HITECH Act: Business Associate Liability, Breach Notice and Penalties

The HITECH Act is the law that turned HIPAA from a rule mainly about hospitals and insurers into one that reaches their software vendors directly. Passed in 2009 as part of the American Recovery and Reinvestment Act, it funded the shift to electronic health records and, at the same time, strengthened privacy and security: business associates became directly liable for HIPAA Security Rule compliance, breach notification became mandatory, penalties increased, and state attorneys general gained enforcement powers.

For health-tech and IT companies, HITECH explains why a business associate agreement is not just a contract but a statement of legal duties, why encryption matters so much for breach notification, and how regulators decide penalties. This guide covers its history, the provisions that affect vendors, breach notification under HHS and FTC rules, the 2021 recognised security practices amendment, and practical steps.

What is the HITECH Act?

The Health Information Technology for Economic and Clinical Health Act is Title XIII of the American Recovery and Reinvestment Act of 2009. It has two broad parts:

• Health information technology adoption: it gave the Office of the National Coordinator for Health Information Technology (ONC) a statutory basis, funded health IT infrastructure, and created Medicare and Medicaid incentive programs for "meaningful use" of certified electronic health record technology, later renamed Promoting Interoperability.
• Privacy and security (Subtitle D): it extended HIPAA obligations directly to business associates, created breach notification requirements, strengthened enforcement and penalties, and restricted some uses and disclosures of protected health information.

HHS implemented most HITECH privacy and security provisions through the HIPAA Omnibus Rule published in January 2013, so in practice HITECH's requirements are found in the HIPAA Rules at 45 CFR Parts 160 and 164.

History and why HITECH was introduced

In 2009, most US healthcare records were still on paper, and the federal government wanted to modernise them as part of economic recovery. Congress recognised that moving to electronic records would increase privacy and security risks, and that HIPAA enforcement had been weak: business associates were bound only by contracts with covered entities, there was no general duty to tell patients about breaches, and penalties were modest. HITECH addressed both goals together, pairing incentives for adoption with stronger protections.

In January 2021, Congress amended HITECH (Public Law 116-321) to require HHS to consider whether a covered entity or business associate had adequately demonstrated recognised security practices in place for the previous 12 months when deciding fines, audits and other remedies.

Who does HITECH affect?

• Covered entities: health plans, healthcare clearinghouses and providers that conduct standard electronic transactions.
• Business associates: vendors that create, receive, maintain or transmit PHI for covered entities, including EHR and practice management software vendors, cloud and hosting providers, billing companies, analytics firms and IT service providers.
• Subcontractors of business associates that handle PHI.
• Vendors of personal health records and related entities not covered by HIPAA, which are subject to the FTC's Health Breach Notification Rule. The FTC has interpreted this rule to cover many health and wellness apps.

Geography: HITECH is US law. Foreign vendors are affected when they act as business associates of US covered entities.

Key provisions for IT vendors

Direct liability of business associates

Before HITECH, a business associate that mishandled PHI faced contract claims from its client, not HHS. HITECH made business associates directly subject to the HIPAA Security Rule's administrative, physical and technical safeguards and to certain Privacy Rule provisions, and directly liable for civil and criminal penalties. The 2013 Omnibus Rule extended this to subcontractors. HHS has published a fact sheet listing the provisions for which business associates are directly liable, including failure to comply with the Security Rule, impermissible uses and disclosures, failure to notify the covered entity of a breach, and failure to enter into business associate agreements with subcontractors.

Breach notification

HITECH required covered entities to notify individuals, HHS and in some cases the media of breaches of unsecured PHI, and business associates to notify covered entities. HHS implemented this in the Breach Notification Rule (45 CFR 164.400 to 414): individuals must be notified without unreasonable delay and within 60 calendar days of discovery; large breaches go to HHS at the same time and to the media; smaller breaches are reported to HHS annually. "Unsecured" means not rendered unusable, unreadable or indecipherable to unauthorised persons through methods in HHS guidance, mainly encryption meeting NIST standards and proper destruction.

FTC Health Breach Notification Rule

For personal health record vendors and related entities outside HIPAA, HITECH directed the FTC to issue a parallel rule. The FTC's Health Breach Notification Rule (16 CFR Part 318) requires notice to consumers, the FTC and sometimes the media, and the FTC amended it in 2024 to clarify that it covers many health apps and that unauthorised disclosures, not only cyberattacks, can be breaches.

