Back to Frameworks

HITECH Act

Self-Assess
United States (federal)
vPublic Law 111-5, Division A Title XIII and Division B Title IV (17 February 2009), as amended by Public Law 116-321 (5 January 2021)
2 domains
22 controls

The Health Information Technology for Economic and Clinical Health Act (HITECH Act) is a US federal statute enacted 17 February 2009 as Title XIII of the AMERICAN RECOVERY AND REINVESTMENT ACT (ARRA, Public Law 111-5, Stimulus Act). HITECH represents the most significant amendment to HIPAA since enactment. KEY PURPOSES + ACHIEVEMENTS: (a) promoting EHR adoption + Health Information Technology + Meaningful Use + interoperability across the US healthcare system; (b) substantially enhancing HIPAA Privacy Rule + HIPAA Security Rule (separately verified) enforcement with tier-based civil monetary penalties + criminal sanctions + State Attorney General enforcement authority; (c) extending HIPAA direct liability to BUSINESS ASSOCIATES + subcontractor business associates downstream; (d) establishing the HITECH BREACH NOTIFICATION RULE (45 CFR Part 164 Subpart D); (e) strengthening individual rights including electronic access + accounting of disclosures + restrictions on disclosures to health plans + prohibition on sale of PHI + tightened marketing + fundraising; (f) creating Office of the National Coordinator for Health IT (ONC) with statutory authority. STRUCTURE: 4 Subtitles - SUBTITLE A Promotion of Health Information Technology (42 USC 17901-17915); SUBTITLE B Testing of Health IT (42 USC 17916-17919); SUBTITLE C Grants/Loans/Workforce (42 USC 17921-17924); SUBTITLE D Privacy and Security Provisions (42 USC 17931-17953 - the HITECH Privacy/Security amendments). KEY SUBTITLE D PROVISIONS: (a) Section 17931 application of security provisions + penalties to BAs; (b) Section 17932 BREACH NOTIFICATION (codified at 45 CFR 164.400-414); (c) Section 17933 education on health information privacy; (d) Section 17934 application of privacy provisions + penalties to BAs; (e) Section 17935 restrictions on certain disclosures + sales of PHI; (f) Section 17936 conditions on contacts as part of health care operations; (g) Section 17937 individual access + accounting of disclosures; (h) Section 17938 conditioning compliance + enforcement; (i) Section 17939 enforcement provisions (tier-based civil monetary penalties up to USD 1.5M/year per category); (j) Section 17940 education + outreach. ENFORCEMENT: HHS Office for Civil Rights (OCR) primary enforcer + State Attorneys General authority to pursue HIPAA violations on behalf of state residents; tier-based civil monetary penalties: Tier 1 (did not know) USD 100-50K per violation, USD 25K annual max; Tier 2 (reasonable cause) USD 1K-50K per violation, USD 100K annual max; Tier 3 (willful neglect, corrected) USD 10K-50K per violation, USD 250K annual max; Tier 4 (willful neglect, uncorrected) USD 50K per violation, USD 1.5M annual max (per category; inflation-adjusted). RECENT HHS OCR ENFORCEMENT: substantial penalties including Anthem USD 16M + Premera USD 6.85M + Excellus USD 5.1M + Memorial Healthcare USD 5.5M + Advocate USD 5.55M + many other settlements + corrective action plans + audits. MEANINGFUL USE / PROMOTING INTEROPERABILITY: CMS Promoting Interoperability program (formerly Meaningful Use) for EHR Incentive Payments + later Medicare Quality Payment Program (MIPS); 3 stages + value-based care + 2018+ EHR Reporting + Promoting Interoperability + post-Cures Act + ONC USCDI + Open APIs + Information Blocking Final Rule. ONC (Office of the National Coordinator): statutory authority + HIT Standards + Certification programs + Information Blocking + Trusted Exchange Framework + Common Agreement (TEFCA) + Health Data Networks. SUBSEQUENT REGULATORY ACTIVITY: (1) 2013 HIPAA Omnibus Final Rule implementing HITECH including direct BA liability + breach notification + marketing/fundraising changes + sale of PHI; (2) 2016 21st Century Cures Act + Sec. 4002 ONC Information Blocking + HIT Advisory Committee + ONC USCDI; (3) 2020 ONC Cures Act Final Rule + Information Blocking + Open APIs + FHIR R4 implementation; (4) 2024 HHS Notice of Proposed Rulemaking on HIPAA Security Rule modernisation (NPRM December 2024) + comments closing March 2025 + potential Final Rule 2025-2026 incorporating cybersecurity best practices + MFA + encryption + asset inventory + ransomware response; (5) 2024 HHS final rule on reproductive health privacy + April 2024 enforcement effective; (6) ongoing OCR audits + enforcement priorities + ransomware + HIPAA Security Rule violations.

