What the HITECH Act means for you

The Health Information Technology for Economic and Clinical Health (HITECH) Act was swept into law as part of the American Recovery and Reinvestment Act of 2009. HITECH affects many aspects of your practice's Health Insurance Portability and Accountability Act (HIPAA) compliance and brings with it increased enforcement and more severe penalties for HIPAA violations. HITECH requires practices to immediately review and modify their existing HIPAA policies and procedures to incorporate the data breach rule's requirements, and to train staff. If a breach has occurred and your protected health information does not meet the safe harbor guidance, then you still need to provide notification only if the breach poses a significant risk of financial, reputational, or other harm to the individual. Once a qualified data breach is discovered, the practice must notify all individuals whose information has been, or is reasonably believed by the practice to have been, accessed, acquired, used, or disclosed as a result of the breach. [PUBLICATION ABSTRACT]