HITECH

Question 1

HITECH updates HIPAA how?

Answer 1

BAs now directly covered by HIPAA instead of via BAAs

Question 2

What is considered a breach under HITECH?

Answer 2

• unauthorized MADE (modification/access/deletion/exfiltration) of unsecurred ePHI
• privacy/security compromised

Question 3

What is NOT considered a breach under HITECH?

Answer 3

• unauthorized MADE but high confidence ePHI not affected
  (ePHI is not access or is encrypted)
• burden of proof on CE/BA

Question 4

HITECH Rulemaking

Answer 4

HHS OCR
HHS ONC

Question 5

HITECH Enforcement

Answer 5

• HHS OCR enforces obligations of CEs/BAs
• FTC enforces Breach notification duties

Question 6

HITECH HBNR duty to individuals

Answer 6

• must notify individuals within 60 days

Question 7

HITECH HBNR duty to HHS

Answer 7

• over 500 = must notify HHS immediately
• under 500 = must notify HHS annually

Question 8

HITECH HBNR duty to media

Answer 8

• 500+ in same jurisdiction = CE must notify media

Question 9

Penalties

Answer 9

• up tot 2 million fine
• criminal liability for misue of ePHI

Question 10

What did HITECH push for?

Answer 10

• EHR to be adopted

Question 11

EHR Requirements

Answer 11

• provide patients with EHR upon request
• account for all non-oral disclosures within the last 3 years
• not sell EHR w/o patient consent