HITECH sectoral application + OCR Wall of Shame. SECTOR ADOPTION: HITECH applies to ALL HIPAA covered entity + BAs handling PHI in US healthcare ecosystem + downstream subcontractor BAs. KEY SECTORS: (a) HEALTH PLANS - commercial + Medicare + Medicaid + Marketplace; major payers (UnitedHealth + Anthem + Aetna + CVS + Cigna + Humana + BCBS + Kaiser + many more); HITECH + 2013 Omnibus + recent OCR enforcement includes large health plan settlements (Anthem USD 16M + Premera USD 6.85M + Excellus USD 5.1M); (b) HEALTHCARE PROVIDERS - hospitals + health systems + ambulatory care + private practices + dentists + chiropractors + therapists + telehealth; HITECH MU/PI EHR adoption + Information Blocking + breach notification + OCR audits; major hospital systems include HCA + CommonSpirit + Tenet + Ascension + Trinity + Kaiser + Mayo + Cleveland Clinic + Johns Hopkins + Mass General Brigham + Geisinger + Sutter + many others; (c) HEALTHCARE CLEARINGHOUSES - claims processing + EDI; e.g. Change Healthcare (subject of major February 2024 ransomware attack affecting 100+M people); (d) PHARMACEUTICAL + BIOTECH + LIFE SCIENCES - clinical trials + research + post-market surveillance + GxP compliance + PHI handling; major manufacturers (Pfizer + Johnson + Johnson + Roche + Novartis + Merck + Eli Lilly + Bristol Myers Squibb + many more); (e) TECH + EHR + DIGITAL HEALTH BAs - Epic + Cerner (Oracle Health) + Allscripts (Veradigm) + Meditech + athenahealth + eClinicalWorks + NextGen + many digital health startups + Apple Health + Google Health + telehealth platforms (Teladoc + Amwell + others); (f) ANCILLARY HEALTHCARE - labs (Quest + LabCorp + Sonic) + imaging (RadiologyPartners + Akumin) + DME suppliers + pharmacies (CVS + Walgreens + Rite Aid + Express Scripts + Amazon Pharmacy); (g) NON-HEALTHCARE BAs - cloud providers (AWS HealthLake + Azure + Google Cloud Healthcare) + analytics + AI/ML providers + billing services + collection agencies + accountants + lawyers + IT services + many others. OCR WALL OF SHAME: HHS OCR publishes breaches affecting 500+ individuals on hhs.gov OCR Breach Portal; ~5,000+ breaches reported since 2010 + affecting hundreds of millions of individuals; trends show ransomware + hacking dominant + hospital systems + health plans largest victims + technology + EHR providers increasingly targeted. RECENT MAJOR BREACHES (2024-2025): Change Healthcare ransomware (~100+M people, largest in healthcare history); Ascension Health ransomware (~5M); HCA Healthcare; Anthem (2015, 78.8M still notable); Premera; Excellus; ongoing hospital + health plan + BA ransomware crisis. SECTORAL COORDINATION: HHS + CMS + ONC + ASTP + FDA + CISA + HSCC (Healthcare and Public Health Sector Coordinating Council) + HHS-405D Task Group + HSCC Joint Cybersecurity Working Group provide sectoral cybersecurity coordination + best practices + threat-sharing + tabletop exercises.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.