The HITECH Act: Impact on HIPAA Compliance

The HITECH Act, passed in 2009, made HIPAA much stronger. It created the Breach Notification Rule. It set four tiers of higher fines, now up to $2,190,294 a year for identical violations. It made business associates (vendors that handle patient data) directly liable. It let state attorneys general sue. It also paid providers to adopt electronic health records.

HITECH Act and Its Impact on HIPAA Compliance

Understanding the HITECH Act

The HITECH Act changed HIPAA dramatically. It turned a privacy law with weak enforcement into a strict, heavily enforced system. Congress passed it in 2009 as part of the American Recovery and Reinvestment Act. HITECH introduced meaningful use requirements that accelerated electronic health record adoption, extended direct liability to business associates for Security Rule violations, and created a tiered civil penalty structure with a calendar-year cap of $1.5 million for identical violations (45 CFR 160.404(b)(2); $2,190,294 today after inflation adjustment, 45 CFR 102.3).

The Health Information Technology for Economic and Clinical Health Act made health data protection stronger in many ways. It set firm deadlines for reporting breaches. It made business associates legally responsible too. It also gave state attorneys general their own power to enforce HIPAA. It raised fines, created breach reporting rules, and pushed healthcare providers to adopt digital health records.

The HITECH Act is over 15 years old, but it still matters in 2026. Many of the tools OCR uses to enforce HIPAA today come from HITECH, not the original 1996 HIPAA law. Practices that know HITECH well can build stronger compliance programs and manage their vendor relationships better.

This guide covers HITECH's key rules and their ongoing effect on HIPAA compliance. For a broader overview, see our healthcare regulatory compliance guide. For HIPAA basics, start with our guide on what HIPAA is.

HITECH Act Overview and Legislative Context

Why HITECH Was Necessary

In 1996, when Congress passed HIPAA, healthcare ran mostly on paper. By the late 2000s, health records had gone digital fast. The original HIPAA law was not built for that world.

Several problems drove the need for HITECH:

• Weak enforcement: HIPAA fines were low. HHS had few resources to investigate breaches.
• Business associate gap: Business associates that handled digital health data (ePHI) were not directly liable for HIPAA breaches. This created a major blind spot.
• No breach reporting rule: HIPAA did not require practices to tell patients when their health data was exposed.
• Slow EHR adoption: digital health records had clear benefits, but high costs kept adoption low.
• Growing cyber threats: Digital health records created new attack targets. Stronger security rules were needed.

Key HITECH Provisions at a Glance

HITECH fixed these gaps with several major rules:

• Breach Notification Rule: requires reporting of exposed PHI.
• Tiered penalty structure: much higher maximum fines.
• Direct business associate liability: under the HIPAA Security Rule.
• State attorney general enforcement: for HIPAA violations.
• EHR incentive programs (Meaningful Use): to speed up technology adoption.
• HHS audit program: for proactive compliance checks.
• Stronger individual rights: including a call to expand the accounting of disclosures. That is the list of who received a patient's records. HHS has not added this to the rule yet. Under 45 CFR 164.528(a)(1)(i), the list still does not have to include records shared for treatment, payment, and health care operations.
• Safe harbor provision: no breach notice needed for properly encrypted data.

Meaningful Use and EHR Adoption

The EHR Incentive Programs

HITECH's most visible result was the EHR Incentive Programs, known as Meaningful Use. These programs paid healthcare providers to adopt certified EHR technology. Providers also had to show they used it to improve patient care.

The Meaningful Use program ran in three stages:

• Stage 1 (2011 to 2012): Focused on capturing and sharing data. Providers recorded patient details, vital signs, and medication lists electronically.
• Stage 2 (2014): Pushed advanced clinical processes. These included digital prescribing, health information exchange, and patient portal access.
• Stage 3 (2017+): Aimed at better outcomes. This included clinical decision support, patient-generated health data, and public health reporting.

The program is now called the Promoting Interoperability Program. For clinicians, it is part of MIPS, the Medicare payment program created under MACRA. It still rewards technology adoption. Providers who don't take part face lower Medicare payments.

Security Implications of Widespread EHR Adoption

HITECH pushed EHR adoption widely, but that created a problem. More ePHI in digital systems means bigger targets for hackers. That's why HITECH also tightened security rules and enforcement.

