---
kind: "section"
citation: "42 U.S.C. § 17941"
title: "42"
title_heading: "The Public Health and Welfare"
number: "17941"
heading: "Recognition of security practices"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/42/17941"
units:
  - "Chapter 156 — Health Information Technology"
  - "Subchapter III — Privacy"
  - "Part A — Improved Privacy Provisions and Security Provisions"
---

# §17941. Recognition of security practices

- (a) **In general—** Consistent with the authority of the [Secretary](/usc/42/17921.md?p=13) under sections [1320d–5](/usc/42/1320d–5.md) and [1320d–6](/usc/42/1320d–6.md) of this title, when making determinations relating to fines under such [section 1320d–5](/usc/42/1320d–5.md) (as amended by section 13410 of Pub. L. 111–5) or such [section 1320d–6](/usc/42/1320d–6.md), decreasing the length and extent of an audit under [section 17940 of this title](/usc/42/17940.md), or remedies otherwise agreed to by the [Secretary](/usc/42/17921.md?p=13), the [Secretary](/usc/42/17921.md?p=13) shall consider whether the [covered entity](/usc/42/17921.md?p=3) or [business associate](/usc/42/17921.md?p=2) has adequately demonstrated that it had, for not less than the previous 12 months, recognized [security](/usc/42/17921.md?p=14) [practices](/usc/42/17061.md?p=19) in place that may—
  - (1) mitigate fines under [section 1320d–5 of this title](/usc/42/1320d–5.md) (as amended by section 13410 of Pub. L. 111–5);
  - (2) result in the early, favorable termination of an audit under [section 17940 of this title](/usc/42/17940.md); and
  - (3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential [violations](/usc/42/2000e–16a.md?p=c) of the HIPAA [Security](/usc/42/17921.md?p=14) rule (part [160](/usc/45/160.md) of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the [covered entity](/usc/42/17921.md?p=3) or [business associate](/usc/42/17921.md?p=2) and the Department of Health and Human Services.
- (b) **Definition and miscellaneous provisions—**
  - (1) **Recognized security practices—** The term “recognized [security](/usc/42/17921.md?p=14) [practices](/usc/42/17061.md?p=19)” means the standards, guidelines, best [practices](/usc/42/17061.md?p=19), methodologies, procedures, and processes developed under [section 272(c)(15) of title 15](/usc/15/272.md?p=c-15), the approaches promulgated under [section 1533(d) of title 6](/usc/6/1533.md?p=d), and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such [practices](/usc/42/17061.md?p=19) shall be determined by the [covered entity](/usc/42/17921.md?p=3) or [business associate](/usc/42/17921.md?p=2), consistent with the HIPAA [Security](/usc/42/17921.md?p=14) rule (part [160](/usc/45/160.md) of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title).
  - (2) **Limitation—** Nothing in this section shall be construed as providing the [Secretary](/usc/42/17921.md?p=13) authority to increase fines under [section 1320d–5 of this title](/usc/42/1320d–5.md) (as amended by section 13410 of Pub. L. 111–5), or the length, extent or quantity of audits under [section 17940 of this title](/usc/42/17940.md), due to a lack of compliance with the recognized [security](/usc/42/17921.md?p=14) [practices](/usc/42/17061.md?p=19).
  - (3) **No liability for nonparticipation—** Subject to [paragraph (4)](#b-4), nothing in this section shall be construed to subject a [covered entity](/usc/42/17921.md?p=3) or [business associate](/usc/42/17921.md?p=2) to liability for electing not to engage in the recognized [security](/usc/42/17921.md?p=14) [practices](/usc/42/17061.md?p=19) defined by this section.
  - (4) **Rule of construction—** Nothing in this section shall be construed to limit the [Secretary](/usc/42/17921.md?p=13)’s authority to enforce the HIPAA [Security](/usc/42/17921.md?p=14) rule (part [160](/usc/45/160.md) of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or [business associate](/usc/42/17921.md?p=2)’s obligations under the HIPAA [Security](/usc/42/17921.md?p=14) rule.

## Source credit

(Pub. L. 111–5, div. A, title XIII, § 13412, as added Pub. L. 116–321, § 1, Jan. 5, 2021, 134 Stat. 5072.)