HITECH Act

Subtitle D Part 2 and enforcement: relationship to other laws, effective date, reports – HITECH Act

HITECH Act 13411: Section 13411: periodic HHS audits of covered entities and business associates

The Secretary provides for periodic audits to ensure that covered entities and business associates comply with the subtitle and with the Privacy and Security Rules; OCR runs the audit programme, and under section 13412 recognized security practices may shorten an audit.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Subtitle D Part 2 and enforcement: relationship to other laws, effective date, reports – HITECH Act

13409 Section 13409: criminal penalties reach any person, including an employee, who obtains or discloses protected health information without authorization
13410a Section 13410(a) and (b): willful neglect violations must be penalised and complaints indicating willful neglect must be formally investigated
13410d Section 13410(d): four tiers of civil money penalties by culpability, with annual caps
13410e Section 13410(e): state attorneys general may sue for HIPAA violations affecting their residents
13412 Section 13412 (added by Public Law 116-321, 2021): recognized security practices in place for the prior twelve months are considered in fines, audits and settlements

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All HITECH Act controls