Tiered civil penalties

HITECH created four penalty tiers based on culpability: the entity did not know and could not reasonably have known; reasonable cause; wilful neglect corrected within 30 days; and wilful neglect not corrected. Each tier has per-violation ranges and annual caps for identical violations, adjusted annually for inflation by HHS. HHS has also exercised enforcement discretion on annual caps per tier.

State attorneys general

State attorneys general may bring civil actions in federal court on behalf of residents for HIPAA violations, seeking injunctions and damages.

Limits on sale and marketing

HITECH restricted the sale of PHI without authorisation, tightened marketing rules for communications paid for by third parties, and strengthened individuals' rights to electronic copies of their records and to restrict disclosures to health plans when they pay out of pocket.

Recognised security practices (2021 amendment)

HHS must consider whether an entity had recognised security practices in place for the prior 12 months when determining fines, audit outcomes and other remedies. Recognised security practices include standards and approaches developed under section 2(c)(15) of the NIST Act (such as the NIST Cybersecurity Framework), approaches promulgated under section 405(d) of the Cybersecurity Act of 2015 (the Health Industry Cybersecurity Practices publications), and other programs recognised by statute or regulation. It is not a safe harbour, but it rewards documented, implemented security programmes.

What HITECH means for EHR and health IT developers

HITECH's adoption programmes created the market that many health IT companies serve today. The Medicare and Medicaid EHR Incentive Programs paid eligible professionals and hospitals for meaningful use of certified EHR technology, which made ONC certification a commercial requirement for EHR vendors. The incentive programmes have since become Promoting Interoperability measures within Medicare payment programmes, and certification criteria have evolved under the 21st Century Cures Act to emphasise standardised APIs, such as HL7 FHIR, and information sharing.

For developers, two consequences follow. First, if you build software that providers use to meet federal programme requirements, ONC certification criteria may apply to your product, alongside HIPAA safeguards. Second, interoperability is now an expectation: providers and patients expect to move data through APIs, and blocking that movement can raise information blocking concerns. Designing for secure, standards-based access, with OAuth scopes, audit logging and patient consent, serves both HITECH-era security duties and current interoperability rules.

How to comply as a business associate, step by step

1. Confirm your status as a business associate or subcontractor for each customer and product.
2. Sign compliant business associate agreements upstream and downstream.
3. Run a HIPAA Security Rule risk analysis and implement safeguards.
4. Encrypt PHI at rest and in transit in line with HHS guidance, so that lost or stolen data is "secured".
5. Build breach detection: audit logs of PHI access, alerting on unusual access and exports.
6. Write a breach response procedure including the four-factor risk assessment and notification to covered entities within contract and regulatory timelines.
7. Adopt a recognised security practices framework, such as the NIST CSF or the 405(d) Health Industry Cybersecurity Practices, and keep 12 months of evidence.
8. Check whether the FTC rule applies to any consumer-facing health app you offer outside HIPAA.
9. Train staff and document everything.

Documentation you will need

• Business associate agreements with customers and subcontractors.
• Security Rule risk analysis and risk management plan.
• Policies and procedures for safeguards, retained for six years.
• Encryption standards and key management documentation.
• Breach response procedure, risk assessments for incidents, and notification records.
• Evidence of recognised security practices over the last 12 months.
• Training records and audit log reviews.

Enforcement and certification

There is no HITECH certification. HHS OCR enforces HIPAA as amended by HITECH through investigations, compliance reviews and audits. State attorneys general can sue. The FTC enforces its Health Breach Notification Rule. The ONC Health IT Certification Program, which certifies EHR technology, is a separate program created to support EHR adoption and is now linked to the 21st Century Cures Act rules.

Timeline and cost considerations

HITECH's obligations have applied for years, so the work is about ongoing compliance. Costs include encryption and key management, logging and monitoring, risk analysis, legal review of BAAs, breach response capability, staff training and any framework implementation. Investments that render PHI "secured" and that build recognised security practices can significantly reduce the cost of a future incident.

