Glossary
H
Hawaii SB 2290
- Description: Hawaii's SB 2290 (HRS §487N) mandates that entities notify residents and the Attorney General about security breaches that involve personal information.
- Enacted and Enforced: Enacted on July 14, 2006, and enforced since January 1, 2008.
- Impacts Data Types: PII, including SSNs, driver’s license numbers, and financial account numbers.
- Examples: Leaked customer SSNs and stolen unencrypted backup tapes.
- Potential Fines: Civil penalties can be up to $5,000 per violation.
Health Breach Notification Rule
- Description: This HHS rule requires HIPAA-covered entities and their business associates to notify individuals, HHS, and the media about breaches of unsecured Protected Health Information (PHI).
- Enacted and Enforced: Enacted on March 26, 2013, and enforced since September 23, 2009.
- Impacts Data Types: Protected Health Information (PHI).
- Examples: An unauthorized email containing patient records or lost unencrypted laptops.
- Potential Fines: Up to $50,000 per violation, with an annual cap of $1.5 million.
HIPAA (Health Insurance Portability and Accountability Act)
- Description: HIPAA establishes national standards to protect individuals’ medical records and health information through data privacy and security provisions.
- Enacted and Enforced: Enacted on August 21, 1996, and enforced since April 14, 2003.
- Impacts Data Types: PHI, which includes medical records, treatment information, and billing data.
- Examples: Patient X-ray images and hospital billing files.
- Potential Fines: Tiered fines ranging from $100 to $50,000 per violation, with a cap of up to $1.5 million per year.
HITECH (Health Information Technology for Economic and Clinical Health Act)
- Description: The HITECH Act encourages the adoption of health information technology and reinforces the privacy and security provisions of HIPAA.
- Enacted and Enforced: Enacted on February 17, 2009, and enforced since February 17, 2010.
- Impacts Data Types: Electronic PHI (ePHI).
- Examples: Electronic health record backups and e-prescribing logs.
- Potential Fines: Enhanced penalties of up to $50,000 per violation, with an annual cap of $1.5 million.