In February 2009, President Obama signed the Health Information Technology for Economic and Clinical Health (HITECH) Act as part of his overall economic stimulus plan. The HITECH Act continues the effort of the Health Insurance Portability and Accountability Act (HIPAA) to encourage movement to electronic patient records and to deliver stricter data protection regulations for more secure patient privacy.
Among the most important of the new HITECH Act mandates is a federal breach notification requirement for stored health information that is not encrypted or otherwise made indecipherable, as well as increasing penalties for violations. Until this law was passed, only two of the 48 states with data breach notification requirements included health information as a specified data type. Now with the HITECH Act, the entire United States health industry and their business partners must quickly understand and get ready for these new data breach notification requirements.
With HITECH Act data breach disclosure requirements already in effect, the problem is imminent and unsolved. Most health organizations are currently not encrypting their patient health data stores. The HIPAA Security Rule, finalized in 2003, defines encryption as “addressable,” which required HIPAA-regulated entities to evaluate and document whether or not they were going to use encryption based on viability and organizational risk-but did not mandate encryption.
Now with the HITECH Act, thousands of healthcare-related businesses are finding themselves struggling to understand not only the HITECH Act’s breach notification requirements, but also what it means to encrypt their data. In addition to data breach notification requirements for all HIPAA-covered entities, the HITECH Act also extended HIPAA requirements beyond the traditionally covered entities of “payors, providers and clearinghouses” to include their business partners.
In light of the new demands and requirements that the HITECH Act has put on healthcare organizations, as well as the introduction of more severe penalties, organizations need to get started with a strategy immediately.