Health Information Technology for Economic and Clinical Health (HITECH)

In February 2009, the American Recovery and Reinvestment Act (ARRA) was signed into law. ARRA includes legislation provisions that redefine and revitalize the HIPAA enforcement process; known as the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act is intended to promote the widespread adoption of health information technology (HIT) to support the electronic sharing of clinical data among hospitals, physicians, and other health care stakeholders. HIT is widely viewed as a necessary and vital component of health care reform. It encompasses interoperable electronic health records (EHRs)including computerized systems to order tests and medications, and support systems to aid clinical decision makingand the development of a national health information network to permit the secure exchange of electronic health information among providers.

The HITECH Act places emphasis on key IT-related healthcare policy objectives:

• Encourage adoption of electronic patient healthcare records (EHR) by 2014


• Disclose PHI data breaches in a timely manner, with very specific requirements


• Extend HIPAA requirements to business associates and non-HIPAA covered entities


• Add “teeth” to HIPAA by granting additional authority to State Attorney generals and the FTC for HIPAA enforcement.


• Periodic audits of HIPAA Privacy and Security requirements, such as access control

These objectives represent a major challenge for covered entities that must begin a massive transition from paper to electronic records, while adhering to stricter privacy requirements. The expansion of HIPAA rule applicability to non-HIPAA covered entities is significant even more today, over ten years after HIPAA was enacted, given the wide availability of electronic healthcare/medical records and vendors who provide products or services to manage EHR/EMR.