Filter by Category

The Challenges HIPAA and HITECH Compliance Bring IT Professionals

Outside of the finance industry, healthcare is one of the most regulated industries in the U.S. As the healthcare policy debates rage on, one issue on which most Americans can agree is the need to keep personal healthcare information confidential and secure.

Major regulations such as HIPAA and HITECH have been passed into law to increase the security of our personal health information. For better or worse, a major portion of the burden to comply with the regulations and all of their revisions falls upon the IT professionals.

HIPAA and HITECH: A Brief OverviewHITECH, data security, compliance

While HIPAA (Health Insurance Portability Accountability Act), passed in 1996, has received the most attention, the more recently implemented HITECH law is quickly having an impact.

HITECH (Health Information Technology for Economic and Clinical Health Act) was passed into law in 2009. The goal for HITECH is to strengthen the civil and criminal enforcement of already existing HIPAA regulations that require health organizations and their business partners to report data breaches. HITECH also increases the penalties for security violations, and implements new rules for tracking and disclosing patient information breaches.

Data Breach Notification

Under HITECH rules, all data breaches of PHI (protected health information) must be reported to the individuals whose data was compromised. This includes reporting files that may have been hacked, stolen, lost, or even transmitted in an unencrypted fashion.

If such a breach--or potential breach--affects 500 people or more, the media must also be notified. Breaches of all sizes must always be reported to the Secretary of Health and Human Services (HHS), but if fewer than 500 individuals' records are affected, healthcare organizations can report the breach via the HHS website on an annual basis. Larger breaches must be reported to HHS within 60 days.

Penalties for Data Breach

The HITECH Act implements a four tier system of financial penalties assessed based on the level of "willful neglect" a healthcare organization demonstrated resulting in the breach. Fines range from $100 per breached record for unintended violations all the way up to $50,000 per record (with an annual cap of $1.5 million) when "willful neglect" is demonstrated.

Access to Electronic Health Records (EHRs)

HITECH requires that the software that a health organization uses to manage its EHRs must make a person's electronic PHI records available to the patient and yet remain protected from data breach by encrypting the data and securing the connection.

Not surprisingly, email is not considered a secure method of data transmission.

Business Associates

Before HITECH, business associates of healthcare organizations were not held directly liable for privacy and security under the HIPAA rules, even though they had access to PHI. HITECH now requires that all business associates with access to PHI are subject to the HIPAA rules and must maintain Business Associate Agreements with the healthcare organization that provides the PHI.  Business associates are also required to report any data breaches and are subject to the same penalties as their healthcare business partners.

Need to meet HIPAA and HITECH compliance?

Latest Posts


What is a DMZ and Why Do You Need a DMZ Gateway?

June 19, 2019

If you’ve watched a science-fiction movie about space travel, then you’ve likely seen some version of a scene in which an astronaut reenters their ship from the outside abyss. Because the ship…


Eight Hacks You Can Implement to Combat "Hackable" Network Vulnerabilities

June 18, 2019

Although we’re becoming savvier to the tricks hackers have pulled in the past, they are still working to up their game and catch us where and when we least expect it. Fortunately, there are some…


How to Achieve SFTP Automation in Your Organization

June 17, 2019

Whether you regularly receive 10 or 10,000 file transfers from your SFTP partners, it can be frustrating to go in and manually retrieve, unencrypt, and process these documents. Not only is this…


How SFTP Works

June 13, 2019

How does SFTP work?When you need to secure server-to-server file transfers between yourself, your trading partners, and enterprise servers, SFTP (which stands for SSH File Transfer Protocol or Secure…


Centralize Your EDI X12 File Translation with GoAnywhere MFT

June 3, 2019

GoAnywhere recently released a new version of its award-winning managed file transfer solution, GoAnywhere MFT. Version 6.1 includes support for electronic data interchange (EDI) X12 standards, as…