The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009 as part of the American Recovery and Reinvestment Act, funded the nationwide adoption of electronic health records through the Meaningful Use incentive programs and significantly strengthened HIPAA — expanding enforcement, increasing penalties, extending obligations to business associates, and introducing breach-notification requirements. It is the law that put EHRs in nearly every US provider, creating the digitized substrate the later Cures Act interoperability rules act upon.
HITECH Act
Statute United States
The HITECH Act is the law that made US healthcare digital in the first place. Its Meaningful Use incentives funded the EHR adoption wave of the 2010s, and it sharpened HIPAA’s teeth — bigger penalties, direct obligations on business associates, and the breach-notification regime that turned data protection from guidance into consequence.
- Meaningful Use - The incentive programs that put an EHR in nearly every US provider, creating the digital substrate everything since is built on.
- HIPAA, strengthened - Expanded enforcement, higher penalties, and extension of the rules to the vendors (business associates) handling PHI.
- Breach notification - The requirement to disclose breaches that made security a board-level concern.
HITECH matters to the API story as the necessary first act: you cannot mandate FHIR interoperability across a paper-records industry. It digitized the data so the Cures Act could later require that data be shareable through an API. Read against my healthcare scoring, HITECH is a reminder of how long these arcs run — a 2009 law created the EHRs, a 2016 law demanded they interoperate, and in 2026 the sector is still doing the narrative and consent work that would make the resulting APIs genuinely usable.
