The Health Information Technology for Economic and Clinical Health (HITECH) Act
Released: 2009-04-27T00:00:00

Introduction

The American Recovery and Reinvestment Act of 2009 (ARRA; H.R. 1 ), which the President signed into law on February 17, 2009 ( P.L. 111-5 ), incorporated the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act, based on legislation introduced in the 110 th Congress, is intended to promote the widespread adoption of health information technology (HIT) for the electronic sharing of clinical data among hospitals, physicians, and other health care stakeholders.

HIT, which generally refers to the use of computer applications in medical practice, is widely viewed as a necessary and vital component of health care reform. It encompasses interoperable electronic health records (EHRs)—including computerized systems to order tests and medications, and support systems to aid clinical decision making—and the development of a national health information network to permit the secure exchange of electronic health information among providers. The promise of HIT comes not from automating existing practices, but rather as a tool to help overhaul the delivery of care. HIT enables providers to render care more efficiently, for example, by eliminating the use of paper-based records and reducing the duplication of diagnostic tests. It can also improve the quality of care by identifying harmful drug interactions and helping physicians manage patients with multiple conditions. Moreover, the widespread use of HIT would provide large amounts of clinical data for comparative effectiveness research, performance measurement, and other activities aimed at improving health care quality.

Relatively few health care providers have adopted HIT. The most recent estimate suggests that only about 5% of physicians have a fully functional EHR that incorporates all or most of the recommended capabilities, including electronic documentation of physicians' notes, electronic viewing of lab test results and radiological images, electronic prescribing, clinical decision support, and interoperability with other systems. The most important barriers to HIT adoption include the high implementation and maintenance costs, the limited financial incentives for using HIT, and the lack of interoperability.

The HITECH Act includes three sets of provisions to promote HIT adoption. First, it codifies the Office of the National Coordinator for Health Information Technology (ONCHIT) within the Department of Health and Human Services (HHS). Created by Executive Order in 2004, ONCHIT was charged with developing and implementing a strategic plan to guide the nationwide implementation of HIT in the public and private health care sectors. ONCHIT has focused its activities in the following areas: (1) developing vocabulary, messaging, and functional standards necessary to achieve interoperability among varying HIT applications; (2) establishing criteria for certifying that HIT products meet those standards; (3) ensuring the privacy and security of electronic health information; and (4) helping facilitate the creation of prototype health information networks. The goal is to develop a national capability to exchange standards-based health care data in a secure computer environment.

Second, the HITECH Act through a number of mechanisms provides financial incentives for HIT use among health care practitioners. It establishes several grant programs to provide funding for investing in HIT infrastructure, purchasing certified EHRs, training, and the dissemination of best practices. It also authorizes grants to states for low-interest loans to help providers finance HIT. Beginning in 2011, the legislation provides Medicare incentive payments to encourage doctors and hospitals to adopt and use certified EHRs. Those incentive payments are phased out over time and replaced by financial penalties for physicians and hospitals that are not using certified EHRs. In addition to the Medicare incentives, the legislation authorizes a 100% federal match for payments to certain qualifying Medicaid providers for the acquisition and use of certified EHR technology.

Finally, the HITECH Act includes a series of privacy and security provisions that amend and expand the current HIPAA requirements. Among other things, the legislation strengthens enforcement of the HIPAA privacy rule and creates a right to be notified in the event of a breach of identifiable health information.

The Congressional Budget Office (CBO) estimates that the HITECH Act payment incentives (and penalties) will increase spending for the Medicare and Medicaid programs by a total of $32.7 billion over the 2009-2019 period. CBO anticipates, however, that widespread adoption of interoperable EHRs will reduce total spending on health care by decreasing the number of duplicate and inappropriate tests and procedures, reducing paperwork and administrative overhead, and eliminating medical errors. Over the 2009-2019 period, it estimates that the HITECH Act will save the Medicare and Medicaid programs a total of $12.5 billion. When savings to the Federal Employees Health Benefits program and CMS's administrative costs are factored in, CBO estimates overall that the HITECT Act will increase direct federal spending by $20.8 billion. Under current law, CBO predicts that about 45% of hospitals and 65% of physicians will have adopted HIT by 2019. CBO estimates that the incentive mechanisms in the HITECH Act will boost those adoption rates to about 70% for hospitals and about 90% for physicians.

