HITECH coordination with HIPAA Privacy Rule + HIPAA Security Rule + 21st Century Cures Act + ONC. HIPAA PRIVACY RULE (45 CFR Parts 160 + 164 Subpart E) - established 2000 + modified 2002 + significantly amended by HITECH 2009 + 2013 Omnibus Final Rule; governs PHI use + disclosure + individual rights; HITECH expanded application to BAs + strengthened individual rights + enforcement. HIPAA SECURITY RULE (45 CFR Part 164 Subpart C, SEPARATELY VERIFIED in this corpus) - established 2003 + significantly amended by HITECH 2009 + 2013 Omnibus + 2024 NPRM modernisation; administrative + physical + technical safeguards for ePHI; HITECH extended direct application to BAs + added Breach Notification Rule; 2024 NPRM proposed enhancements include MFA + encryption + asset inventory + ransomware response + vulnerability management. 2013 HIPAA OMNIBUS FINAL RULE (78 FR 5566): implementing HITECH Privacy/Security amendments + Genetic Information Nondiscrimination Act (GINA) + breach notification + BA direct liability + marketing/fundraising changes + sale of PHI; effective 23 March 2013 + compliance 23 September 2013. 21st CENTURY CURES ACT (Public Law 114-255 of 13 December 2016): Section 4002 directing ONC + HHS to implement INFORMATION BLOCKING + interoperability + USCDI + Open APIs; Information Blocking Final Rule (ONC) effective phased + Cures Act Final Rule 2020. ONC INFORMATION BLOCKING FINAL RULE (85 FR 25642 of 1 May 2020): defines + prohibits Information Blocking by actors (HIT developers + HIE/HIN + healthcare providers) + 8 exceptions (preventing harm + privacy + security + infeasibility + Health IT performance + content + manner + fees + licensing); penalties USD 1M per violation for HIT developers + HIE/HIN actors (administered by HHS OIG); ASTP Information Blocking Disincentives Final Rule (2024) for healthcare providers (different penalties + reductions in Medicare reimbursement). ONC CERTIFICATION PROGRAM + 2015 EDITION CURES UPDATE: continued evolution of EHR + Health IT module certification criteria including USCDI + FHIR + interoperability + security + Information Blocking compliance. USCDI (United States Core Data for Interoperability) v1-v4+: standardised health data elements + classes + ongoing semiannual updates. TEFCA (Trusted Exchange Framework and Common Agreement, 2022): voluntary network-of-networks framework for nationwide interoperable HIE; QHINs operationalising. STATE PRIVACY LAWS COORDINATION: state-specific health privacy laws (e.g. NY State Information Security Breach Notification + CMIA California + others) coordinate with HITECH/HIPAA; preemption analysis case-by-case.
What else in your programme already covers this
This control maps to 155 controls across 58 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process
3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process