Health Information Technology for Economic and Clinical Health Act, Subtitle D (Privacy)
HITECH
Health · Breach notification · Data security
HITECH's privacy subtitle created the federal breach notification duty for HIPAA covered entities and business associates, made business associates directly subject to HIPAA security and penalty provisions, and raised HIPAA penalties. A 2021 amendment requires HHS to consider an entity's recognized security practices when setting fines and audit outcomes.
- Where
- Federal
- Citation
- 42 U.S.C. 17921-17954 (Pub. L. 111-5, div. A, title XIII, subtitle D)
- Status
- In force
- In force since
- 2009-02-17
- Last amended
- 2021-01-05
- Enforced by
- HHS Office for Civil Rights; state attorneys general; FTC for section 13407
- People can sue
- No
- Penalties
- Created the tiered HIPAA civil money penalty structure (top statutory tier $50,000 per violation, $1.5 million per year for identical violations, inflation-adjusted) and extended penalties to business associates.
- Applies to
- HIPAA covered entities
- HIPAA business associates (directly liable for Security Rule and certain Privacy Rule duties)
- Vendors of personal health records and PHR related entities (through section 13407, implemented by the FTC Health Breach Notification Rule)
Security duties
- Business associates must comply with the HIPAA Security Rule safeguards and are subject to the same civil and criminal penalties.42 U.S.C. 17931, 17934
Breach duties
- Covered entities must notify each individual whose unsecured PHI is breached; business associates must notify the covered entity.42 U.S.C. 17932(a)-(b)
- Notifications must be made without unreasonable delay and no later than 60 calendar days after discovery.42 U.S.C. 17932(d)
- Notify the Secretary (and media where more than 500 residents of a state are affected) for large breaches.42 U.S.C. 17932(e)
Other duties
- HHS must weigh whether an entity had recognized security practices in place for the prior 12 months when setting fines and audit results.42 U.S.C. 17941
Sources
- Official text
- 42 U.S.C. 17932 (OLRC)
- 42 U.S.C. 17934 (OLRC)
- 42 U.S.C. 17941 (OLRC)
- 42 U.S.C. 1320d-5 (OLRC)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: 42 U.S.C. 17931 and 17932(e) were cited from HITECH structure; only 17932(a),(d), 17934 and 17941 text was read
Research reference, not legal advice.