This report provides a summary and explanation of the provisions in the HITECH Act. In order to provide some context for that discussion, the report first gives an overview of prior actions taken by Congress and the Administrations to promote HIT, and briefly describes efforts by the 109 th and 110 th Congresses to enact comprehensive HIT legislation. The report will continue to be updated to reflect administrative actions related to the implementation of the HITECH Act.

Federal Efforts to Promote HIT

HIPAA Administrative Simplification: Electronic Transactions, Security & Privacy Standards

Congress took an important first step towards promoting HIT when it enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA; P.L. 104-191 ). HIPAA imposed new federal requirements on health insurance plans offered by public and private employers, guaranteeing the availability and renewability of health insurance coverage for certain employees and individuals, and limited the use of preexisting condition restrictions. But while HIPAA was primarily concerned with giving consumers greater access to health insurance, the legislation also contained a section, subtitled Administrative Simplification, that included provisions to promote more standardization and efficiency in the health care industry and safeguard personal health information. Under HIPAA Administrative Simplification, the HHS Secretary was required to develop standards to support the growth of electronic record keeping and claims processing in the health care system and to safeguard the privacy of patient records. The standards apply to health care providers (who transmit any health information in electronic form in connection with a HIPAA-specified transaction), heath plans, and health care clearinghouses.

Electronic Transactions and Code Sets

HIPAA instructed the Secretary to issue electronic format and data standards for nine routine administrative and financial transactions between health care providers and health plan/payers. Those transactions include claims and encounter information, payment and remittance advice, and claims status inquiry and response. The electronic transactions standards include several Accredited Standards Committee X12 (ASC X12) standards, as well as a number of code sets (e.g., International Classification of Diseases, 9 th Edition, Clinical Modification, or ICD-9CM) used to identify specific diagnoses and clinical procedures that pertain to a patient encounter. HIPAA does not mandate that providers submit transactions electronically, though health plans/payers increasingly require it. However, if a health care provider chooses to submit one or more of the HIPAA-specified transactions electronically, then he or she must comply with the standard for that transaction. In 2001, Congress enacted the Administrative Simplification Compliance ( P.L. 107-105 ), which, among other things, requires Medicare providers to submit claims electronically.

Unique Health Identifiers

HIPAA further required the Secretary to issue national identification numbers for health care providers, health plans, employers, and individuals (i.e., patients) for use in standard transactions. Unique identifiers for providers and employers have been adopted, while the health plan identifier is still under review. The requirement that HHS develop a unique patient identifier has proven too controversial because of privacy concerns and is on hold. Beginning in FY1999, Congress each year has included language in the annual appropriations bill for the Departments of Labor, HHS, and Education prohibiting the use of funds for the development of a unique individual identifier.

Health Information Security

HIPAA's Administrative Simplification provisions also instructed the Secretary to issue security standards to safeguard individually identifiable health information in electronic form against unauthorized access, use, and disclosure. The security rule (45 CFR Parts 160, 164) specifies a series of administrative, technical, and physical security procedures for providers and plans to use to ensure the confidentiality of electronic health information. Administrative safeguards include such functions as assigning or delegating security responsibilities to employees, as well as security training requirements. Physical safeguards are intended to protect electronic systems and data from threats, environmental hazards, and unauthorized access. They include restricting access to computers and off-site backups. Technical safeguards are primarily IT functions used to protect and control access to data. They include using authentication and password controls, and encrypting data for storage and transmission.

The HIPAA security standards are flexible and scalable, allowing covered entities (i.e., health plans, health care providers, and health care clearinghouses) to take into account their size, capabilities, and the costs of specific security measures. The standards are also technology neutral. They do not prescribe the use of specific technologies, so that covered entities will not be bound by particular systems and/or software.

