Enacted on February 17, 2009, the
Health Information Technology for Economic and Clinical Health Act, also known as the HITECH Act, was designed to protect the security and privacy of Personal Health Information (PHI). Although related to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act expands on the requirements to protect health information and has a wider scope for the entities that it covers. Under the HITECH Act, business partners of health care providers are now subject to HIPAA requirements and the penalties for violating the requirements. These new requirements for business partners become effective on February 17, 2010; one year to the day after the HITECH Act was signed into law by President Obama.
When many people think about data breaches and personal information, they tend to think about the loss of credit card information or Social Security numbers rather than medical information. However, over 220 data loss incidents recorded by the DataLossDB involved medical information over the last several years and there are certain to be countless other incidents that were either not publicly reported or have not yet been cataloged in the database. To this end, the HITECH Act will also establish a new breach notice requirement that will go into effect in September of 2010:
Sec. 13402. Notification In The Case Of Breach.
(a) In General.—A covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information (as defined in subsection (h)(1)) shall, in the case of a breach of such information that is discovered by the covered entity, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, or disclosed as a result of such breach.
It should be noted that many states do not include medical information in their data breach notification laws, but since the HITECH Act is federal legislation, all health care entities and their business partners are required to disclose a breach if it can be treated as “discovered”. Notification may include not only individual notices to those people affected, but also possibly notice to “prominent media outlets” and, where applicable, the Department of Health and Human Services.