HITECH extends security, privacy and breach notification requirements to Business Associates. HITECH also establishes the right for patients to obtain their e-PHI, enforces data breach notification requirements, institutes third-party management and mandatory penalties for willful negligence.