Health Information Privacy

Finally, HIPAA set a three-year deadline for Congress to enact health information privacy legislation. If, as turned out to be the case, lawmakers were unable to pass such legislation before the deadline, the HHS Secretary was instructed to promulgate regulations containing standards to protect the privacy of individually identifiable health information. The HIPAA privacy rule (45 CFR Parts 160, 164) established several individual privacy rights with respect to such protected health information (PHI). First, it established a right of access. Individuals have the right to see and obtain a copy of their own PHI in the form or format they request, provided the information is readily producible in such form or format. If not, then the information must be provided in hard copy or such form or format as agreed to by the covered entity and the individual. The covered entity can impose reasonable, cost-based fees for providing the information. Second, the privacy rule gives individuals the right to amend or supplement their own PHI. Third, individuals have the right to request that a covered entity restrict the use and disclosure of their PHI for the purposes of treatment, payment, or other routine health care operations. However, the covered entity is not required to agree to such a restriction unless it has entered into an agreement to restrict, in which case it must abide by the agreement. Finally, individuals have the right to an accounting of disclosures of their PHI by a covered entity during the previous six years, with certain exceptions. For example, a covered entity is not required to provide an accounting of disclosures that have been made to carry out treatment, payment, and health care operations.

In addition to patient privacy rights, the HIPAA privacy rule placed certain limitations on when and how covered entities may use and disclose PHI. Generally, health plans and health care providers may use and disclose health information for the purpose of treatment, payment, and health care operations without the individual's authorization and with few restrictions. In certain other circumstances (e.g., disclosures to family members and friends), the rule requires plans and providers to give the individual the opportunity to object to the disclosure. The rule also permits the use and disclosure of health information without the individual's permission for various specified activities (e.g., public health oversight, law enforcement) that are not directly connected to the treatment of the individual. For all uses and disclosures of health information that are not otherwise required or permitted by the rule, plans and providers must obtain a patient's written authorization.

The privacy rule incorporates a minimum necessary standard. Whenever a covered entity uses or discloses PHI or requests such information from another covered entity, it must make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose of the use or disclosure. There are a number of circumstances in which the minimum necessary standard does not apply; for example, disclosures to or requests by a health care provider for treatment purposes. The rule also permits the disclosure of a "limited data set" for certain specified purposes (e.g., research), pursuant to a data use agreement with the recipient. A limited data set, while not meeting the rule's definition of de-identified information (to which the privacy protections do not apply), has most direct identifiers removed and is considered by HHS to pose a low privacy risk.

Under the HIPAA privacy and security standards, health plans and health care providers may share PHI with their business associates who provide a wide variety of functions for them, including legal, actuarial, accounting, data aggregation, management, administrative, accreditation, and financial services. A covered entity is permitted to disclose health information to a business associate or to allow a business associate to create or receive health information on its behalf, provided the covered entity receives satisfactory assurance in the form of a written contract that the business associate will not use or disclose the information other than as permitted or required by the contract or as required by law, and that the business associate will implement appropriate administrative, technical, and physical safeguards to prevent unauthorized uses and disclosures. Covered entities are not liable for, or required to monitor, the actions of their business associates. If a covered entity finds out about a material breach or violation of the contract by a business associate, it must take reasonable steps to remedy the situation, and, if unsuccessful, terminate the contract. If termination is not feasible, the covered entity must notify HHS.

HIPAA authorized the Secretary to impose civil monetary penalties on any person failing to comply with the privacy and security standards. The maximum civil penalty is $100 per violation and up to $25,000 for all violations of an identical requirement or prohibition during a calendar year. The HHS Office of Civil Rights (OCR) is responsible for enforcing the privacy rule. For certain wrongful disclosures of PHI, OCR may refer the case to the Department of Justice for criminal prosecution. HIPAA's criminal penalties include fines of up to $250,000 and up to 10 years in prison for disclosing or obtaining health information with the intent to sell, transfer or use it for commercial advantage, personal gain, or malicious harm.

Together, the HIPAA privacy and security standards have helped lay the groundwork for the development of a National Health Information Network and the widespread adoption of interoperable EHRs. Information on the HIPAA privacy rule and links to information on the other HIPAA Administrative Simplification standards is at [ http://www.hhs.gov/ocr/hipaa ].