• Larger attack surface: Centralized EHR systems hold complete patient records. One breach can expose far more data.
• Linked systems: Health information exchange means one breach can spread to connected systems.
• Remote access: Clinicians access EHRs from phones and home networks. This expands the threat area.
• Third-party links: EHR systems rely on many vendors, connections, and cloud services. Each one must be secured.

Practices must make sure their EHR security meets the standards in the HIPAA Security Rule. They also need strong encryption and access controls.

Breach Notification Expansion

Creating the Breach Notification Rule

Before HITECH, HIPAA did not require anyone to report a breach. A practice could suffer a major PHI exposure and have no federal duty to tell patients, regulators, or the public. HITECH closed that gap with the Breach Notification Rule.

The Breach Notification Rule requires:

• Individual notice: Written notice to every affected individual “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach” (45 CFR 164.404(b)). The notice must describe the breach, list the types of data involved, tell people what steps to take, and explain what the practice is doing to respond.
• HHS notice: For breaches affecting 500 or more people, notify HHS “contemporaneously with the notice” to individuals (45 CFR 164.408(b)). HHS then posts the breach on its public portal (often nicknamed the "Wall of Shame"). For smaller breaches, report to HHS once a year within 60 days of year-end.
• Media notice: For a breach “involving more than 500 residents of a State or jurisdiction,” notify prominent media outlets serving that state or jurisdiction (45 CFR 164.406(a)).
• Business associate notice: Business associates must tell covered entities about breaches without unreasonable delay.

The Presumption of Breach

The Breach Notification Rule, as amended in 2013, sets a key rule: any acquisition, access, use, or disclosure of PHI that the Privacy Rule does not permit “is presumed to be a breach” unless the practice “demonstrates that there is a low probability that the protected health information has been compromised” (45 CFR 164.402). The practice must prove otherwise. It does this through a risk assessment of at least four factors.

The four-factor risk assessment looks at:

1. The nature and extent of the PHI involved.
2. Who accessed or received the PHI without permission.
3. Whether the PHI was actually seen or taken.
4. How much the risk has been reduced.

If the practice can't show a low probability that the PHI has been compromised, it must send breach notices. For a full guide to breach response steps, see our article on how to respond to a HIPAA data breach.

The Safe Harbor Provision

HITECH gives a strong incentive to encrypt data. If PHI is encrypted to NIST standards and the encryption keys weren't exposed, the data is considered "secured." Breach notification rules don't apply in that case.

The safe harbor applies when:

• Data at rest is encrypted per NIST SP 800-111.
• Data in transit is encrypted per NIST SP 800-52, 800-77, or 800-113.
• Encryption keys were not exposed in the same incident.

For details on meeting encryption standards, see our guide on HIPAA encryption rules.

Increased Penalties and Enforcement

The Tiered Penalty Structure

HITECH replaced HIPAA's modest fines with a four-tier system. The new fines are much higher and depend on the level of culpability (45 CFR 160.404(b)(2)):

Note: Penalty amounts are adjusted annually for inflation. Figures shown are the current amounts in 45 CFR 102.3, from the inflation adjustment HHS published January 28, 2026 (91 FR 3665). Since 2019, OCR has used lower yearly caps for the first three tiers: $25,000, $100,000, and $250,000, adjusted for inflation. OCR set these in a 2019 notice of enforcement discretion (84 FR 18151), a public statement of how it chooses to enforce.

Practices that act in good faith and fix problems quickly pay far less than those that show willful neglect. This gives every practice a strong reason to run a proactive compliance program.

Criminal Penalties

The criminal penalties come from the original 1996 law (42 U.S.C. 1320d-6). HITECH section 13409 clarified who can be charged: a person, “including an employee or other individual,” who obtains or discloses health information maintained by a covered entity without authorization. The penalties are:

• Tier 1: Knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA (up to $50,000 fine, 1 year in prison, or both).
• Tier 2: Offenses committed under false pretenses (up to $100,000 fine, 5 years in prison, or both).
• Tier 3: Offenses committed with intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm (up to $250,000 fine, 10 years in prison, or both).

The Department of Justice handles criminal enforcement. It has pursued cases where healthcare workers accessed PHI for personal reasons, committed identity theft, or ran fraud schemes.

State Attorney General Enforcement

HITECH gave state attorneys general the power to sue in federal court over HIPAA violations that harm state residents. This means states can enforce HIPAA too, not just OCR.

