HITECH Enforcement Changes (42 USC 17939)
HITECH expanded HIPAA enforcement with state attorney general civil actions, four-tier penalties, willful neglect mandatory investigation, and a percentage of CMPs to harmed individuals.
Primary source
42 USC 17939 — Office of the Law Revision Counsel →https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17939&num=0&edition=prelim
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
42 USC 17939 — section 13410 of HITECH — restructured HIPAA enforcement.
Major changes:
- State attorney general enforcement (42 USC 1320d-5(d)): state AGs may bring civil actions in federal district court on behalf of state residents to enjoin further violation or obtain damages. Connecticut, Massachusetts, Indiana, Minnesota, New York, and Vermont have all brought HIPAA AG actions.
- Four-tier penalty structure: no knowledge / reasonable cause / willful neglect corrected / willful neglect not corrected — codified at 45 CFR 160.404.
- Mandatory investigation of willful neglect: HHS must investigate any complaint or compliance review where preliminary investigation indicates a possible willful neglect violation and must impose a CMP when the investigation confirms willful neglect.
- Distribution of CMPs to harmed individuals: HITECH directed HHS to establish a methodology under which individuals harmed by HIPAA violations may receive a percentage of CMPs or settlements. The methodology has not been finalized as of this review date.
The combination of mandatory willful-neglect investigation, expanded penalty tiers, state AG concurrent jurisdiction, and direct BA liability is the regulatory backdrop against which the modern HIPAA risk picture is calibrated.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHITECH Act Overview (Pub. L. 111-5, Title XIII)Title XIII of the American Recovery and Reinvestment Act amended HIPAA in 2009 to add breach notification, direct business associate liability, increased penalties, and the Meaningful Use program.
- RegulationHIPAA Civil Money Penalty Tiers (45 CFR 160.404)The four-tier culpability and penalty structure for HIPAA civil money penalties, with statutory caps adjusted annually for inflation.
- RegulationHIPAA Enforcement Rule Overview (45 CFR 160 Subpart C-E)The framework for HHS investigation and enforcement of HIPAA violations: complaints, compliance reviews, informal resolution, civil money penalties, and the four-tier culpability structure.
- RegulationHIPAA Criminal Enforcement (42 USC 1320d-6)Criminal sanctions for knowingly obtaining or disclosing PHI in violation of HIPAA, enforced by the Department of Justice rather than HHS, with three tiers escalating to ten years' imprisonment.
- ComplianceCommunicable Disease Reporting: CDC NNDSS + State Health Department RequirementsFederal 42 USC § 247b + CDC NNDSS + state reportable-disease lists: who reports, what conditions, timelines (immediate to weekly), and 45 CFR § 164.512(b) HIPAA permissibility.
- SRAHIPAA Settlements and Civil Money Penalties: A Small-Practice Reading ListHow HHS Office for Civil Rights publishes its enforcement record, the tiered civil money penalty structure at 45 CFR 160.404, and what recent small-practice settlements actually say.
- RegulationAnti-Kickback Statute Overview (42 USC 1320a-7b(b))Criminal prohibition on knowingly and willfully soliciting, receiving, offering, or paying remuneration to induce or reward federal health care program business, with safe harbors at 42 CFR 1001.952.
- RegulationFCA 'Knowingly' Standard and Reckless Disregard (31 USC 3729(b))'Knowingly' under the FCA includes actual knowledge, deliberate ignorance, and reckless disregard of the truth or falsity of the information; no specific intent required.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.