Verified

HITECH Act is a compliance framework from United States (federal) with 2 domains and 22 controls that map to 72 other frameworks. The largest domains are Subtitle D Part 1: improved privacy and security provisions (sections 13401 to 13412) – HITECH Act (16 controls), Subtitle D Part 2 and enforcement: relationship to other laws, effective date, reports – HITECH Act (6 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (2)

Subtitle D Part 1: improved privacy and security provisions (sections 13401 to 13412) – HITECH Act

16 controls
Controls in the Subtitle D Part 1: improved privacy and security provisions (sections 13401 to 13412) – HITECH Act domain of HITECH Act: 16 controls
CodeTitle
hitech-act::13401Section 13401: HIPAA Security Rule safeguards and penalties apply directly to business associates
hitech-act::13402aSection 13402(a) to (c): notify every individual whose unsecured PHI was breached; breaches deemed discovered when known or reasonably knowable
hitech-act::13402bSection 13402(b): a business associate notifies the covered entity of a breach and identifies each affected individual
hitech-act::13402dSection 13402(d) and (g): notify without unreasonable delay and within 60 calendar days of discovery, with the burden of proof on the notifier; delay only at law enforcement request
hitech-act::13402eSection 13402(e): methods of notice: written notice to individuals, substitute notice, media notice above 500 residents of a state, notice to the Secretary and the public breach list
hitech-act::13402fSection 13402(f): content of the notice
hitech-act::13404Section 13404: HIPAA Privacy Rule use and disclosure limits and penalties apply directly to business associates
hitech-act::13405aSection 13405(a): honour a requested restriction on disclosure to a health plan where the patient paid out of pocket in full
hitech-act::13405bSection 13405(b): limit uses, disclosures and requests to the limited data set or the minimum necessary, determined by the discloser
hitech-act::13405cSection 13405(c): accounting of disclosures for treatment, payment and operations made through an electronic health record
hitech-act::13405dSection 13405(d): no sale of protected health information without an authorization that states whether it may be resold
hitech-act::13405eSection 13405(e): electronic access to an electronic health record, transmission to a designated third party, and a fee capped at labour cost
hitech-act::13406aSection 13406(a): marketing communications paid for by a third party are not health care operations without an authorization
hitech-act::13406bSection 13406(b): every written fundraising communication must offer a clear and conspicuous opt-out, treated as a revocation of authorization
hitech-act::13407Section 13407: breach notification by vendors of personal health records and other non-HIPAA entities to individuals and the FTC
hitech-act::13408Section 13408: health information exchanges, e-prescribing gateways and PHR vendors serving covered entities are business associates and must have contracts

Subtitle D Part 2 and enforcement: relationship to other laws, effective date, reports – HITECH Act

6 controls
Controls in the Subtitle D Part 2 and enforcement: relationship to other laws, effective date, reports – HITECH Act domain of HITECH Act: 6 controls
CodeTitle
hitech-act::13409Section 13409: criminal penalties reach any person, including an employee, who obtains or discloses protected health information without authorization
hitech-act::13410aSection 13410(a) and (b): willful neglect violations must be penalised and complaints indicating willful neglect must be formally investigated
hitech-act::13410dSection 13410(d): four tiers of civil money penalties by culpability, with annual caps
hitech-act::13410eSection 13410(e): state attorneys general may sue for HIPAA violations affecting their residents
hitech-act::13411Section 13411: periodic HHS audits of covered entities and business associates
hitech-act::13412Section 13412 (added by Public Law 116-321, 2021): recognized security practices in place for the prior twelve months are considered in fines, audits and settlements

