The Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”): Congress Includes Sweeping Expansion of HIPAA and Data Breach Notification Requirements in the Stimulus Bill

HIPAA Covered Entities and Business Associates affected. Personal Health Records (PHR), Electronic Health Records (EHR) and Health Information Exchanges (HIE) subject to new federal requirements.

The American Recovery and Reinvestment Act of 2009, the “Stimulus Bill,” includes Title XIII – “Health Information Technology,” also known as the “Health Information Technology for Economic and Clinical Health Act” or “HITECH Act.” The HITECH Act contains significant expansions of the HIPAA Privacy and Security Rules and numerous other changes that will have a major impact on the health care information and technology sector. Virtually every health care provider and third party service provider that stores or accesses individuals’ medical information will be affected by this new federal law.

This Ober|Kaler Health Information Privacy, Security and Technology Bulletin provides an overview of Subtitle D of the HITECH ACT: “Privacy,” particularly Part 1 “Improved Privacy Provisions and Security Provisions.”