Benefits and consequences of non-compliance

Compliance lets vendors serve US healthcare customers, reduces breach impact, and, with documented recognised security practices, can mitigate penalties. Non-compliance exposes business associates directly to OCR penalties across the four tiers, corrective action plans, state attorney general lawsuits, FTC enforcement for non-HIPAA apps, contract termination and reputational damage.

Common mistakes and challenges for IT companies

• Believing a vendor is only contractually liable. Since HITECH, business associates are directly liable.
• Unencrypted PHI on laptops, backups or in logs, turning incidents into notifiable breaches.
• No audit trail of PHI access, making it impossible to scope a breach.
• Slow notification to covered entities that pushes them past their 60-day limit.
• Ignoring the FTC rule for consumer health apps outside HIPAA.
• No evidence of recognised security practices when an investigation starts.

Best practices, tools and technologies

• Encrypt PHI with validated cryptography and managed keys; document it against HHS guidance.
• Log every read and change of PHI with user, time and context; alert on unusual patterns.
• Adopt the NIST CSF or 405(d) Health Industry Cybersecurity Practices and track evidence monthly.
• Rehearse breach response with customers' contacts and timelines.
• Minimise PHI in non-production environments and third-party tools.

We build encrypted, audited health-tech applications and secure EHR integrations.

How HITECH relates to other laws and frameworks

Law or framework	Relationship
HIPAA	HITECH amended HIPAA; its provisions live in the HIPAA Rules.
21st Century Cures Act	Builds on HITECH-era health IT policy with information blocking and certification rules.
NIST CSF	A recognised security practice under the 2021 amendment.
HITRUST	Private framework vendors use to demonstrate safeguards.
SOC 2	Common evidence of security controls for business associates.

Real-world enforcement examples

HHS OCR has resolved cases directly against business associates since HITECH, including settlements with technology and service vendors after breaches caused by inadequate risk analysis and security. The FTC has brought actions under its Health Breach Notification Rule against health apps that shared health data with advertisers without authorisation, showing that the rule reaches beyond hacking incidents.

An illustrative case for a care coordination SaaS: a developer laptop with a database extract is stolen. Because the disk was encrypted with validated encryption and the extract was pseudonymised, the incident does not involve unsecured PHI. The company documents the risk assessment, notifies its customers as the BAA requires, and shows its year of NIST CSF evidence. What could have been a notifiable breach becomes a documented security incident.

Next steps

1. Confirm your business associate status and BAAs.
2. Encrypt PHI everywhere it is stored and transmitted.
3. Build PHI access logging and breach detection.
4. Adopt and evidence a recognised security practices framework.
5. Check FTC rule applicability for any consumer health products.

Frequently asked questions

What is the difference between HIPAA and HITECH?

HIPAA (1996) created the privacy and security framework. HITECH (2009) amended it, making business associates directly liable, adding breach notification and increasing penalties, and also promoted electronic health records.

Are business associates directly liable under HITECH?

Yes. Business associates and their subcontractors are directly liable for compliance with the Security Rule and certain Privacy Rule provisions.

What counts as unsecured PHI?

PHI not rendered unusable, unreadable or indecipherable to unauthorised persons using methods in HHS guidance, mainly encryption and destruction.

How long do covered entities have to notify individuals of a breach?

Without unreasonable delay and no later than 60 calendar days after discovery.

What are recognised security practices?

Security frameworks and practices, such as the NIST Cybersecurity Framework and the 405(d) Health Industry Cybersecurity Practices, that HHS must consider when setting penalties if they were in place for the prior 12 months.

Does HITECH apply to health apps?

Apps that handle PHI for covered entities are covered through HIPAA. Consumer health apps outside HIPAA may be covered by the FTC's Health Breach Notification Rule, created under HITECH.

What are the HITECH penalty tiers?

Four tiers based on culpability, from lack of knowledge to uncorrected wilful neglect, with per-violation ranges and annual caps adjusted for inflation.

Can state attorneys general enforce HIPAA?

Yes. HITECH allows them to bring civil actions on behalf of residents.

Is there a HITECH certification?

No. ONC certifies EHR technology under a separate program, but there is no certification of HITECH compliance.

Does encryption avoid breach notification?

If PHI was encrypted in line with HHS guidance and the keys were not compromised, it is not unsecured PHI, so the Breach Notification Rule does not require notification.