42 U.S.C. § 17931 — Application of security provisions and penalties to business associates of covered entities; annual guidance on security provisions
submitted 17 years ago by Pub. L. 111-5 to r/title-42-THE-PUBLIC-HEALTH-AND-WELFARE · 248 words · no verdicts yet
Business associates must follow the same HIPAA security rules as covered entities. A business associate that breaks those security rules faces the same civil and criminal penalties as a covered entity. HHS must issue yearly guidance on the best technical safeguards for these security rules.
(a) Application of security* provisions. The security rules in sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, apply to a business associate* of a covered entity* the same way they apply to the covered entity itself. Any extra security requirements this title places on covered entities also apply to that business associate, and must be written into the business associate agreement between the associate and the covered entity.
(b) Application of civil and criminal penalties. If a business associate violates any security rule named in subsection (a), sections 1320d-5 and 1320d-6 of this title apply to that business associate for that violation the same way they apply to a covered entity that violates the rule.
(c) Annual guidance. Starting with the first year after February 17, 2009, and every year after that, the Secretary* of Health and Human Services must consult with stakeholders and then issue guidance on the most effective and appropriate technical safeguards for carrying out the sections in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including standards developed under section 300jj-12(b)(2)(B)(vi) of this title, as those provisions stood the day before February 17, 2009.
Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate* of a covered entity* in the same manner that such sections apply to the covered entity. The additional requirements of this title 1 that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.
In the case of a business associate that violates any security provision specified in subsection (a), sections 1320d–5 and 1320d–6 of this title shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision.
For the first year beginning after February 17, 2009, and annually thereafter, the Secretary* of Health and Human Services shall, after consultation with stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use* in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 300jj–12(b)(2)(B)(vi) 1 of this title, as added by section 13101 of this Act, as such provisions are in effect as of the date before February 17, 2009.
Source credit: (Pub. L. 111–5, div. A, title XIII, § 13401, Feb. 17, 2009, 123 Stat. 260.)
- 2009Enacted · Pub. L. 111-5 · 123 Stat. 260
A history note hasn’t been published yet. The record shows enactment by Pub. L. 111-5 on 2009-02-17.
all 0 arguments · sorted by: best
no arguments yet — make the first case