcement, the amendment does offer organizations a chance to mitigate financial penalties and other negative regulatory actions that may result from a data breach.
Specifically, the amendment instructs HHS to consider “whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may”:
(1) mitigate fines imposed under section 1176 of the Social Security Act (as previously amended by the HITECH Act);
(2) result in an early and favorable termination of an audit conducted pursuant to section 13411 of the HITECH Act; and
(3) mitigate remedies that would otherwise be included in an agreement between a covered entity or business associate and HHS to resolve potential violations of the HIPAA Security Rule (subparts A and C of 45 C.F.R. part 164).
“Recognized security practices” are defined as “the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology [(“NIST”)] Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities.” Notably, consistent with the approach of the HIPAA Security Rule, the amendment does not mandate the adoption of any particular standard and expressly allows covered entities and business associates to decide what recognized security practices are best suited for their organization, consistent with the requirements of the HIPAA Security Rule.
Finally, the amendment does not require the adoption of recognized security practices, specifically stating that covered entities and business associates will not face liability “for electing not to engage in the recognized security practices defined by this section.” However, as the healthcare industry is often the target of cyberattacks, organizations subject to HIPAA should strongly consider implementing a robust cybersecurity framework – not only as a defense to possible regulatory enforcement after a data breach occurs, but also to lower the risk of a data breach in the first place.