Medicare Part D: E-Prescribing

Besides HIPAA, the other significant legislative action taken by Congress to promote HIT was the inclusion of electronic prescribing provisions in the Medicare Modernization Act of 2003 (MMA; P.L. 108-173 ), which created the Part D prescription drug benefit. The MMA established a timetable for the Centers for Medicare and Medicaid Services (CMS) to develop e-prescribing standards, which provide for the transmittal of such information as eligibility and benefits (including formulary drugs), information on the drug being prescribed and other drugs listed in the patient's medication history (including drug-drug interactions), and information on the availability of lower-cost, therapeutically appropriate alternative drugs. CMS issued a set of foundation standards in 2005, then piloted and tested additional standards in 2006. The final Medicare e-prescribing standards, which become effective on April 1, 2009, apply to all Part D sponsors, as well as to prescribers and dispensers that electronically transmit prescriptions and prescription-related information about Part D drugs prescribed for Part D eligible individuals. The MMA did not require Part D drug prescribers and dispensers to e-prescribe. Under its provisions, only those who choose to e-prescribe must comply with the new standards. However, the recently enacted Medicare Improvement for Patients and Providers Act of 2008 (MIPPA; P.L. 110-275 ) includes an e-prescribing mandate and authorizes incentive bonus payment for e-prescribers between 2009 and 2013. Beginning in 2012, payments would be reduced for those who fail to e-prescribe. Information on the CMS e-prescribing standards is at [ http://www.cms.hhs.gov/EPrescribing ].

Anti-Kickback Statute, Stark Law

The MMA also instructed the Secretary to establish a safe harbor from penalties under the anti-kickback statute (42 U.S.C. 1320a-7b) and an exception to the Medicare physician self-referral (Stark) law (42 U.S.C. 1395nn) for the provision of HIT and training services used in e-prescribing. The anti-kickback statute prohibits an individual or entity from knowingly or willfully offering or accepting remuneration of any kind to induce a patient referral for, or purchase of, an item or service covered by any federal health care program. The Stark law prohibits physicians from referring patients to any entity for certain health services if the physician (or an immediate family member) has a financial relationship with the entity, and prohibits entities from billing for any services resulting from such referrals, unless an exception applies. Both statutes, which are intended to fight fraud and abuse, are seen as impediments to the dissemination of HIT among health care entities.

In 2006, the Secretary announced final regulations creating new safe harbors and Stark exceptions for certain arrangements involving the donation of electronic prescribing and EHR technologies and training services. That would allow, for example, a hospital to provide such technologies and services to its medical staff, and Medicare Advantage plans to provide such technologies and services to pharmacies and prescribing health care providers.

CMS Grants, Demonstrations and Pay-for-Performance

CMS is administering a number of additional programs to promote HIT adoption. The MMA mandated a three-year pay-for-performance demonstration in four states to encourage physicians to adopt and use HIT to improve the treatment of chronically ill Medicare patients. Physicians participating in the Medicare Care Management Performance (MCMP) demonstration receive bonus payments for reporting clinical quality data and meeting clinical performance standards for treating patients with certain chronic conditions. They are eligible for an additional incentive payment for using a certified EHR and reporting the clinical performance data electronically.

CMS has developed a second demonstration to promote EHR adoption using its Medicare waiver authority. The five-year Medicare EHR demonstration is intended to build on the foundation created by the MCMP program. It will provide financial incentives to as many as 1,200 small- to medium-sized physician practices in 12 communities across the country for using certified EHRs to improve quality, as measured by their performance on specific clinical quality measures. Additional bonus payments will be made based on the number of EHR functionalities a physician group has incorporated into its practice.

The Tax Relief and Health Care Act of 2006 ( P.L. 109-432 ) established a voluntary physician quality reporting system, including an incentive payment for Medicare providers who report data on quality measures. The Medicare Physician Quality Reporting Initiative (PQRI) was expanded by the Medicare, Medicaid, and SCHIP Extension Act of 2007 ( P.L. 110-173 ) and by MIPPA, which authorized the program indefinitely and increased the incentive that eligible physicians can receive for satisfactorily reporting quality measures. In 2009, eligible physicians may earn a bonus payment equivalent to 2.0 percent of their total allowed charges for covered Medicare physician fee schedule services. The PQRI quality measures include a structural measure that conveys whether a physician has and uses an EHR.

