Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting.

It targets companies that deal with the storage or movement of medical and financial files, which targets the small business that I work for. We want to ensure we are following these regulations as to not have penalty fines.

THE QUESTION: What does the Act outline and what steps can we take to ensure we are following it?

  • I'm having a little trouble determining exactly what you're asking us for. Would you care to clarify, and maybe get a bit more specific on your question?
    – Scott Pack
    Commented Dec 6, 2011 at 19:24
  • 1
    Most likely to be answered at HealthcareIT.se
    – Jeff Ferland
    Commented Dec 6, 2011 at 21:31
  • 2
    Do you have a copy of the act? I have just had a quick look online and it seems to explain the privacy additions to HIPAA quite clearly. Can you revise your question to list what you don't understand in the act?
    – Rory Alsop
    Commented Dec 7, 2011 at 15:15
  • 2
    That's because HITECH is a different law 12.5 years newer than HIPAA. Title XIII of Division A of the American Recovery and Reinvestment Act of 2009 (the "stimulus bill") states that "the HITECH Act" refers to that title and Title IV of Division B.
    – minopret
    Commented Mar 9, 2012 at 4:14
  • 1
    For those who come across this: check out (1) healthit.hhs.gov/portal/server.pt/community/…
    – Eric G
    Commented Aug 29, 2012 at 3:41

1 Answer 1


The first question you have to ask is "Does HITECH (and by extension HIPAA) affect my company?" Do you store files with protected information in them? Do you move files with protected information in them? If the answer to either of those questions is YES, then you must examine the security of your organization. Make sure physical and digital access to files/data is logged and is audit-able. Make sure the files/data reside on physically and digitally secured storage (on an encrypted drive with proper ACL's on a server in a locked rack, where physical access to server is logged and audit-able). If the data is in a database, are you using column encryption on personally identifiable data (think last name, address, dob, ssn, etc.)? If you're moving the files/data, make sure that you use an encrypted/secure connection to move them, i.e. HTTPS, SFTP, FTPS, etc., and that all moves are logged and audit able.

Meet the above basics first, then worry about digging in to more detail of the actual legislation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .