Which of the following was NOT one of the factors that led to changes in HIPAA as a result of the HITECH Act?

• A. There were reports of breaches of information security.
• B. Enforcement was not being done well.
• C. The 1997 security recommendations were outdated.
• D. Privacy advocates felt there was not enough consumer control.

Answer: (C)

The changes brought by HITECH were driven by practical, real-world issues in HIPAA implementation. Reports of information security breaches highlighted the need for prompt breach notification and stronger protections. Enforcement gaps meant that penalties and oversight weren’t sufficient to deter violations, so HITECH expanded civil penalties and enhanced enforcement tools. Privacy advocates pushed for greater consumer control over health information, aiming for more transparency and control for individuals. The notion that 1997 security recommendations were outdated isn’t the factor that spurred HITECH; while earlier guidance informed HIPAA, the act’s push came from the need to address breaches, strengthen enforcement, and give patients more control, along with expanding protections to business associates.