Which of the following was a change with the HITECH Privacy Regulations?

• A. Tracking disclosures for TPO was now required.
• B. Authorization for use of information for advertising purposes was now required.
• C. Patient acknowledgement that they had read a hospital's privacy practices was no longer required.
• D. Reporting breaches to the media was no longer required.

Answer: (A)

HITECH raised the level of accountability for how protected health information is disclosed. A notable change it introduced was that disclosures for treatment, payment, and health care operations needed to be tracked so that an organization can provide a patient with an accounting of disclosures. This enhances transparency and helps individuals understand who has seen their PHI and for what purpose.

The other statements don’t reflect a change brought by HITECH: authorization for advertising uses was not newly required by HITECH (marketing disclosures still require appropriate authorization under HIPAA); patient acknowledgment of privacy practices is not mandated by HIPAA or HITECH; and breach reporting to the media remains required when a breach affects 500 or more individuals, so saying it’s no longer required is incorrect.