The Deficit Reduction Act of 2005 ( P.L. 109-171 ) authorized Medicaid Transformation Grants to states totaling $150 million over two years. The purpose of the grants is to support adoption of innovative methods to improve effectiveness and efficiency in providing medical assistance under Medicaid. In 2007, CMS awarded Medicaid Transformation Grants to 33 states, the District of Columbia, and Puerto Rico. Most of the funds are being used for HIT-related initiatives.

Office of the National Coordinator for Health Information Technology

On April 27, 2004, President Bush announced a commitment to the promotion of HIT by calling for the widespread adoption of interoperable EHRs within 10 years. That same day he signed Executive Order 13335 creating ONCHIT to develop, maintain, and direct a strategic plan to guide the nationwide implementation of HIT in the public and private health care sectors. Within three months, ONCHIT published a strategic framework in which it outlined four major goals for HIT: (1) informing clinical practice by accelerating the use of EHRs; (2) interconnecting clinicians allowing them to exchange health information in a secure environment; (3) personalizing health care by enabling consumers to participate more actively in their own care; and (4) improving population health through improved public health surveillance and by accelerating research and its translation into clinical practice.

In fall 2004, ONCHIT solicited public input on a series of questions on whether and how a National Health Information Network should be developed. The questions addressed such topics as organization and business framework, legal and regulatory issues, management and operational considerations, interoperability standards, and privacy and security. Based on the detailed and coordinated responses that it received from a broad array of stakeholders in the health care sector, ONCHIT has undertaken a series of activities to address several important challenges to the nationwide implementation of a HIT infrastructure.

In 2005, the Secretary created the American Health Information Community (AHIC), a public-private advisory body, to make recommendations to the Secretary on how to accelerate the development and adoption of interoperable HIT using a market-driven approach. AHIC and its workgroups have proven to be extremely important in creating a forum to seek input and guidance from a broad range of stakeholders on key HIT issues and policy implications. The AHIC charter required it to provide the Secretary with recommendations to create a successor entity based in the private sector. AHIC Successor, Inc. was established in July 2008 to transition AHIC's accomplishments into a new public-private partnership. That partnership, the National eHealth Collaborative (NeHC), was launched on January 8, 2009.

Developing standards and a process to certify HIT products and services as meeting those standards is a key priority. ONCHIT awarded a contract to the American National Standards Institute (ANSI) to establish a public-private collaborative, known as the Healthcare Information Technology Standards Panel (HITSP), to harmonize existing HIT standards and identify and establish standards to fill gaps. To date, the Secretary has recognized over 100 harmonized standards, including many that need to be used for interoperable EHRs. To ensure that these standards are incorporated into products, a second contract was awarded to the Certification Commission for Healthcare Information Technology (CCHIT), a private, nonprofit organization created by HIT industry associations, which establishes criteria for certifying products that use recognized standards. CCHIT has certified over 150 ambulatory and inpatient EHR products. In August 2006, the President issued Executive Order 13410 committing federal agencies that purchase and deliver health care to require the use of HIT that is based on interoperability standards recognized by the Secretary.

The National Health Information Network (NHIN) is envisioned as a "network of networks"; that is, a nationwide, Internet-based architecture that interconnects state and regional health information exchanges (and other networks). It will be built on a secure platform using a shared set of standards and policies to permit interoperable health information exchange among providers, consumers, and others involved in supporting health care. To facilitate the development of the NHIN, ONCHIT awarded several contracts to develop models of how nationwide electronic health information might work. Each contractor was asked to develop a prototype architecture for the NHIN and to interconnect three communities as a demonstration of the architecture. The initial phase of the project has since been expanded and now involves health information exchanges across the country working cooperatively to identify and implement best practices for health information exchange.