State attorneys general have been most active in:

• Multi-state investigations of large healthcare data breaches.
• Actions against practices that fail to put basic security in place.
• Joint work with OCR on cases that have both federal and state angles.
• Enforcement of state laws that go beyond HIPAA's baseline.

Practices must now watch both OCR and state regulators. Multi-state health systems face extra risk. One breach can trigger enforcement from several state attorneys general at once.

Business Associate Obligations

Direct Liability Under HITECH

Before HITECH, business associates were bound by HIPAA only through their contracts with covered entities. If a business associate broke HIPAA rules, the covered entity could be fined. But OCR could not directly penalize the business associate.

HITECH changed that. Business associates are now directly liable for:

• The full HIPAA Security Rule.
• Certain Privacy Rule provisions. These include limits on using and sharing PHI, and the minimum necessary standard (use or share only the PHI needed for the task).
• The Breach Notification Rule, including the duty to report breaches to covered entities.
• Documentation and record-keeping rules.

Practical Implications for Business Associates

Direct liability means business associates face the same fines as covered entities:

• OCR investigations: OCR can investigate business associates directly after a breach or complaint.
• Independent fines: OCR can fine a business associate separately from the covered entity. Both parties may face their own penalties for the same event.
• BAA rules: Business associate agreements must reflect HITECH's rules. Business associates cannot push their HIPAA duties onto covered entities through a contract.
• Subcontractor chain: Business associates must make sure their own subcontractors (sub-business associates) follow HIPAA through proper agreements and oversight.

Managing Business Associate Relationships

Practices should run a full business associate management program:

• Due diligence: Check the security posture of any business associate before signing a contract.
• Contract terms: Make sure BAAs include all HITECH-required terms (breach reporting timelines, security duties, and termination rights, meaning your right to end the contract).
• Ongoing checks: Regularly review business associate compliance through questionnaires, audits, or certifications.
• Breach coordination: Set up clear steps for how covered entities and business associates will work together when a breach happens.
• Exit steps: Define clear steps for ending a relationship with a business associate that does not follow HIPAA, including data return and deletion rules.

Audit Program Establishment

The HIPAA Audit Program

HITECH told HHS to run periodic audits of covered entities and business associates. This was a major shift. Before that, enforcement mostly reacted to complaints.

Key features of the audit program:

• Phase 1 (2011 to 2012): Full audits, including site visits, of 115 covered entities. This set a baseline for compliance data.
• Phase 2 (2016 to 2017): Desk audits of both covered entities and business associates. These focused on specific Security Rule and Breach Notification Rule items.
• Ongoing program: OCR still runs audits, mainly to improve compliance. If an audit finds a serious problem, OCR may open a separate compliance review.

Preparing for Potential Audits

Practices should stay audit-ready at all times:

• Keep all HIPAA records current and easy to find.
• Run regular risk analyses and track fixes.
• Make sure policies, procedures, and training materials match current rules.
• Keep proof of ongoing compliance work, not just one-time reviews.
• Assign one compliance team member to lead audit coordination.

For full audit prep across multiple regulatory frameworks, see our healthcare regulatory compliance guide.

HITECH's Legacy and Continuing Impact

How HITECH Shaped Modern Healthcare Compliance

HITECH's rules are now so embedded in healthcare compliance that most practices don't separate "original HIPAA" from "HITECH-enhanced HIPAA." But knowing what HITECH added helps explain why modern compliance programs look the way they do:

• Breach transparency: The Breach Notification Rule and the public breach portal created new openness around healthcare data breaches. This pushed practices to invest more in security.
• Business associate accountability: Direct liability changed the vendor world. Security commitments now run through the entire healthcare supply chain.
• Financial deterrence: The tiered fine structure made non-compliance too costly to ignore, for practices of any size.
• Technology adoption: EHR incentives sped up the shift to digital healthcare. This created better care options but also new security risks that require ongoing investment.
• Multi-state enforcement: State attorney general authority spread enforcement across the country. Oversight continues even when federal resources are stretched.

Looking Forward

HITECH still shapes healthcare privacy and security policy today. Recent proposed HIPAA updates build on HITECH's base. The Security Rule changes HHS proposed on January 6, 2025 (90 FR 898), which are not final, would make certain protections (like encryption and multi-factor authentication) required, with limited exceptions. Today, encryption is an “Addressable” implementation specification (45 CFR 164.312(a)(2)(iv)), and the Security Rule does not name multi-factor authentication. Organizations that understand that progression are better positioned to respond when the next update arrives.