Your Compliance Coverage

If you comply with HITECH Act, you already cover:

Privacy Act 1988 (Australia)

12%

4 controls mapped

Compare →

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP)

12%

4 controls mapped

Compare →

Law No. 172-13 on the Protection of Personal Data

12%

4 controls mapped

Compare →

+ 69 more: India DPDP Act (12%), APPI (12%)

See all 72 mapped frameworks ↓

Maps to 72 other frameworks

33 total controls
Privacy Act 1988 (Australia)
4 source controls mapped|3 target controls covered
12%
Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP)
4 source controls mapped|2 target controls covered
12%
Law No. 172-13 on the Protection of Personal Data
4 source controls mapped|2 target controls covered
12%
India DPDP Act
4 source controls mapped|2 target controls covered
12%
APPI
4 source controls mapped|5 target controls covered
12%
Bahrain PDPL
4 source controls mapped|5 target controls covered
12%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
4 source controls mapped|7 target controls covered
12%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
4 source controls mapped|3 target controls covered
12%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
4 source controls mapped|5 target controls covered
12%
Pakistan Personal Data Protection Bill 2023
3 source controls mapped|2 target controls covered
9%
Barbados Data Protection Act 2019
3 source controls mapped|2 target controls covered
9%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
3 source controls mapped|2 target controls covered
9%
TEFCA - Trusted Exchange Framework and Common Agreement
3 source controls mapped|2 target controls covered
9%
Regulation on the European Health Data Space (EHDS)
3 source controls mapped|3 target controls covered
9%
OWASP Top 10:2025
3 source controls mapped|5 target controls covered
9%
OWASP DevSecOps Maturity Model (DSOMM)
3 source controls mapped|3 target controls covered
9%
ICH E6(R3) - Good Clinical Practice
3 source controls mapped|3 target controls covered
9%
ISO/IEC 27400:2022
3 source controls mapped|3 target controls covered
9%
BSI IT-Grundschutz
3 source controls mapped|11 target controls covered
9%
IEC 60601-1 - Medical Electrical Equipment Safety
3 source controls mapped|1 target controls covered
9%
FDA Quality Management System Regulation (QMSR)
3 source controls mapped|2 target controls covered
9%
COSO Internal Control - Integrated Framework (2013)
3 source controls mapped|2 target controls covered
9%
ASD Strategies to Mitigate Cyber Security Incidents
3 source controls mapped|5 target controls covered
9%
Aged Care Quality Standards 2019 (repealed edition)
3 source controls mapped|3 target controls covered
9%
FFIEC Cybersecurity Assessment Tool (CAT)
3 source controls mapped|5 target controls covered
9%
Florida Digital Bill of Rights (FDBR)
3 source controls mapped|2 target controls covered
9%
Vermont Data Privacy and Online Surveillance Act
2 source controls mapped|1 target controls covered
6%
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
2 source controls mapped|1 target controls covered
6%
India Account Aggregator Framework (RBI)
2 source controls mapped|1 target controls covered
6%
Azure Security Benchmark
2 source controls mapped|1 target controls covered
6%
GDPR
2 source controls mapped|1 target controls covered
6%
Section 508 - ICT Accessibility (Revised)
2 source controls mapped|2 target controls covered
6%
US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements
2 source controls mapped|1 target controls covered
6%
Protective Security Policy Framework (PSPF) Release 2026