Ensuring the privacy and security of electronic health information is critical to the success of the NHIN and the widespread adoption of interoperable EHRs. ONCHIT has undertaken the development of a national privacy and security framework, using HIPAA as its foundation, to incorporate the needs of health care consumers and build public trust in the new e-health environment. To this end it has awarded a contract to RTI International, which in turn has subcontracted with 33 states and one territory that make up the Health Information Security and Privacy Collaboration (HISPC). HISPC is leveraging input from a broad range of public and private stakeholders in health information exchange to assess the variations in current privacy and security practices and policies. The goal is to identify both best practices and challenges, and develop consensus-based solutions for interoperable electronic health information exchange that protect the privacy and security of health information. Information on ONCHIT's activities and programs is at [ http://www.hhs.gov/healthit ].

Agency for Healthcare Research and Quality

Within HHS, the Agency for Healthcare Research and Quality (AHRQ) is the principal source of federal HIT grant money. Since 2004, AHRQ has awarded $260 million to support and stimulate investment in HIT. This translates into almost 200 projects in 48 states. AHRQ-funded projects, many of which are focused on rural and underserved populations, cover a broad range of HIT tools and systems, including EHRs, personal health records (PHRs), e-prescribing, privacy and security, quality measurement, and Medicaid technical assistance. In addition, AHRQ created the online National Resource Center for Health IT to disseminate research findings and best practices, facilitate expert and peer-to-peer collaboration, and foster the growth of online communities who are planning to implement HIT. Information on AHRQ's HIT activities and programs is at [ http://healthit.ahrq.gov ].

Other Federal Agencies

Other federal agencies that purchase health care are also involved in efforts to further the development and broad adoption of HIT. The Department of Defense (DOD), the Department of Veterans Affairs (VA), and the Office of Personnel Management (OPM) have worked with HHS to adopt health information standards for use by all federal health agencies. As part of the Consolidated Health Informatics Initiative, more than 20 federal agencies have agreed to endorse standards that enable information to be shared among agencies and that can serve as a model for the private sector. Over the past few years, OPM has encouraged Federal Employees Health Benefits (FEHB) health benefits plans to increase their use of HIT.

The VA and DOD are both extensive users of HIT. For several years, the VA has used an EHR—the Veterans Health Information Systems and Technology Architecture, or VistA—in providing care to U.S. military veterans. According to the VA, VistA has improved the efficiency of its health care delivery and the quality of the care it provides. DOD has developed and is in the process of implementing an EHR—known as AHLTA (Armed Forces Health Longitudinal Technology Application)—for its health care system. DOD is also working with the VA to develop a way by which health information can be transmitted seamlessly and instantaneously between the two agencies.

HIT Legislation in the 109th and 110th Congresses

109th Congress

The 109 th Congress was the first to consider comprehensive HIT legislation. On November 18, 2005, the Senate, by unanimous consent, passed the bipartisan Wired for Health Care Quality Act ( S. 1418 , S.Rept. 109-111 ). On July 27, 2006, the House passed the Health Information Technology Promotion Act ( H.R. 4157 , H.Rept. 109-603 ) on a vote of 270-148. The bills, which contained several important differences, were not conferenced. Both bills included comparable provisions establishing ONCHIT, but contained competing language addressing the responsibilities and composition of AHIC and its role in the adoption of interoperability standards. Only the Senate bill addressed certification. S. 1418 also would have authorized grants for health care providers, grants for implementing regional HIT plans, and a state loan program to facilitate HIT adoption. H.R. 4157 included a single HIT grant program for integrated health care systems. Both measures would have authorized a demonstration program, but for different purposes. The House measure also included provisions that would have established an anti-kickback safe harbor and Stark exception for the donation of HIT and related support or training services, as well as provisions to expedite updating and modifying the HIPAA electronic transactions and codes standards. The Senate version contained no such provisions.

