OCR Seeks Input on “Recognized Security Practices” as Mitigating Factor for HIPAA and HITECH Fines

Lexology May 26, 2022
McGuireWoods LLP

• In 2021, HITECH was amended to add “recognized cybersecurity practices” as a mitigating factor when determining fines, audits and remedies against covered entities and business associates for violations of HIPAA.
• HHS now seeks public comment on what should be considered a recognized cybersecurity practice.
• Covered entities and business associates should update their HIPAA compliance plans to incorporate the recognized cybersecurity practices, implement the identified security practices and ensure they have been actively and consistently used over the prior 12-month period of time.

On Jan. 5, 2021, Public Law 116-321 amended the Health Information Technology for Economic and Clinical Health (HITECH) Act to require the Department of Health and Human Services (HHS) to consider covered entities’ (most healthcare providers,...

Today's Sponsors

Today's Sponsor