HITECH and the Proposed Security Rule Changes: How They Connect

The Security Rule changes HHS proposed on January 6, 2025 (90 FR 898) are not final, and the current Security Rule still governs. The proposal is not a departure from HITECH: it would build on the enforcement structure HITECH created. Understanding the lineage helps organizations see where it fits.

The progression from HIPAA to today:

• HIPAA (1996): Established the basic framework for health data privacy and security
• HITECH Act (2009): Dramatically strengthened enforcement: created Business Associate liability, raised penalties, created the Breach Notification Rule, and linked HIPAA compliance to EHR adoption incentives
• Omnibus Rule (2013): Implemented HITECH’s BA provisions, updated breach notification rules, and made subcontractors count as business associates
• 2021 HITECH Amendment (Public Law 116-321): Requires HHS to consider whether an organization had recognized security practices in place for the previous 12 months when making determinations about fines, audits, and other remedies (see below)
• Proposed Security Rule changes (January 6, 2025, 90 FR 898, not final): Would remove the distinction between required and addressable implementation specifications and would require multi-factor authentication, a compliance audit at least once every 12 months, and vulnerability scans at least once every six months

Each layer builds on the last. HITECH’s enforcement structure (the penalty tiers, the BA liability, the breach notification requirements) is in effect today. The proposed changes are not; they would take effect only if HHS publishes a final rule.

What the proposal would change, if finalized:

• A written compliance audit: “Perform and document an audit at least once every 12 months” of compliance with each Security Rule standard and implementation specification (proposed 45 CFR 164.308(a)(14))
• Business associate contracts would require the business associate to report activation of its contingency plan to the covered entity “without unreasonable delay, and in no case later than 24 hours after activation” (proposed 45 CFR 164.314(a)(2)(i)(D)). The proposal does not change the Breach Notification Rule’s deadlines.
• Removing the “addressable” label would end the current option to document why a specification is not reasonable and appropriate and implement an equivalent alternative (45 CFR 164.306(d)(3))

The 2021 HITECH Amendment: Recognized Security Practices

On January 5, 2021, Congress amended the HITECH Act (Public Law 116-321, adding HITECH section 13412, 42 U.S.C. 17941). The amendment, sometimes called the HITECH cybersecurity safe harbor, says that when HHS makes determinations about fines, audits, or other remedies, it “shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place” that may:

1. Mitigate fines under section 1176 of the Social Security Act
2. Result in the early, favorable termination of an audit under HITECH section 13411
3. Mitigate the remedies that would otherwise be agreed to in any agreement resolving potential violations of the HIPAA Security Rule

The law also gives HHS no authority to increase fines, or the length, extent, or quantity of audits, because an organization lacks these practices, and it creates no liability for choosing not to adopt them.

What counts as “recognized security practices” under the 2021 amendment:

• The standards, guidelines, best practices, methodologies, procedures, and processes “developed under section 2(c)(15) of the National Institute of Standards and Technology Act”
• “The approaches promulgated under section 405(d) of the Cybersecurity Act of 2015”
• “Other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities”

This is not a guarantee of immunity. The law requires HHS to consider these practices; it does not promise a lower fine or any particular outcome. It names no specific framework: the practices “shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule.”

The key word is “demonstrated”: the organization has to show the practices were in place for at least the previous 12 months. That is one of the strongest arguments for not just doing compliance, but documenting it systematically.

HITECH Act FAQ

How does the HITECH Act differ from HIPAA?

HIPAA (1996) set the original rules for health data privacy and security. The HITECH Act (2009) made those rules much stronger. It created the Breach Notification Rule, raised fines, made business associates directly liable, gave state attorneys general enforcement power, and offered incentives for EHR adoption. Many HIPAA enforcement actions today rely on authority and penalty structures that HITECH created.

Does the HITECH Act apply to business associates?

Yes. One of HITECH's biggest changes is making business associates directly liable for the HIPAA Security Rule, certain Privacy Rule items, and the Breach Notification Rule. Business associates face the same fines as covered entities. OCR can investigate and penalize them directly.

