HIPAA is a federal law and regulatory framework governing health information privacy and security. HITECH is a 2009 federal law that strengthened HIPAA enforcement, breach notification, and business-associate accountability. HITRUST is a private cybersecurity assurance framework and certification program. Unlike HIPAA and HITECH, HITRUST certification is not generally required by federal law.

They sound similar, they’re often mentioned together, and they’re frequently confused — even by experienced healthcare professionals. Here’s the framework that makes them easy to distinguish:

  • HIPAA sets the baseline — what regulated entities must protect and how
  • HITECH strengthened and expanded it — stronger enforcement, breach notification, business associate accountability, and health IT adoption incentives
  • HITRUST independently validates controls — a private certification program that provides assurance that relevant security and privacy controls have been implemented and validated

Not sure where your organization stands on HIPAA, HITECH, or HITRUST requirements? HIPAA Vault provides managed HIPAA-compliant hosting with a signed BAA — and our compliance team can help you assess your current posture.

Take our free HIPAA assessment →

Key Takeaways

  • HIPAA (1996) — federal law establishing privacy and security rules for protected health information
  • HITECH (2009) — federal law that dramatically strengthened HIPAA enforcement, created the Breach Notification Rule, and extended direct liability to business associates for certain HIPAA provisions
  • HITRUST — a private, voluntary certification framework providing independent assurance that relevant security and privacy controls have been implemented and validated
  • HIPAA and HITECH are legally required for covered entities and business associates — HITRUST is voluntary
  • Before HITECH, HIPAA civil enforcement was significantly weaker. HITECH introduced tiered penalties tied to culpability that power modern OCR enforcement
  • HITRUST certification does not replace HIPAA compliance — depending on assessment scope, it can provide independent assurance that controls mapped to HIPAA have been validated
  • The 2025 proposed HIPAA Security Rule update is the next major evolution after HITECH — but it remains a proposal; the current Security Rule remains in effect

The Three-Way Comparison at a Glance

HIPAAHITECHHITRUST
TypeFederal lawFederal lawPrivate certification framework
Created byU.S. CongressU.S. CongressHITRUST Alliance (private)
Year199620092007
Required by law?✅ Yes — for covered entities and BAs✅ Yes — for covered entities and BAs❌ No — voluntary
Enforced byHHS Office for Civil RightsHHS Office for Civil RightsHITRUST Alliance assessors
Penalties for non-complianceCivil + criminal penaltiesStrengthened civil enforcement; penalty amounts adjusted for inflationLoss of certification only
Who it applies toCovered entities + BAsCovered entities + BAs (certain provisions directly)Any organization seeking certification
Primary focusPrivacy + security rulesEnforcement + breach notification + EHR adoptionIndependently validated compliance program
Covers PHI?✅ Yes✅ Yes✅ Part of CSF framework
BAA required?✅ Yes — with all BAs✅ Yes — strengthened BA obligationsN/A — certification, not law

HIPAA: The Foundation (1996)

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996. The privacy and security provisions that healthcare organizations deal with today came through subsequent rulemaking:

  • Privacy Rule (2003) — established standards for PHI use and disclosure
  • Security Rule (2005) — established administrative, physical, and technical safeguards for ePHI
  • Enforcement Rule (2006) — established procedures for investigations and penalties

What HIPAA requires:

  • Covered entities (healthcare providers, health plans, clearinghouses) and their business associates must protect PHI
  • Signed Business Associate Agreements with all vendors handling PHI
  • Administrative, physical, and technical safeguards for ePHI per NIST SP 800-66 Rev. 2
  • Patients’ rights to access, amend, and receive accounting of disclosures of their records

HIPAA’s original enforcement limitation: Before HITECH, HIPAA’s civil enforcement framework was significantly weaker. HITECH substantially strengthened it by introducing tiered penalties tied to an organization’s level of culpability and increasing potential penalties for noncompliance.

As Gil Vidals, CTO and co-founder of HIPAA Vault, explains:

“HIPAA without HITECH is like a speed limit without radar. The rules existed, but the enforcement mechanism that made organizations actually pay attention — that came in 2009.”

HITECH: The Enforcement Revolution (2009)

The Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted as part of the American Recovery and Reinvestment Act of 2009, signed into law on February 17, 2009. HITECH fundamentally changed HIPAA enforcement — and created the compliance environment healthcare organizations operate in today.

What HITECH did:

1. Strengthened Civil Enforcement with Tiered Penalties

HITECH established a four-tier penalty structure based on increasing levels of culpability, from violations an organization could not reasonably have known about through uncorrected willful neglect. HIPAA civil monetary penalties are adjusted periodically for inflation, so organizations should consult HHS’s current penalty regulations rather than relying on historical dollar amounts.

The four tiers reflect:

  • Tier 1 — Did not know, and with reasonable diligence could not have known
  • Tier 2 — Reasonable cause — knew or should have known, not willful neglect
  • Tier 3 — Willful neglect — corrected within required time period
  • Tier 4 — Willful neglect — not corrected

As of the January 2026 HHS inflation adjustment, Tier 4 carries a minimum per-violation penalty of $73,011 and a calendar-year cap that has increased substantially from HITECH’s original figures. Verify current amounts directly at HHS before relying on any specific dollar figure.