2 source controls mapped|3 target controls covered
6%
OWASP ASVS
2 source controls mapped|5 target controls covered
6%
OWASP API Security Top 10 - 2023
2 source controls mapped|3 target controls covered
6%
MITRE D3FEND
2 source controls mapped|2 target controls covered
6%
ICAO Annex 17 - Aviation Security (AVSEC)
2 source controls mapped|2 target controls covered
6%
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
2 source controls mapped|5 target controls covered
6%
HL7 FHIR Security Framework
2 source controls mapped|3 target controls covered
6%
HKMA Cyber Resilience Assessment Framework (C-RAF)
2 source controls mapped|2 target controls covered
6%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
2 source controls mapped|6 target controls covered
6%
Canada ITSG-33 - IT Security Risk Management
2 source controls mapped|1 target controls covered
6%
ISO/IEC 27010:2015
2 source controls mapped|4 target controls covered
6%
FTC GLBA Safeguards Rule (16 CFR Part 314)
2 source controls mapped|2 target controls covered
6%
IEC 62351 - Power Systems Communication Security
2 source controls mapped|3 target controls covered
6%
API 1164
2 source controls mapped|6 target controls covered
6%
ISO/IEC 27011:2024
2 source controls mapped|4 target controls covered
6%
FFIEC IT Examination Handbook
2 source controls mapped|4 target controls covered
6%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
2 source controls mapped|5 target controls covered
6%
Annex 11 to EU GMP - Computerised Systems
2 source controls mapped|3 target controls covered
6%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
1 source controls mapped|1 target controls covered
3%
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
1 source controls mapped|1 target controls covered
3%
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)
1 source controls mapped|1 target controls covered
3%
FedRAMP Rev 5
1 source controls mapped|3 target controls covered
3%
FBI CJIS Security Policy
1 source controls mapped|2 target controls covered
3%
ISO/IEC 23837:2023
1 source controls mapped|3 target controls covered
3%
FIDO2 / WebAuthn
1 source controls mapped|1 target controls covered
3%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
1 source controls mapped|1 target controls covered
3%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
1 source controls mapped|2 target controls covered
3%
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
1 source controls mapped|1 target controls covered
3%
Singapore Cybersecurity Act 2018
1 source controls mapped|1 target controls covered
3%
Nevada Gaming Control Board Cybersecurity Requirements
1 source controls mapped|1 target controls covered
3%
India CERT-In Cyber Security Directions 2022
1 source controls mapped|1 target controls covered
3%
APRA CPS 234
1 source controls mapped|2 target controls covered
3%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
1 source controls mapped|2 target controls covered
3%
APRA CPS 230 Operational Risk Management
1 source controls mapped|1 target controls covered
3%
ISO/IEC 30111:2019
1 source controls mapped|2 target controls covered
3%
ASIS SPC.1-2009 - Organizational Resilience Standard
1 source controls mapped|1 target controls covered
3%
MiFID II / MiFIR
1 source controls mapped|1 target controls covered
3%
ILO Tripartite Declaration of Principles concerning Multinational Enterprises (MNE Declaration)
1 source controls mapped|1 target controls covered
3%
US Automated Commercial Environment (ACE) - CBP Trade Data Requirements
1 source controls mapped|1 target controls covered
3%
Compare HITECH Act with Privacy Act 1988 (Australia)

