; (2) result in the early, favorable termination of an audit under section 13411; and (3) limit the remedies that would otherwise be agreed to in any agreement between the entity or business associate and the Department of Health and Human Services. (b) Additional consideration At the election of the entity or business associate, the Secretary may provide further consideration to an entity or business associate that can adequately demonstrate that such recognized security practices were in place, as determined by the Secretary. (c) Definition and miscellaneous provisions (1) Recognized security practices The term recognized security practices means the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology Act, the approaches promulgated under section 405(d) of the Cybersecurity Information Sharing Act of 2015, and any other program or processes that are equivalent to such requirements as may be developed through regulations. Such practices shall be determined by the entity or business associate, except where additional consideration is requested under subsection (b). (2) Limitation Nothing in this section shall be construed as providing the Secretary authority to— (A) increase fines under section 13410, or the length, extent or quantity of audits under section 13411, due to a lack of compliance with the recognized security practices