What Is the HITECH Act? What It Changed in HIPAA

The HITECH Act, the Health Information Technology for Economic and Clinical Health Act, was signed into law on February 17, 2009 as part of the American Recovery and Reinvestment Act to promote health IT and strengthen HIPAA enforcement. HHS says it was enacted "to promote the adoption and meaningful use of health information technology," and that its Subtitle D strengthens "the civil and criminal enforcement of the HIPAA rules" (HHS). Its lasting effects for marketers are tiered penalties, breach notification, State Attorney General enforcement and direct liability for business associates, including tracking vendors that handle PHI. Curve Compliance signs a BAA on every plan.

Book a call. Curve Compliance strips PHI before data reaches an ad platform, and Curve's team does the setup. Book a call with Curve.

The HITECH Act in brief

HITECH did two jobs. It paid incentives for adopting electronic health records, and it rewrote parts of HIPAA so the rules had more force once more data was digital. HHS turned a number of the HIPAA changes into regulation in its 2013 Omnibus rule, which "implements a number of provisions of the HITECH Act to strengthen the privacy and security protections for health information established under HIPAA, finalizing the Breach Notification Rule" (HHS; Federal Register). HIPAA itself dates from 1996, Public Law 104-191 (HHS).

What HITECH changed in HIPAA

Change	What HITECH did	Source
Penalty tiers	Created "Four categories of violations that reflect increasing levels of culpability" with matching penalty tiers and "A maximum penalty amount of $1.5 million for all violations of an identical provision." It also barred penalties for violations corrected within 30 days unless due to willful neglect.	HHS, section 13410(d)
Breach notification	Section 13400 defined "breach" and section 13402 "enacted breach notification requirements," now the HIPAA Breach Notification Rule.	HHS; HHS
Business associate liability	Made "business associates of covered entities directly liable for compliance with certain requirements of the HIPAA Rules."	HHS
State Attorneys General	Gave them "the authority to bring civil actions on behalf of state residents for violations of the HIPAA Privacy and Security Rules."	HHS, section 13410(e)
Criminal reach	Section 13409 added that "a person (including an employee or other individual)" who obtains or discloses information held by a covered entity without authorization can commit the federal offense.	42 U.S.C. 1320d-6
Health apps outside HIPAA	Breach notification for vendors of personal health records, enforced by the FTC, "pursuant to section 13407 of the HITECH Act."	HHS; FTC

The penalty tiers today

HITECH's four tiers live in 45 CFR 160.404(b)(2), for violations on or after February 18, 2009 (eCFR). The dollar amounts are adjusted for inflation: "These amounts will be updated annually and published at 45 CFR part 102" (eCFR; 45 CFR part 102). For the current figures, see the HIPAA marketing penalties reference table.

Tier	Culpability under 45 CFR 160.404(b)(2)
1	The entity "did not know and, by exercising reasonable diligence, would not have known" of the violation (eCFR)
2	The violation "was due to reasonable cause and not to willful neglect" (eCFR)
3	Willful neglect, corrected within 30 days of when the entity knew or should have known (eCFR)
4	Willful neglect, not corrected within that 30-day period (eCFR)

The first tier matters most for website tracking. Before HITECH, HHS explains, penalties were barred when an entity did not know and could not reasonably have known of a violation; HITECH struck that bar, so "such violations are now punishable under the lowest tier of penalties" (HHS). Not knowing what a pixel sends does not, on its own, bar a penalty.

HITECH vs HIPAA

HIPAA is the 1996 law and the rules HHS wrote under it: the Privacy Rule, the Security Rule and the Enforcement Rule (HHS). HITECH is a 2009 law that amended how those rules are enforced and added to them. For a clinic, HITECH's privacy changes show up as amendments to the HIPAA Rules, such as the 2013 Omnibus rule that finalized the Breach Notification Rule, rather than as a separate rulebook (HHS). For a walk through each rule, see the HIPAA rules explained.

Meaningful use, briefly

The other half of HITECH paid providers to adopt electronic records. CMS says the Medicare and Medicaid EHR Incentive Programs were "Established in 2011 as required in the Health Information Technology for Economic and Clinical Health (HITECH) Act," and that providers "were incentivized to adopt and meaningfully use CEHRT," meaning certified EHR technology (CMS). Those programs are now the Medicare Promoting Interoperability Program for hospitals and the Promoting Interoperability performance category of MIPS for clinicians, and CMS says the Medicaid program "ended on December 31, 2021" (CMS).

What HITECH means for marketing vendors today

Direct liability is the change marketers feel. HHS lists what business associates are directly liable for, including "Impermissible uses and disclosures of PHI," "Failure to comply with the requirements of the Security Rule," and "Failure to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (HHS). HHS says a covered entity may disclose PHI to a business associate if it obtains "satisfactory assurances, in the form of a contract or other written arrangement," the business associate agreement (HHS). See what a business associate is.

HHS's tracking bulletin applies this to analytics and ad tools: tracking technology vendors "are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function" (HHS). Ad platforms that will not sign a BAA are a different case, and HHS says disclosures of PHI to tracking vendors "for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS). Under HITECH's breach rule, "An impermissible use or disclosure of protected health information is presumed to be a breach" unless a risk assessment shows a low probability of compromise (HHS). See the HIPAA breach notification rule and breach liability for clinic marketing teams.

Health apps outside HIPAA are not out of reach either. HITECH section 13407 is the basis for the FTC's Health Breach Notification Rule, which "requires vendors of personal health records and related entities to notify consumers following a breach involving unsecured information" (FTC; HHS). See who the FTC rule covers beyond HIPAA.

How Curve Compliance helps

HITECH made business associates, such as a tracking vendor that handles PHI for you, directly liable, and made unknowing violations punishable. Curve Compliance signs a BAA on every plan, replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to each platform and what the platform accepted, so you can see what each platform received. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For questions about your own obligations, talk to your counsel.

Sources, checked October 26, 2026: HHS, HITECH Act Enforcement Interim Final Rule; HHS, State Attorneys General; HHS, Direct Liability of Business Associates; HHS, Business Associates; HHS, Breach Notification Rule; HHS, HIPAA for Professionals; HHS, Fact Sheet 42 CFR Part 2 Final Rule; HHS, Use of Online Tracking Technologies; HHS, Model Notices of Privacy Practices; 45 CFR 160.404; 45 CFR part 102; 42 U.S.C. 1320d-6; Federal Register, 78 FR 5566 (2013); CMS, Promoting Interoperability; FTC, Health Breach Notification Rule.

Frequently Asked Questions

What is the HITECH Act of 2009?

It is the Health Information Technology for Economic and Clinical Health Act, signed on February 17, 2009 as part of the American Recovery and Reinvestment Act to promote health IT and strengthen HIPAA enforcement (HHS).

What is HITECH in healthcare?

It is the 2009 law behind two things providers still live with: the EHR incentive programs, now Promoting Interoperability (CMS), and stronger HIPAA enforcement, including breach notification and business associate liability (HHS; HHS).

What is HITECH used for?

Its lasting effects today are on enforcement: the penalty tiers in 45 CFR 160.404 (eCFR), the duty to notify after a breach (HHS), direct liability for business associates (HHS), and State Attorney General lawsuits (HHS).

What is the most accurate purpose of the HITECH Act?

In HHS's words, "to promote the adoption and meaningful use of health information technology," with Subtitle D addressing "the privacy and security concerns associated with the electronic transmission of health information" (HHS).

What is the difference between HITECH and HIPAA?

HIPAA (1996) created the privacy and security rules; HITECH (2009) amended them, adding breach notification, tiered penalties, State AG actions and business associate liability (HHS; HHS).

What are the HITECH Act penalties?

Four tiers by culpability, from not knowing to uncorrected willful neglect, set in 45 CFR 160.404, with amounts adjusted each year in 45 CFR part 102 (eCFR). Knowingly obtaining or disclosing health information in violation of HIPAA is also a federal crime (42 U.S.C. 1320d-6).

What is meaningful use called now?

Promoting Interoperability. CMS runs the Medicare Promoting Interoperability Program for hospitals, and clinicians report under the MIPS Promoting Interoperability performance category (CMS).

What is the new HIPAA rule in 2026?

"As of February 16, 2026," HHS says, covered entities must include information about substance use disorder records in their notice of privacy practices (HHS). See the new HIPAA rule in 2026 and the notice of privacy practices.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.