Which statement best describes the relationship between HIPAA and HITECH?

• A. HITECH replaces HIPAA when health IT is used.
• B. HITECH expands health IT while ensuring security and does not supersede HIPAA.
• C. HIPAA applies only to education records.
• D. HIPAA and HITECH are unrelated.

Answer: (B)

HIPAA provides the baseline protections for patient health information that covered entities must follow. HITECH builds on that framework by strengthening privacy and security protections, extending those obligations to business associates, mandating breach notifications, and increasing enforcement penalties, while also promoting the adoption and meaningful use of health IT. Because of this, HITECH does not replace HIPAA; it expands and strengthens it. The other statements aren’t accurate: HIPAA isn’t limited to education records (that’s FERPA), and HIPAA and HITECH are related—HITECH augments HIPAA, not treats them as unrelated.