110th Congress

The Wired for Health Care Quality Act ( S. 1693 ) was reintroduced on June 26, 2007, and ordered reported (as amended) by the Committee on Health, Education, Labor, and Pensions (HELP) on August 1, 2007 ( S.Rept. 110-187 ). In the House, H.R. 6357 , the PRO(TECH)T Act of 2008, was introduced by Representatives Dingell and Barton on June 24, 2008, and ordered reported (as amended) by the Committee on Energy and Commerce on September 11, 2008 ( H.Rept. 110-837 ). No further legislative action was taken on either measure. Like the Senate bill, H.R. 6357 would have codified ONCHIT and authorized grants and loans to promote the adoption of EHRs and the development of health information exchange networks. Unlike S. 1693 , however, the House measure also included extensive privacy and security provisions to strengthen the HIPAA rules. A second House bill, H.R. 6898 , the Health-e Information Technology Act of 2008, was introduced by Representative Stark on September 15, 2008, and referred to the Committees on Energy and Commerce, Science and Technology, and Ways and Means. Broadly similar to the PRO(TECH)T Act, H.R. 6898 also included Medicare incentive payments to encourage EHR use by hospitals and physicians, as well as financial penalties for providers that failed to adopt HIT.

HITECH Act: Explanation of Provisions

Lawmakers incorporated the HITECH Act in the American Recovery and Reinvestment Act of 2009 (ARRA; H.R. 1 , H.Rept. 111-16), the economic stimulus bill that the President signed into law on February 17, 2009 ( P.L. 111-5 ). The HITECH Act is an amalgam of the two House bills from the 110 th Congress. It contains three sets of provisions that are expected to boost HIT adoption among health care providers in the coming years. First, it codifies ONCHIT and establishes a process for the development of interoperability standards that support the nationwide electronic exchange of health information among doctors, hospitals, patients, health plans, the federal government, and other health care stakeholders. It also establishes a voluntary certification process for HIT products. The National Institute of Standards and Technology (NIST) is to provide for the testing of such products to determine if they meet national standards that allow for secure electronic information exchange. After the adoption of an initial set of standards by the end of 2009, the National Coordinator must make an EHR available at a nominal fee, unless it is determined that the needs and demands of providers are being adequately met by the marketplace.

Second, the HITECH Act authorizes funding for several grant programs to support HIT infrastructure, EHR adoption, training, dissemination of best practices, telemedicine, and inclusion of HIT in clinical education. Funds also are provided to states for low-interest loans to help health care practitioners finance HIT. In addition, the legislation provides financial incentives through the Medicare and Medicaid programs to encourage doctors, hospitals, health clinics, and other entities to adopt and use certified EHRs. Medicare incentive payments are phased out over time and replaced with financial penalties for providers that are not using EHRs.

Finally, the HITECH Act expands the HIPAA privacy and security standards. Among other things, it establishes a breach notification requirement for health information that is not encrypted, strengthens enforcement of the HIPAA standards by increasing penalties for violations and provides greater resources for enforcement and oversight activities, places new restrictions on marketing activities by health plans and providers, and creates transparency by allowing patients to request an audit trail showing all disclosures of their electronic health information.

The HITECH Act appears in two separate ARRA titles, each of which is described in the tables below. Table 1 provides a summary of the HITECH Act provisions in Division A, Title XIII of the economic stimulus bill. Those provisions include ONCHIT and the development and adoption of standards, the grant and loan programs, and the privacy and security requirements. Table 2 summarizes the HITECH Act's Medicare and Medicaid provisions, which are in Division B, Title IV of the stimulus bill. For each provision, as appropriate, the tables include additional information on existing federal requirements and other relevant administrative activities. Each mention of the Secretary in the tables refers to the Secretary of Health and Human Services. Note: Table 2 does not include two miscellaneous Medicare provisions added to the HITECH Act, which are unrelated to HIT.

HIT Appropriations in ARRA

In addition to the mandatory funding that would become available to health care providers under the HITECH Act's Medicare and Medicaid provisions, the emergency appropriations provisions in ARRA Division A include $2 billion in discretionary funds for ONCHIT to invest in HIT architecture; provide grants to hospitals, physicians, and other health care providers; and support training programs. In addition, $85 million is appropriated to the Indian Health Service (IHS) for HIT and telehealth, to be allocated at the discretion of the IHS Director.