HITECH Act Expands HIPAA Privacy and Security Rules
HITECH - Health Information Technology for Economic and Clinical Health Act was created on Feb 17th, 2009 by President Obama to provide substantial Medicare and Medicaid incentives for hospitals and physicians to adopt electronic health records (EHRs) and provides grants for the development of health information exchange (HIE).

These incentives and grants will provide the needed support for many health care providers to adopt technology necessary to improve the quality and efficient of patient care. Stay tuned for a future memorandum from Coppersmith Gordon on these EHR incentives and HIE grants.

What Are the HITECH Act Requirements?

• Apply the HIPAA privacy and security requirements directly to business associates
• Establish mandatory federal security breach reporting requirements for HIPAA covered entities and their business associates
• Create new privacy requirements for HIPAA covered entities and their business associates, including new accounting requirements for EHR, restrictions on marketing and fundraising, and other developments
• Establish new criminal and civil penalties for noncompliance and new enforcement responsibilities

What Are the New HIPAA Security Rules?
The HITECH Act substantially expands the scope of the HIPAA Privacy and Security Rule by applying most of the rules’ provisions to business associates. Section 13401 of the Act requires individuals and entities acting as “business associates” of HIPAA covered entities to comply with the HIPAA Security Rule provisions on:

• Administrative safeguards
• Physical safeguards
• Technical safeguards
• Policies and documentation
• The new security breach reporting requirement

What Are the Funds Allocated for the HITECH Act?

• $18 billion through the Medicare and Medicaid reimbursement systems for hospitals and physicians who are “meaningful users” of EHR systems
• $2 billion to the Office of the National Coordinator for infrastructure necessary to:
  - Allow for, and promote, the electronic exchange and use of health information for each individual in the United States
  - Updating the Department of Health & Human Services’ technologies to allow for the electronic flow of information
  - Integrating health IT education into the training of healthcare professionals; and, promoting interoperable clinical data repositories
• $1 billion to be made available for renovation and repair of health centers and for the acquisition of health IT systems
• $550 million for – among other things – the purchase of equipment and services including, but not limited to, health IT within Indian Health Service facilities
• $400 million for comparative effectiveness research on how use of electronic data impacts healthcare treatments and strategies
• $300 million to support regional and sub-national efforts towards health information exchange
• $40 million to be used by the Social Security Administration to use EMRs to submit disability claims

Creating Collaborative Communities of Care