By way of background, on January 3, 2020, the Health Information Technology for Economic and Clinical Health (HITECH) Act was amended, creating a kind of “safe harbor” for HIPAA covered entities and their business associates when facing potential fines and other penalties under HIPAA. If the covered entity or business associate can “adequately demonstrate” to the Secretary of DHHS that it had “recognized security practices” in place for at least the 12 month period prior to the conduct in question—HIPAA violation, breach event or audit—the Secretary may determine to mitigate any fines to be assessed, favorably terminate early an audit that has been undertaken, or mitigate the remedies in any settlement agreement that may be entered into between the covered entity or business associate and the government. In short, a covered entity or business associate that has experienced a data breach incident and is responding to the related DHHS investigation and document requests, or is otherwise under a HIPAA audit or investigation, may be able to reduce or eliminate fines and penalties if it can sufficiently demonstrate its implementation of recognized security practices.