Coverage is not the same as your position

This page shows what HITECH Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is HITECH Act and who does it apply to?

HITECH Act is a compliance framework from United States (federal) with 2 domains and 22 controls. The Health Information Technology for Economic and Clinical Health Act (HITECH Act) is a US federal statute enacted 17 February 2009 as Title XIII of the AMERICAN RECOVERY AND REINVESTMENT ACT (ARRA, Public Law 111-5, Stimulus Act). HITECH represents the most significant amendment to HIPAA since enactment. KEY PURPOSES + ACHIEVEMENTS: (a) promoting EHR adoption + Health Information Technology + Meaningful Use + interoperability across the US healthcare system; (b) substantially enhancing HIPAA Privacy Rule + HIPAA Security Rule (separately verified) enforcement with tier-based civil monetary penalties + criminal sanctions + State Attorney General enforcement authority; (c) extending HIPAA direct liability to BUSINESS ASSOCIATES + subcontractor business associates downstream; (d) establishing the HITECH BREACH NOTIFICATION RULE (45 CFR Part 164 Subpart D); (e) strengthening individual rights including electronic access + accounting of disclosures + restrictions on disclosures to health plans + prohibition on sale of PHI + tightened marketing + fundraising; (f) creating Office of the National Coordinator for Health IT (ONC) with statutory authority. STRUCTURE: 4 Subtitles - SUBTITLE A Promotion of Health Information Technology (42 USC 17901-17915); SUBTITLE B Testing of Health IT (42 USC 17916-17919); SUBTITLE C Grants/Loans/Workforce (42 USC 17921-17924); SUBTITLE D Privacy and Security Provisions (42 USC 17931-17953 - the HITECH Privacy/Security amendments). KEY SUBTITLE D PROVISIONS: (a) Section 17931 application of security provisions + penalties to BAs; (b) Section 17932 BREACH NOTIFICATION (codified at 45 CFR 164.400-414); (c) Section 17933 education on health information privacy; (d) Section 17934 application of privacy provisions + penalties to BAs; (e) Section 17935 restrictions on certain disclosures + sales of PHI; (f) Section 17936 conditions on contacts as part of health care operations; (g) Section 17937 individual access + accounting of disclosures; (h) Section 17938 conditioning compliance + enforcement; (i) Section 17939 enforcement provisions (tier-based civil monetary penalties up to USD 1.5M/year per category); (j) Section 17940 education + outreach. ENFORCEMENT: HHS Office for Civil Rights (OCR) primary enforcer + State Attorneys General authority to pursue HIPAA violations on behalf of state residents; tier-based civil monetary penalties: Tier 1 (did not know) USD 100-50K per violation, USD 25K annual max; Tier 2 (reasonable cause) USD 1K-50K per violation, USD 100K annual max; Tier 3 (willful neglect, corrected) USD 10K-50K per violation, USD 250K annual max; Tier 4 (willful neglect, uncorrected) USD 50K per violation, USD 1.5M annual max (per category; inflation-adjusted). RECENT HHS OCR ENFORCEMENT: substantial penalties including Anthem USD 16M + Premera USD 6.85M + Excellus USD 5.1M + Memorial Healthcare USD 5.5M + Advocate USD 5.55M + many other settlements + corrective action plans + audits. MEANINGFUL USE / PROMOTING INTEROPERABILITY: CMS Promoting Interoperability program (formerly Meaningful Use) for EHR Incentive Payments + later Medicare Quality Payment Program (MIPS); 3 stages + value-based care + 2018+ EHR Reporting + Promoting Interoperability + post-Cures Act + ONC USCDI + Open APIs + Information Blocking Final Rule. ONC (Office of the National Coordinator): statutory authority + HIT Standards + Certification programs + Information Blocking + Trusted Exchange Framework + Common Agreement (TEFCA) + Health Data Networks. SUBSEQUENT REGULATORY ACTIVITY: (1) 2013 HIPAA Omnibus Final Rule implementing HITECH including direct BA liability + breach notification + marketing/fundraising changes + sale of PHI; (2) 2016 21st Century Cures Act + Sec. 4002 ONC Information Blocking + HIT Advisory Committee + ONC USCDI; (3) 2020 ONC Cures Act Final Rule + Information Blocking + Open APIs + FHIR R4 implementation; (4) 2024 HHS Notice of Proposed Rulemaking on HIPAA Security Rule modernisation (NPRM December 2024) + comments closing March 2025 + potential Final Rule 2025-2026 incorporating cybersecurity best practices + MFA + encryption + asset inventory + ransomware response; (5) 2024 HHS final rule on reproductive health privacy + April 2024 enforcement effective; (6) ongoing OCR audits + enforcement priorities + ransomware + HIPAA Security Rule violations. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does HITECH Act actually require?

HITECH Act has 22 controls organised across 2 domains. The largest domains are Subtitle D Part 1: improved privacy and security provisions (sections 13401 to 13412) – HITECH Act (16 controls), Subtitle D Part 2 and enforcement: relationship to other laws, effective date, reports – HITECH Act (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of HITECH Act do I already cover?

HITECH Act maps to 72 other compliance frameworks. The top mapping partners are Privacy Act 1988 (Australia) (12% coverage), Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) (12% coverage), Law No. 172-13 on the Protection of Personal Data (12% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement HITECH Act?

Start your HITECH Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about HITECH Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 22 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required