; (4) employ the applicable content, vocabulary, and technical standards, including, as appropriate, such standards adopted by the Secretary pursuant to title XXX; and (5) employ security and authentication standards, as the Secretary determines appropriate. (d) Rule of construction regarding privacy Nothing in this section shall be construed to alter existing obligations under the privacy, security, and breach notification rules promulgated under section 264(c) of the Health Insurance Portability and Accountability Act (or successor regulations), under part 2 of title 42, Code of Federal Regulations (or successor regulations), under section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g ) (commonly referred to as the Family Educational Rights and Privacy Act of 1974 ), under the amendments made by the Genetic Information Nondiscrimination Act, or under State privacy law. . (b) Effective date Section 2715B of the Public Health Service Act, as added by subsection (a), shall take effect 1 year after the date of enactment of this Act. 502. Recognition of security practices Part 1 of subtitle D of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 et seq.) is amended by adding at the end the following: 13412. Recognition of security practices (a) In general Consistent with the authority of the Secretary under sections 1176 and 1177 of the Social Security Act, when making determinations relating to fines under section 13410, decreasing the length and extent of an audit under section 13411, or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the entity or business associate had, for not less than the previous 12 months, recognized security practices in place that may— (1) mitigate fines under section 13410; (2) result in the early, favorable termination of an audit under section 13411