Health Information Technology for Economic and Clinical Health Act(HITECH)
The Health Information Technology for Economic and Clinical Health Act came in to existence as part of the American Recovery and Reinvestment Act of 2009. It imposes certain requirements on vendors of personal health records (and other related entities) in the event of certain security breaches relating to protected health information.
In February 2009, President Obama signed the Health Information Technology for Economic and Clinical Health (HITECH) Act as part of his overall economic stimulus plan. The HITECH Act continues the effort of the Health Insurance Portability and Accountability Act (HIPAA) to encourage movement to electronic patient records and to deliver stricter data protection regulations for more secure patient privacy.
Reference:
http://www.eweek.com/c/a/Health-Care-IT/How-to-Secure-Healthcare-Data-to-Meet-HITECH-Act-Compliance/
Enhanced breach notification requirements have major impact on providers, insurance companies and other EPs and their 'business associates':
Breach Notification Final Rule Update
The Interim Final Rule for Breach Notification for Unsecured Protected Health Information, issued pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act, was published in the Federal Register on August 24, 2009, and became effective on September 23, 2009. During the 60-day public comment period on the Interim Final Rule, HHS received approximately 120 comments.
HHS reviewed the public comment on the interim rule and developed a final rule, which was submitted to the Office of Management and Budget (OMB) for Executive Order 12866 regulatory review on May 14, 2010. At this time, however, HHS is withdrawing the breach notification final rule from OMB review to allow for further consideration, given the Department’s experience to date in administering the regulations. This is a complex issue and the Administration is committed to ensuring that individuals’ health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur. We intend to publish a final rule in the Federal Register in the coming months.
Until such time as a new final rule is issued, the Interim Final Rule that became effective on September 23, 2009, remains in effect.
Reference: http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/finalruleupdate.html
