Opinion ID: 3183121
Heading Depth: 2
Heading Rank: 1

Heading: The HITECH Act

Text: Enacted in 2009, the HITECH Act was designed to encourage the adoption of sophisticated electronic health record (“EHR”) technology by health care providers. See, e.g., Vadim Schick, After HITECH: HIPAA Revisions Mandate Stronger Privacy and Security Safeguards, 37 J.C. & U.L. 403, 404 (2011). To that end, the Act creates incentive payments for eligible health care providers (“providers”)—i.e. individual hospitals and health care professionals—that demonstrate “meaningful use” of certified EHR technology. 42 C.F.R. § 495.2; see also 42 U.S.C. §§ 1395w-4(o), 1395ww(n) (establishing diminishing schedule for incentive payments to encourage early adoption by eligible professionals and hospitals). Incentive payments are calculated using a formula that takes account of each individual provider’s volume of patients. See, e.g., 42 C.F.R. §§ 495.102(a)(1) (eligible professionals), 495.104(c)(2) (hospitals). No 15-3075 U.S. ex rel. Sheldon v. Kettering Health Network Page 3 As a condition to receipt of incentive payments, the Act requires providers to meet roughly two-dozen meaningful-use objectives and accompanying measures of compliance. 42 C.F.R. § 495.20; 42 U.S.C. §§ 1395w-4(o), 1395ww(n). Objectives and measures were released in two stages; Stage 2, which went into effect on September 4, 2012, added additional objectives and measures to the requirements for compliance with the Act. See Electronic Health Record Incentive Program—Stage 2, 77 Fed. Reg. 53,968 (Sept. 4, 2012); 42 C.F.R. §§ 495.20(h)–(m). After Congress passed the Act, the Centers for Medicare and Medicaid Services (“CMS”), an agency of the Department of Health and Human Services, promulgated specific standards for meeting these objectives. See, e.g., Medicare and Medicaid Programs; Electronic Health Record Incentive Program, 75 Fed. Reg. 44314-01 (July 28, 2010). The meaningful-use objective relevant here (hereinafter “the objective” or “security and privacy objective”) requires providers to “[p]rotect electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities.” 42 C.F.R. §§ 495.20(d)(15)(i), (f)(14)(i), (j)(16)(i), (l)(15)(i) (establishing the same security and privacy objective for different types of providers over different Stages of Act implementation). To meet the objective during Stage 1 of Act implementation, providers were required to “[c]onduct or review a security risk analysis in accordance with the requirements under 45 C.F.R. § 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies as part of [their] risk management process.” Id. at §§ 495.20(d)(15)(ii), (f)(14)(ii). During Stage 2, providers are additionally required to “address[] the encryption/security of data stored in Certified EHR Technology in accordance with requirements under” 45 C.F.R. §§ 164.312(a)(2)(iv) and 164.306(d)(3). 42 C.F.R. §§ 495.6(j)(16)(ii), (l)(15)(ii). To receive incentive payments, individual providers must legally attest to meeting these standards. See id. at § 495.8. Attestation is required at intervals dependent upon the type of provider, the “EHR Incentive Program” chosen (Medicare or Medicaid), and the reporting year. See id. at § 495.4. Both Stage 1 and Stage 2 measures for the security and privacy objective require providers to comply with 45 C.F.R. § 164.308(a)(1), which contains security and privacy standards established under the Health Insurance Portability and Accountability Act of 1996 No 15-3075 U.S. ex rel. Sheldon v. Kettering Health Network Page 4 (“HIPAA”). Subsection (a)(1) requires health care providers to “[i]mplement policies and procedures to prevent, detect, contain, and correct security violations.” Specifically, the subsection requires providers to: (A) . . . Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. (B) . . . Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a). (C) . . . Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate. (D) . . . Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. Id. at (a)(1)(ii). Stage 2 measures for the objective require providers to comply with two additional HIPAA regulations—45 C.F.R. §§ 164.312(a)(2)(iv) and 164.306(d)(3)—that also contain security standards. 42 C.F.R. §§ 495.6(j)(16)(ii), (l)(15)(ii). The first standard, § 164.312(a)(2)(iv), requires providers to “[i]mplement a mechanism to encrypt and decrypt electronic protected health information.” The second standard, § 164.306(d)(3), requires providers to implement such a mechanism if “reasonable and appropriate,” and if not, to document why and implement “an equivalent alternative measure.”