Who must comply with the HITECH amendments to HIPAA?

Covered entities and business associates under HIPAA must comply with HIPAA, as amended by HITECH.

Isn't every physician a covered entity under HIPAA?

No. Only providers who electronically submit specific transactions electronically are covered by (required to comply with) HIPAA. The most common transaction that makes a provider covered is the electronic submission of claims to health plans. The Department of Health and Human Services (HHS) has useful resources to determine the applicability of the federal HIPAA regulations posted at <www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/index.html>.

What is a business associate?

Under the privacy rule, a business associate is a person who provides a function on behalf of a covered entity (other than as part of the covered entity's workforce) that involves the use of protected health information (PHI). Examples of this type of business associate include billing services, transcription services, and answering services. A business associate is also a person who provides specified services involving the use of PHI to a covered entity. The specified services are legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, and financial services. The HHS Web site at <www.hhs.gov/ocr/privacy> has much more information on entities that are, and are not, business associates.

Business associates may use and disclose PHI, but only in compliance with the business associate agreement evidencing the business associate's promise to maintain the confidentiality and security of PHI. Under existing law, business associates only have contractual liability with the covered entity via the business associate agreement. As of February 2010, business associates must comply with the security rule and will be subject to government enforcement.

What does HITECH say about HIPAA?

There are many changes to HIPAA under HITECH, but not all of the provisions have the same effective date. See Summary Timeline for HITECH Requirements for Providers Covered Under HIPAA for a summary timeline showing the implications of the major HITECH provisions on HIPAA-covered entities.

The most significant provisions of HITECH include the following: