# HITECH Act Privacy — Standards and References

## Primary Legal Sources
- **HITECH Act** — Title XIII of Pub. L. 111-5 (American Recovery and Reinvestment Act of 2009)
- **HITECH §13400-13424** — Subtitle D — Privacy (breach notification, penalties, enforcement, BA liability)
- **HITECH §13401** — Application of Security Provisions to Business Associates
- **HITECH §13402** — Notification in the Case of Breach
- **HITECH §13404** — Application of Privacy Provisions to Business Associates
- **HITECH §13405** — Restrictions on certain disclosures and sales of PHI; minimum necessary enhancement; accounting of disclosures for EHR
- **HITECH §13410** — Improved enforcement (penalty tiers, state AG authority, percentage to individuals)
- **HITECH §13412** — Recognized security practices (2021 amendment via Pub. L. 116-321)
- **78 FR 5566** — Omnibus Rule implementing HITECH provisions (January 25, 2013)

## ONC / Meaningful Use
- **45 CFR Part 170** — Health Information Technology: Standards, Implementation Specifications, and Certification Criteria
- **CMS Promoting Interoperability Program** — formerly EHR Incentive Program / Meaningful Use
- **HTI-1 Final Rule** (88 FR 62592, December 13, 2023) — Health Data, Technology, and Interoperability; AI transparency requirements

## State AG Enforcement
- **HITECH §13410(e)** — State AG authority to bring civil actions for HIPAA violations
- **State AG enforcement precedents**: Connecticut v. Health Net (2010), Minnesota v. Accretive Health (2011), New York v. EyeMed (2021)