The American Recovery and Reinvestment Act of 2009 (ARRA; H.R. 1 ), which the President signed into law on February 17, 2009 ( P.L. 111-5 ), incorporated the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act, based on legislation introduced in the 110 th Congress, is intended to promote the widespread adoption of health information technology (HIT) for the electronic sharing of clinical data among hospitals, physicians, and other health care stakeholders. HIT, which generally refers to the use of computer applications in medical practice, is widely viewed as a necessary and vital component of health care reform. It encompasses interoperable electronic health records (EHRs)—including computerized systems to order tests and medications, and support systems to aid clinical decision making—and the development of a national health information network to permit the secure exchange of electronic health information among providers. The promise of HIT comes not from automating existing practices, but rather as a tool to help overhaul the delivery of care. HIT enables providers to render care more efficiently, for example, by eliminating the use of paper-based records and reducing the duplication of diagnostic tests. It can also improve the quality of care by identifying harmful drug interactions and helping physicians manage patients with multiple conditions. Moreover, the widespread use of HIT would provide large amounts of clinical data for comparative effectiveness research, performance measurement, and other activities aimed at improving health care quality. Relatively few health care providers have adopted HIT. The most recent estimate suggests that only about 5% of physicians have a fully functional EHR that incorporates all or most of the recommended capabilities, including electronic documentation of physicians' notes, electronic viewing of lab test results and radiological images, electronic prescribing, clinical decision support, and interoperability with other systems. The most important barriers to HIT adoption include the high implementation and maintenance costs, the limited financial incentives for using HIT, and the lack of interoperability. The HITECH Act includes three sets of provisions to promote HIT adoption. First, it codifies the Office of the National Coordinator for Health Information Technology (ONCHIT) within the Department of Health and Human Services (HHS). Created by Executive Order in 2004, ONCHIT was charged with developing and implementing a strategic plan to guide the nationwide implementation of HIT in the public and private health care sectors. ONCHIT has focused its activities in the following areas: (1) developing vocabulary, messaging, and functional standards necessary to achieve interoperability among varying HIT applications; (2) establishing criteria for certifying that HIT products meet those standards; (3) ensuring the privacy and security of electronic health information; and (4) helping facilitate the creation of prototype health information networks. The goal is to develop a national capability to exchange standards-based health care data in a secure computer environment. Second, the HITECH Act through a number of mechanisms provides financial incentives for HIT use among health care practitioners. It establishes several grant programs to provide funding for investing in HIT infrastructure, purchasing certified EHRs, training, and the dissemination of best practices. It also authorizes grants to states for low-interest loans to help providers finance HIT. Beginning in 2011, the legislation provides Medicare incentive payments to encourage doctors and hospitals to adopt and use certified EHRs. Those incentive payments are phased out over time and replaced by financial penalties for physicians and hospitals that are not using certified EHRs. In addition to the Medicare incentives, the legislation authorizes a 100% federal match for payments to certain qualifying Medicaid providers for the acquisition and use of certified EHR technology. Finally, the HITECH Act includes a series of privacy and security provisions that amend and expand the current HIPAA requirements. Among other things, the legislation strengthens enforcement of the HIPAA privacy rule and creates a right to be notified in the event of a breach of identifiable health information. The Congressional Budget Office (CBO) estimates that the HITECH Act payment incentives (and penalties) will increase spending for the Medicare and Medicaid programs by a total of $32.7 billion over the 2009-2019 period. CBO anticipates, however, that widespread adoption of interoperable EHRs will reduce total spending on health care by decreasing the number of duplicate and inappropriate tests and procedures, reducing paperwork and administrative overhead, and eliminating medical errors. Over the 2009-2019 period, it estimates that the HITECH Act will save the Medicare and Medicaid programs a total of $12.5 billion. When savings to the Federal Employees Health Benefits program and CMS's administrative costs are factored in, CBO estimates overall that the HITECT Act will increase direct federal spending by $20.8 billion. Under current law, CBO predicts that about 45% of hospitals and 65% of physicians will have adopted HIT by 2019. CBO estimates that the incentive mechanisms in the HITECH Act will boost those adoption rates to about 70% for hospitals and about 90% for physicians. This report provides a summary and explanation of the provisions in the HITECH Act. In order to provide some context for that discussion, the report first gives an overview of prior actions taken by Congress and the Administrations to promote HIT, and briefly describes efforts by the 109 th and 110 th Congresses to enact comprehensive HIT legislation. The report will continue to be updated to reflect administrative actions related to the implementation of the HITECH Act. Congress took an important first step towards promoting HIT when it enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA; P.L. 104-191 ). HIPAA imposed new federal requirements on health insurance plans offered by public and private employers, guaranteeing the availability and renewability of health insurance coverage for certain employees and individuals, and limited the use of preexisting condition restrictions. But while HIPAA was primarily concerned with giving consumers greater access to health insurance, the legislation also contained a section, subtitled Administrative Simplification, that included provisions to promote more standardization and efficiency in the health care industry and safeguard personal health information. Under HIPAA Administrative Simplification, the HHS Secretary was required to develop standards to support the growth of electronic record keeping and claims processing in the health care system and to safeguard the privacy of patient records. The standards apply to health care providers (who transmit any health information in electronic form in connection with a HIPAA-specified transaction), heath plans, and health care clearinghouses. HIPAA instructed the Secretary to issue electronic format and data standards for nine routine administrative and financial transactions between health care providers and health plan/payers. Those transactions include claims and encounter information, payment and remittance advice, and claims status inquiry and response. The electronic transactions standards include several Accredited Standards Committee X12 (ASC X12) standards, as well as a number of code sets (e.g., International Classification of Diseases, 9 th Edition, Clinical Modification, or ICD-9CM) used to identify specific diagnoses and clinical procedures that pertain to a patient encounter. HIPAA does not mandate that providers submit transactions electronically, though health plans/payers increasingly require it. However, if a health care provider chooses to submit one or more of the HIPAA-specified transactions electronically, then he or she must comply with the standard for that transaction. In 2001, Congress enacted the Administrative Simplification Compliance ( P.L. 107-105 ), which, among other things, requires Medicare providers to submit claims electronically. HIPAA further required the Secretary to issue national identification numbers for health care providers, health plans, employers, and individuals (i.e., patients) for use in standard transactions. Unique identifiers for providers and employers have been adopted, while the health plan identifier is still under review. The requirement that HHS develop a unique patient identifier has proven too controversial because of privacy concerns and is on hold. Beginning in FY1999, Congress each year has included language in the annual appropriations bill for the Departments of Labor, HHS, and Education prohibiting the use of funds for the development of a unique individual identifier. HIPAA's Administrative Simplification provisions also instructed the Secretary to issue security standards to safeguard individually identifiable health information in electronic form against unauthorized access, use, and disclosure. The security rule (45 CFR Parts 160, 164) specifies a series of administrative, technical, and physical security procedures for providers and plans to use to ensure the confidentiality of electronic health information. Administrative safeguards include such functions as assigning or delegating security responsibilities to employees, as well as security training requirements. Physical safeguards are intended to protect electronic systems and data from threats, environmental hazards, and unauthorized access. They include restricting access to computers and off-site backups. Technical safeguards are primarily IT functions used to protect and control access to data. They include using authentication and password controls, and encrypting data for storage and transmission. The HIPAA security standards are flexible and scalable, allowing covered entities (i.e., health plans, health care providers, and health care clearinghouses) to take into account their size, capabilities, and the costs of specific security measures. The standards are also technology neutral. They do not prescribe the use of specific technologies, so that covered entities will not be bound by particular systems and/or software. Finally, HIPAA set a three-year deadline for Congress to enact health information privacy legislation. If, as turned out to be the case, lawmakers were unable to pass such legislation before the deadline, the HHS Secretary was instructed to promulgate regulations containing standards to protect the privacy of individually identifiable health information. The HIPAA privacy rule (45 CFR Parts 160, 164) established several individual privacy rights with respect to such protected health information (PHI). First, it established a right of access.