Filter by Category

The Challenges HIPAA and HITECH Compliance Bring IT Professionals

Outside of the finance industry, healthcare is one of the most regulated industries in the U.S. As the healthcare policy debates rage on, one issue on which most Americans can agree is the need to keep personal healthcare information confidential and secure.

Major regulations such as HIPAA and HITECH have been passed into law to increase the security of our personal health information. For better or worse, a major portion of the burden to comply with the regulations and all of their revisions falls upon the IT professionals.

HIPAA and HITECH: A Brief OverviewHITECH, data security, compliance

While HIPAA (Health Insurance Portability Accountability Act), passed in 1996, has received the most attention, the more recently implemented HITECH law is quickly having an impact.

HITECH (Health Information Technology for Economic and Clinical Health Act) was passed into law in 2009. The goal for HITECH is to strengthen the civil and criminal enforcement of already existing HIPAA regulations that require health organizations and their business partners to report data breaches. HITECH also increases the penalties for security violations, and implements new rules for tracking and disclosing patient information breaches.

Data Breach Notification

Under HITECH rules, all data breaches of PHI (protected health information) must be reported to the individuals whose data was compromised. This includes reporting files that may have been hacked, stolen, lost, or even transmitted in an unencrypted fashion.

If such a breach--or potential breach--affects 500 people or more, the media must also be notified. Breaches of all sizes must always be reported to the Secretary of Health and Human Services (HHS), but if fewer than 500 individuals' records are affected, healthcare organizations can report the breach via the HHS website on an annual basis. Larger breaches must be reported to HHS within 60 days.

Penalties for Data Breach

The HITECH Act implements a four tier system of financial penalties assessed based on the level of "willful neglect" a healthcare organization demonstrated resulting in the breach. Fines range from $100 per breached record for unintended violations all the way up to $50,000 per record (with an annual cap of $1.5 million) when "willful neglect" is demonstrated.

Access to Electronic Health Records (EHRs)

HITECH requires that the software that a health organization uses to manage its EHRs must make a person's electronic PHI records available to the patient and yet remain protected from data breach by encrypting the data and securing the connection.

Not surprisingly, email is not considered a secure method of data transmission.

Business Associates

Before HITECH, business associates of healthcare organizations were not held directly liable for privacy and security under the HIPAA rules, even though they had access to PHI. HITECH now requires that all business associates with access to PHI are subject to the HIPAA rules and must maintain Business Associate Agreements with the healthcare organization that provides the PHI.  Business associates are also required to report any data breaches and are subject to the same penalties as their healthcare business partners.

Need to meet HIPAA and HITECH compliance?

Latest Posts


What is a Cloud Connector?

September 17, 2020

The cloud and all its possibilities for connecting with customers, vendors, trading partners, and more is exciting. Managing your organization’s transition to the cloud – whether you’re…


How Amazon Web Services Works with GoAnywhere MFT

September 16, 2020

“Alexa, What is MFT?” While that may not be a question you’ve ever asked your virtual assistant, it’s not outside the realm of possibility – Amazon has quickly become ubiquitous for online…


Why You Should Use Scheduled File Transfer Software

September 15, 2020

Have you set up Amazon auto-deliveries? Installed a smart thermostat to keep your house the perfect temperature throughout the day? Approved auto-pay for your bills? Today’s world makes it easy to…


The ABC's of MFT

September 11, 2020

Tech Terminology Can be ToughWe know that tech terms can be tricky, but the good news is that technology makes it easy to learn and read about them if you’re willing to do the research. The…


Pair Your Enterprise File Sharing Solution with Data Loss Prevention

September 10, 2020

Is Your Enterprise File Sharing Solution Enough? Enterprise file sharing solutions are already a great way to encrypt sensitive data in motion, but encryption alone is not enough. Can you ensure…