2 cissp ® Official Study Guide Eighth Edition

 Health Information Technology for Economic and Clinical Health Act of 2009
In 2009, 
Congress amended HIPAA by passing the Health Information Technology for Economic 
and Clinical Health (HITECH) Act. This law updated many of HIPAA’s privacy and security 
requirements and was implemented through the HIPAA Omnibus Rule in 2013. 
One of the changes mandated by the new regulations is a change in the way the law treats 
business associates, which are organizations that handle protected health information (PHI) 
on behalf of a HIPAA covered entity. Any relationship between a covered entity and a busi-
ness associate must be governed by a written contract known as a business associate agree-
ment (BAA). Under the new regulation, business associates are directly subject to HIPAA and 
HIPAA enforcement actions in the same manner as a covered entity. 
HITECH also introduced new data breach notifi cation requirements. Under the HITECH 
Breach Notifi cation Rule, HIPAA-covered entities that experience a data breach must notify 
affected individuals of the breach and must also notify both the Secretary of Health and 
Human Services and the media when the breach affects more than 500 individuals.
data Breach notifi cation Laws
HITECH’s data breach notifi cation rule is unique in that it is a federal law mandating the 
notifi cation of affected individuals. Outside of this requirement for healthcare records, 
data breach notifi cation requirements vary widely from state to state. 
In 2002, California passed SB 1386 and became the fi rst state to immediately disclose to 
individuals the known or suspected breach of personally identifi able information. This 
includes unencrypted copies of a person’s name in conjunction with any of the following 
information: 
■
Social Security number 
■
Driver’s license number 
■
State identifi cation card number 

---

144
Chapter 4 
■
Laws, Regulations, and Compliance
■
Credit or debit card number 
■
Bank account number in conjunction with the security code, access code, or 
password that would permit access to the account 
■
Medical records 
■
Health insurance information
In the years following SB 1386, many (but not all) other states passed similar laws 
modeled on the California data breach notifi cation law. As of 2017, only Alabama and 
South Dakota do not have state breach notifi cation laws.
For a complete listing of state data breach notification laws, see
www.ncsl
.org/research/telecommunications-and-information-technology/
security-breach-notification-laws.aspx
 .