Hitech Breach Notification

HITECH Breach Notification

Overview

The Health Information Technology for Economic and Clinical Health (HITECH) Act (2009), codified at 42 U.S.C. §17921–17923 and implemented through HIPAA Omnibus Rule amendments, strengthened breach notification, extended direct liability to business associates (BAs), and increased civil monetary penalties.

| HITECH element | Requirement | Primary reference | | --- | --- | --- | | Breach notification | Individual, HHS, media (if >500 in state) | 45 CFR §164.400–414; 42 U.S.C. §17921 | | Unsecured PHI | Breach applies to PHI not rendered unusable/unreadable/indecipherable | 45 CFR §164.402; HHS encryption guidance | | BA liability | BAs directly liable for Security, Privacy, Breach Notification | 45 CFR §160.402(c) | | OCR reporting | HHS breach portal; immediate if ≥500 individuals | HHS Breach Portal | | Penalty tiers | Four tiers under HITECH (willful neglect, correction) | 42 U.S.C. §1320d-5 | | Accounting of disclosures | Expanded accounting; breach may trigger disclosure log review | 45 CFR §164.528 |

Relationship to breach-incident-response: Use that skill for containment, scope, and cross-framework incident orchestration. This skill adds HITECH-specific legal depth: unsecured PHI analysis, OCR portal mechanics, BA direct notification obligations, media triggers, and penalty-tier documentation.

AI/agent scenarios: LLM vendor without BAA receives ePHI prompts; MCP Postgres leak of session logs; failed redaction gate (agent.py) leading to model log retention; BA LLM subprocessors.

When to Use

Use this skill when:

• HITECH breach determination after initial incident classification (breach-incident-response Step 4 complete)
• Preparing HHS OCR breach portal submission (≥500 immediate; 500 residents of a state or jurisdiction)
• Penalty exposure assessment and corrective action planning (willful neglect tiers)
• Accounting of disclosures update for breach-related unauthorized access
• Auditing HITECH compliance of agent pipelines post-incident

Do not use this skill when:

• Active containment still in progress (use breach-incident-response Steps 1–2 first)
• No PHI involved—pure PCI or SOC 2 incident without ePHI
• Preventive encryption design (use hipaa-technical-safeguards, pci-dss-encryption-key-management)
• State-only breach without HIPAA PHI (use us-state-privacy-laws)

Core Process

Execute after containment. Steps in order.

Step 1: Unsecured PHI determination

1. List PHI elements involved: identifiers, clinical data, dates, device IDs in agent logs.
2. Apply secured PHI test per HHS guidance:

• Valid encryption per NIST SP 800-111 (or documented equivalent)?
• Destruction of paper/electronic media per policy?

1. If PHI was encrypted at rest/in transit per guidance and key not compromised → may not be "unsecured" → breach may not apply.
2. Document analysis in templates/hitech-breach-workbook.yaml — do not assume encryption safe harbor without key compromise review.

Step 2: Four-factor risk assessment (§164.402(2))

If unsecured PHI involved, breach is presumed unless low probability documented:

| Factor | Assessment questions | | --- | --- | | Nature and extent of PHI | Diagnosis, financial, SSN, full clinical notes in LLM prompt? | | Unauthorized person | External attacker, rogue employee, non-BAA LLM vendor employee? | | Was PHI acquired or viewed? | Log evidence, model training retention, MCP export? | | Extent of mitigation | Revocation, deletion certificates, re-encryption? |

Privacy officer signs determination: breach vs security incident (no breach).

Step 3: Individual notification (§164.404)

1. Without unreasonable delay, no later than 60 calendar days from discovery.
2. Content per §164.404(c):

• Brief description of incident and dates
• Types of PHI involved
• Steps individuals should take
• CE investigation and mitigation steps
• Contact procedures (toll-free, email, website)

1. Substitute notice if insufficient contact data (>10 individuals): website 90 days, media, or email if consented.
2. For agent breaches: explain if LLM/MCP systems were involved without naming unnecessary clinical detail.

Step 4: HHS OCR notification (§164.408)

| Affected count | Action | Timeline | | --- | --- | --- | | ≥500 in a state/jurisdiction | Submit via OCR Breach Portal | Without unreasonable delay, max 60 days; OCR expects prompt submission | | 500 residents of a state or jurisdiction affected:

1. Notify prominent media outlets in affected areas without unreasonable delay (max 60 days).
2. Coordinate with legal/comms—message consistent with individual notice.
3. Document media list and publication dates.

Step 6: Business associate obligations (§164.410)

If CE uses BA (LLM vendor, MCP host, cloud agent platform):

1. BA must notify CE without unreasonable delay, no later than 60 days from discovery.
2. BA provides: identities of affected individuals if known, other information CE needs for notification.
3. If BA is agent skill operator's subprocessors chain, map contractual notice SLAs—contract must meet or beat 60 days.
4. CE remains responsible for individual/HHS/media notification unless delegated in BAA (uncommon).

Step 7: Penalty tier and corrective action (42 U.S.C. §1320d-5)

Document tier for management/legal (not legal advice):

| Tier | Conduct | Planning use | | --- | --- | --- | | 1 | Unknowing | Training gaps, undetected misconfig | | 2 | Reasonable cause, not willful neglect | Process failure, delayed BA notification | | 3 | Willful neglect, corrected | Known redaction bypass, uncorrected for period | | 4 | Willful neglect, not corrected | Ignored OCR corrective action plan |

1. Draft corrective action plan: fix redaction.py gate, MCP allowlists, BAA gaps.
2. Link to hipaa-baa-vendor-assessment for vendor remediation.

Step 8: Accounting of disclosures (§164.528)

1. Review whether breach constitutes disclosure requiring accounting update.
2. Update disclosure logs for affected individuals requesting accounting (6-year lookback).
3. Agent/MCP logs may be source of disclosure evidence—use hashed, access-controlled exports.

Step 9: Evidence and retention

1. Package: risk assessment, notification letters, portal submission, media proof, BA notices.
2. SHA-256 manifest per templates/audit-evidence-manifest.yaml.
3. Retain 6 years minimum (HIPAA documentation; state laws may differ).

Common Rationalizations

| Excuse | Rebuttal | | --- | --- | | "Encrypted in transit to LLM—no breach." | Key compromise or vendor log retention of decrypted prompts voids safe harbor—document analysis. | | "BA will handle all notifications." | CE retains primary notification duty unless explicit BAA delegation; verify contract language. | | "500 in state/jurisdiction

• [ ] BA notification chain documented with contractual SLAs
• [ ] Penalty tier and corrective action plan drafted for management
• [ ] Accounting of disclosures reviewed and updated if applicable
• [ ] Evidence manifest with SHA-256 hashes archived

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: vaquarkhan
• Source: vaquarkhan/compliance-agent-skills
• License: MIT
• Homepage: https://github.com/vaquarkhan/compliance-agent-skills#readme

Install and usage instructions live in the source repository linked above.