At a glance
- Short name
- HITECH
- Jurisdiction
- US
- Sectors
- Healthcare, Biotech & Life Sciences, Research
- Also known as / related labels
- HIPAA Security Rule · HIPAA Privacy Rule · HIPAA Breach Notification Rule · HIPAA Enforcement Rule · Public Law 116-321
What this entry covers
The HITECH Act was enacted in 2009 as part of the American Recovery and Reinvestment Act (Public Law 111-5, Division A, Title XIII). Its privacy provisions extended HIPAA Security Rule obligations and liability to business associates, created the breach notification requirement, and increased enforcement penalties. HHS implements it through the HIPAA rules at 45 CFR Parts 160 and 164, enforced by the HHS Office for Civil Rights. Public Law 116-321 (2021) added Section 13412, which requires HHS to consider a regulated entity’s recognized security practices when setting fines and audit outcomes.
MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid. It is not legal advice and is not a substitute for the official text.
Official documentation
- Primary official source: https://www.hhs.gov/hipaa/for-professionals/index.html
- Statute (Public Law 111-5, ARRA): https://www.congress.gov/111/plaws/publ5/PLAW-111publ5.pdf
- Public Law 116-321 (recognized security practices): https://www.congress.gov/116/plaws/publ321/PLAW-116publ321.pdf
How to use this index entry
- Open the official link above (or the agency home if the deep link drifts).
- Confirm edition / revision date against your program scope.
- Map applicability by sector and jurisdiction listed in the metadata.
- Follow related frameworks only after checking their own official sources.
Disclaimers
- MyRHC does not host proprietary standards text (ISO, some industry bodies).
- Where standards are paywalled, we link to the publisher’s catalog page.
- Always verify current requirements with counsel and the issuing authority.