HITECH Act: Health IT and Enforcement Guide

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, fundamentally strengthened HIPAA by extending its requirements to business associates, establishing mandatory breach notification, introducing tiered penalties for violations, and promoting the adoption of electronic health records through the Meaningful Use program.

What HITECH Covers

HITECH's most significant contribution to healthcare privacy and security was closing gaps in HIPAA. Before HITECH, business associates were only contractually bound to HIPAA through their agreements with covered entities — HITECH made them directly liable for compliance. The Act established the breach notification requirement that did not exist in the original HIPAA statute, requiring notification to individuals, HHS, and media for breaches affecting 500+ individuals.

HITECH also created a tiered penalty structure ranging from $100 to $50,000 per violation (with annual maximums up to $2.1 million per violation category), replacing HIPAA's original flat penalty structure. State attorneys general were empowered to bring civil actions for HIPAA violations, adding another enforcement mechanism.

Who Needs HITECH Compliance

HITECH applies to the same entities as HIPAA — covered entities and business associates — but significantly expanded enforcement to business associates. Any technology vendor, cloud provider, or service provider handling PHI on behalf of a healthcare organization is now directly subject to HIPAA rules through HITECH, not merely contractually obligated.

Implementation Approach

For most organizations, HITECH compliance is achieved through a comprehensive HIPAA compliance program. Key HITECH-specific areas to address include breach notification procedures and timelines, breach risk assessment methodology to determine notification obligations, documentation of business associate direct liability, and readiness for OCR audits and state attorney general investigations.

Cost Considerations

HITECH compliance costs are generally embedded within HIPAA compliance programs. Incremental costs of $15,000 to $150,000 typically cover breach notification procedure development, breach response planning, enhanced security monitoring, and legal readiness for the strengthened enforcement environment. Organizations should also budget for potential breach response costs including forensic investigation and notification services.