What is the HITECH Act?
The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed into law on 17 February 2009 as part of the American Recovery and Reinvestment Act. Its main aim was to speed up the adoption of electronic health records. One part of it, Subtitle D, deals with privacy and security, and it changed HIPAA in ways that still shape how HIPAA is enforced today.
HITECH isn’t a separate set of rules that organisations follow alongside HIPAA. Its changes were written into the HIPAA rules themselves, mostly through HHS’s Omnibus Rule of 2013. In practice, complying with HIPAA as it stands today means complying with what HITECH added.
What did it change?
- Tougher penalties. HITECH created four tiers of civil penalties that rise with culpability, from violations the organisation didn’t know about to wilful neglect left uncorrected, with much higher minimum and maximum amounts. HHS adjusts the amounts for inflation every year, so check its current figures rather than older tables.
- Breach notification. It required covered entities to notify individuals, HHS and, for larger breaches, the media when unsecured protected health information is breached. HHS implemented this as the Breach Notification Rule (45 CFR 164.400 to 164.414). Business associates must tell the covered entity.
- Business associates directly liable. Vendors that handle protected health information became directly responsible for meeting the Security Rule and parts of the Privacy Rule, not just bound by contract.
- State enforcement. State attorneys general gained the power to bring civil actions for HIPAA violations affecting their residents.
A 2021 amendment also requires HHS to take into account whether an organisation had recognised security practices in place for the previous 12 months when it decides penalties and audits.
How does it relate to other frameworks?
HITECH sits inside HIPAA. Read it with the HIPAA guide, which covers the Privacy, Security and Breach Notification Rules as they apply today.
Sources and official references
- HITECH Act Enforcement Interim Final Rule — US Department of Health and Human Services (official source)
- Breach Notification Rule — US Department of Health and Human Services (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with US Congress; enforced by HHS Office for Civil Rights.
