The Health Information Technology for Economic and Clinical Health Act (HITECH) (2009)

The HITECH Act requires that anyone with custody of personal health records send a notification to affected individuals if their personal health records have been disclosed, or the employer believes they have been disclosed, to any unauthorized person. Enacted as part of the American Recovery and Reinvestment Act (ARRA), this law made several changes to the Health Insurance Portability and Accountability Act, including the establishment of a federal standard for security breach notifications that requires covered entities, in the event of a breach of any personal health records (PHI) information, to notify each individual whose PHI has been disclosed without authorization. For more information, see www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/hitechenforcementifr
.html.