--- title: "42 U.S.C. 17939 HIPAA: Improved enforcement" canonical: "https://dposchool.com/hipaa/section/17939" source: "https://uscode.house.gov/us/usc/119-136/t42/s17939/" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-22" language: "en" publisher: "DPO School" --- 42 U.S.C. 17939 HIPAA · Chapter 156: HEALTH INFORMATION TECHNOLOGY # 42 U.S.C. 17939 HIPAA: Improved enforcement United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. ## Official text ### 42 U.S.C. 17939(a) **(a)** In general #### 42 U.S.C. 17939(a)(1) **(1)** Omitted #### 42 U.S.C. 17939(a)(2) **(2)** Enforcement under Social Security Act Any violation by a covered entity under thus 1 subchapter is subject to enforcement and penalties under section 2 1176 and 1177 of the Social Security Act \[42 U.S.C. 1320d–5, 1320d–6\]. ### 42 U.S.C. 17939(b) **(b)** Effective date; regulations #### 42 U.S.C. 17939(b)(1) **(1)** The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009. #### 42 U.S.C. 17939(b)(2) **(2)** Not later than 18 months after February 17, 2009, the Secretary of Health and Human Services shall promulgate regulations to implement such amendments. ### 42 U.S.C. 17939(c) **(c)** Distribution of certain civil monetary penalties collected #### 42 U.S.C. 17939(c)(1) **(1)** In general Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Security Act (42 U.S.C. 1320d–5) insofar as such section relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009. #### 42 U.S.C. 17939(c)(2) **(2)** GAO report Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommendations for a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense. #### 42 U.S.C. 17939(c)(3) **(3)** Establishment of methodology to distribute percentage of CMPS collected to harmed individuals Not later than 3 years after February 17, 2009, the Secretary shall establish by regulation and based on the recommendations submitted under paragraph (2), a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense. #### 42 U.S.C. 17939(c)(4) **(4)** Application of methodology The methodology under paragraph (3) shall be applied with respect to civil monetary penalties or monetary settlements imposed on or after the effective date of the regulation. ### 42 U.S.C. 17939(d) **(d)** Tiered increase in amount of civil monetary penalties #### 42 U.S.C. 17939(d)(1) **(1)** to (3) Omitted #### 42 U.S.C. 17939(d)(4) **(4)** Effective date The amendments made by this subsection shall apply to violations occurring after February 17, 2009. ### 42 U.S.C. 17939(e) **(e)** Enforcement through State attorneys general #### 42 U.S.C. 17939(e)(1) **(1)** , (2) Omitted #### 42 U.S.C. 17939(e)(3) **(3)** Effective date The amendments made by this subsection shall apply to violations occurring after February 17, 2009. ## Notes in the official text - (1) So in original. Probably should be “this”. - (2) So in original. Probably should be “sections”. ## Source Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source credit: ( Pub. L. 111-5, div. A, title XIII, § 13410 , Feb. 17, 2009 , 123 Stat. 271 .) [42 U.S.C. 17939 on the Office of the Law Revision Counsel](https://uscode.house.gov/us/usc/119-136/t42/s17939/) United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 42 U.S.C. 17939 Previous: [42 U.S.C. 17938 HIPAA: Business associate contracts required for certain entities](https://dposchool.com/hipaa/section/17938) Next: [42 U.S.C. 17940 HIPAA: Audits](https://dposchool.com/hipaa/section/17940) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents