Privacy protection for health information has been established through multiple means, including HIPAA and the HITECH provisions of ARRA. True or False?

• A. Not stated
• B. Not applicable
• C. True
• D. False

Answer: (C)

Privacy protection for health information is provided by multiple sources, with HIPAA serving as the foundational federal law that sets national standards for the protection of protected health information (PHI) and governs its use and disclosure, along with the Security Rule and Privacy Rule. The HITECH Act, part of the ARRA of 2009, strengthens those protections by extending HIPAA requirements to electronic health information, bringing business associates under the same privacy and security obligations, increasing enforcement tools and penalties, mandating breach notification to individuals, and supporting the nationwide adoption of electronic health records.

So the statement is true: privacy protections have been established through HIPAA and the HITECH provisions of ARRA. The other options would be incorrect because they would imply the protections are not established or are not applicable, which isn’t the case.