2. Created the HIPAA Breach Notification Rule

Before HITECH, there was no federal requirement to notify patients when their PHI was breached. HITECH provided the statutory basis for the Breach Notification Rule — requiring covered entities to notify:

  • Affected individuals within 60 days of discovery
  • HHS OCR (annually for small breaches, within 60 days for breaches of 500+)
  • Prominent media outlets for breaches involving more than 500 residents of a state or jurisdiction

3. Extended Direct HIPAA Liability to Business Associates

HITECH made business associates directly liable for compliance with certain provisions of the HIPAA Rules. HHS implemented these changes through the 2013 Omnibus Final Rule, giving OCR authority to take enforcement action directly against business associates for specified violations. This is why vendors like HIPAA Vault are directly subject to HIPAA enforcement — not just contractually through BAAs, but legally for applicable provisions.

4. Promoted EHR Adoption Through Meaningful Use

HITECH created financial incentives (and later penalties) for healthcare providers to adopt certified electronic health records — the Meaningful Use program that drove widespread EHR adoption across the U.S. healthcare system.

Ready for the 2026 HIPAA Rules

See the fully managed solutions that meet MFA, encryption, and recovery requirements out of the box

See HIPAA Solutions

HITRUST: The Certification Framework (2007)

The Health Information Trust Alliance (HITRUST) is a private organization that created the HITRUST Common Security Framework (CSF). It is not a government agency, not a federal law, and HITRUST certification is not generally required by federal law. It is a voluntary certification that provides independent assurance that relevant security and privacy controls have been implemented and validated.

What HITRUST CSF is:

  • A comprehensive security and privacy framework incorporating HIPAA, NIST, ISO 27001, PCI DSS, and other standards into a unified control set
  • An independent assessment and certification process conducted by approved HITRUST assessors
  • A signal to business partners and customers that your compliance program has been independently validated

HITRUST certification levels:

  • e1 Assessment — foundational, 43 core controls, one-year validity
  • i1 Assessment — threat-adaptive, 182 control requirements, one-year validity
  • r2 Assessment — risk-based, highest level of control requirements, two-year validity. Maintaining r2 certification requires an interim assessment around the 12-month mark

What HITRUST does NOT do:

  • HITRUST certification does not replace HIPAA compliance. Depending on the assessment scope, it can provide independent assurance that relevant security and privacy controls — including controls mapped to HIPAA — have been implemented and validated
  • A HITRUST-certified vendor is not automatically your HIPAA business associate — you still need a signed BAA
  • HITRUST certification does not protect against OCR enforcement — OCR enforces HIPAA, not HITRUST

As Gil Vidals explains about how organizations should evaluate vendor certifications:

“HITRUST is meaningful — it tells you the vendor has gone through rigorous independent validation. But it’s not a substitute for asking the right questions. You still need a BAA. You still need to understand what data flows where. HITRUST is a starting point for trust, not the end of due diligence.”

How HIPAA, HITECH, and HITRUST Work Together

The three frameworks are complementary — not alternatives:

HIPAA sets the legal requirements — what covered entities and business associates must do to protect PHI.

HITECH makes HIPAA enforceable with real consequences — the tiered penalty structure, the breach notification obligation, and the direct liability of business associates for certain violations that give the law its teeth.

HITRUST provides a way to demonstrate that relevant controls have been implemented through a rigorous, independently validated compliance program — useful for vendor due diligence, enterprise sales, and risk management.

Covered entities and business associates that are HIPAA and HITECH compliant have met their applicable legal obligations. Those that are also HITRUST certified can demonstrate that compliance through independent third-party validation.

The 2025 Proposed HIPAA Security Rule Update: What’s Coming

⚠️ Important: The changes described below are not currently in effect. HHS proposed these Security Rule changes in December 2024, with publication in the Federal Register in January 2025. Until HHS issues a final rule and applicable compliance dates take effect, regulated entities must continue following the current HIPAA Security Rule.

In January 2025, HHS published a Notice of Proposed Rulemaking to strengthen the HIPAA Security Rule — the most significant proposed update since HITECH. Key proposed changes include:

  • Multi-factor authentication — the proposal would expressly require MFA, with limited exceptions
  • Encryption — proposed to become required for ePHI at rest and in transit, with limited exceptions
  • Vulnerability scanning — proposed at least every six months
  • Penetration testing — proposed at least once every 12 months
  • Technology asset inventory — explicitly addressed in the proposal

Organizations that are already HITRUST r2 certified will find many of these proposed requirements already met within their existing control framework.

Practical Implications for Healthcare Organizations

Do you need to comply with HIPAA and HITECH? Covered entities and business associates must comply with the HIPAA requirements applicable to their roles and activities. HITECH amended and strengthened many of those obligations. If you create, receive, maintain, or transmit PHI as a healthcare provider, health plan, clearinghouse, or business associate, the HIPAA/HITECH framework applies to you.

Do you need HITRUST certification? Not generally required by federal law — but increasingly relevant commercially. Some healthcare organizations and enterprise customers may require or strongly prefer HITRUST certification as part of vendor risk management and procurement. If you sell into enterprise healthcare, ask your target customers what they require.

What’s the right sequence?

  1. Achieve HIPAA/HITECH compliance — this is the legal baseline
  2. Conduct a Security Risk Assessment — required by HIPAA, foundational to everything else
  3. Implement required administrative, physical, and technical safeguards
  4. Monitor proposed Security Rule changes and evaluate readiness
  5. Consider HITRUST certification if your business targets enterprise healthcare or requires independent validation

Frequently Asked Questions

This article is educational and does not constitute legal advice. HIPAA, HITECH, and HITRUST requirements are subject to regulatory updates — verify current standards with HHS OCR and the HITRUST Alliance. The 2025 proposed Security Rule changes are not yet in effect.