HIPAA Glossary · Laws & rules
HITECH Act
The 2009 law that strengthened HIPAA — created breach notification, extended direct liability to business associates, and set the four-tier penalty structure.
Context
HITECH (the Health Information Technology for Economic and Clinical Health Act) was enacted as part of the 2009 American Recovery and Reinvestment Act. It created the breach notification requirement, extended direct HIPAA liability to business associates, established the four-tier penalty structure, and authorised state attorney general enforcement — the enforcement regime most practitioners actually work with today.
Related terms
- HIPAA — The Health Insurance Portability and Accountability Act of 1996 — the federal law that sets US healthcare privacy and security obligations.
- Omnibus Rule — The 2013 final rule implementing HITECH — direct business associate liability, the revised breach standard, and updated authorisation requirements.
- Business associate — A person or organisation that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- Civil money penalty — The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.