What penalties did HITECH add for HIPAA violations?

HITECH created a four-tier civil penalty structure based on culpability. Under 45 CFR 102.3, fines range from $145 per violation at the lowest tier (did not know, and by exercising reasonable diligence would not have known) to $2,190,294 for identical violations in a calendar year at the highest tier (willful neglect, not corrected). The criminal penalties, up to $250,000 in fines and 10 years in prison for the most serious offenses, come from the original 1996 law (42 U.S.C. 1320d-6). HITECH section 13409 clarified that an employee or other individual who obtains or discloses health information maintained by a covered entity without authorization can be charged under it.

How did HITECH change breach notification requirements?

Before HITECH, HIPAA had no breach reporting rule. HITECH created the Breach Notification Rule. It requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach, notify HHS, and, for a breach involving more than 500 residents of a state or jurisdiction, notify prominent media outlets (45 CFR 164.404 to 164.408). Under 45 CFR 164.402, any acquisition, access, use, or disclosure of PHI that the Privacy Rule does not permit is presumed to be a breach unless a risk assessment of at least four factors shows a low probability that the PHI has been compromised.

Is the Meaningful Use program still active?

The original Meaningful Use program is now called the Promoting Interoperability Program. For clinicians, it is part of MIPS, the Medicare payment program created under MACRA. The program still rewards the use of certified EHR technology. Eligible providers who don't take part face lower Medicare payments. HITECH's core goal, wide EHR adoption and real use of health IT, is still built into current CMS programs.

What did the HITECH Act change about HIPAA?

The HITECH Act (2009) made four major changes to HIPAA: (1) It created direct liability for Business Associates: previously, only covered entities were directly subject to HIPAA enforcement; HITECH made BAs independently liable. (2) It dramatically increased civil monetary penalties, creating the four-tier structure that still governs enforcement today. (3) It created the HIPAA Breach Notification Rule, requiring covered entities to notify affected individuals no later than 60 calendar days after discovery of a breach, and to notify HHS and (for breaches involving more than 500 residents of a state or jurisdiction) the media. (4) It created financial incentives for healthcare providers to adopt certified electronic health record technology through the Meaningful Use program.

What is the HITECH safe harbor for cybersecurity?

The name usually refers to a 2021 amendment to HITECH (Public Law 116-321, January 5, 2021). When HHS makes determinations about fines, audits, or other remedies for potential HIPAA Security Rule violations, it must consider whether the organization has adequately demonstrated that it had recognized security practices in place for not less than the previous 12 months. The law defines those practices by reference to section 2(c)(15) of the National Institute of Standards and Technology Act, section 405(d) of the Cybersecurity Act of 2015, and other cybersecurity programs developed, recognized, or promulgated through regulations under other statutory authorities. It is not a guarantee of immunity, and the law gives HHS no authority to increase fines for lacking these practices. See HIPAA Fines 2025 for current penalty figures.

How does HITECH connect to the proposed HIPAA Security Rule changes?

HITECH created the enforcement structure (tiered penalties, BA liability, breach notification) that is in effect today. The Security Rule changes HHS proposed on January 6, 2025 (90 FR 898) would build on it, and they are not final. As proposed, they would require multi-factor authentication, a compliance audit at least once every 12 months, and vulnerability scans at least once every six months, and would remove the distinction between required and addressable implementation specifications. Until a final rule is published, the current Security Rule governs.

HITECH Act Takeaways

The HITECH Act turned HIPAA compliance from a low-stakes duty into a high-stakes rule. Its rules on breach reporting, higher fines, business associate liability, and EHR adoption still define the compliance space in 2026 and beyond. Practices that know HITECH's rules well build stronger compliance programs, manage vendor relationships better, and stay ready for audits.

One Guy Consulting helps healthcare practices put HIPAA and HITECH requirements into everyday practice. We cover business associate management, breach response planning, and full compliance program development. We give you the expertise to handle healthcare compliance with confidence. Contact us today to strengthen your compliance program and get ready for what's ahead.

Related Reading

• HIPAA Fines 2025: The Full Breakdown
• State Privacy Laws vs. HIPAA: What Takes Priority?
• Is MFA Required for HIPAA? A Plain-English Guide

Sources

• HITECH Act (Title XIII of ARRA)
• 45 CFR Part 170: Health IT Standards
• HHS Breach Notification Rule