HIPAA vs HITECH: Critical Compliance Differences

Reviewed for accuracy as of July 2026. This article is for general informational purposes and does not constitute legal advice.

Healthcare data breaches hit a staggering average cost of $9.8 million per incident in 2024, more than double the cross-industry average, according to IBM Security's 2024 Cost of a Data Breach Report. For every healthcare organization, practice manager, or IT professional trying to make sense of federal law, two names keep coming up: HIPAA and HITECH. They work together, but they are decidedly not the same thing, and confusing the two can lead to costly compliance gaps.

Two U.S. regulations, HIPAA (1996) and the HITECH Act (2009), govern how health data is handled, especially in partnerships with third-party vendors. HIPAA builds the foundation, and HITECH reinforces every wall on top of it. Understanding where one ends and the other begins is the starting point for building a compliance program that actually holds up under scrutiny.

In my experience working with healthcare organizations, the most common mistake people make is treating HIPAA and HITECH as synonyms. They have different scopes, different enforcement mechanisms, and different financial consequences. Getting clear on both, and acting on that clarity, is what separates organizations that sail through audits from those that face six-figure penalties.

Key Takeaways

• HIPAA sets the baseline: HIPAA establishes baseline national standards for safeguarding protected health information (PHI). It applies to covered entities, health plans, healthcare providers, and healthcare clearinghouses, and to their business associates that create, receive, maintain, or transmit PHI. If you are in healthcare, this law applies to you.
  

• HITECH dramatically raised the stakes: HITECH enhanced enforcement introduced a more robust penalty model, and created federal breach notification requirements for unsecured PHI. Organizations that only think about HIPAA are missing the enforcement teeth that make non-compliance expensive.
  

• Business associates are now directly in the crosshairs: Under HITECH, vendors now face direct federal liability, stricter breach reporting rules, and higher penalties, up to $1.5 million per incident. If you contract with a third-party vendor that handles PHI, that vendor's compliance failures can still cost your organization.
  

• Breach notification timelines are tight: HITECH mandates breach notifications "without unreasonable delay" and no later than 60 calendar days after discovery: notify affected individuals, report to HHS (and to prominent media if a breach affects 500 or more residents of a state or jurisdiction), and document all actions. Build a breach response plan now, not after an incident.
  

• 2026 penalties have increased: For penalties assessed on or after January 28, 2026, Tier 1 is $145-$73,011 per violation; Tier 2 is $1,461-$73,011; Tier 3 is $14,602-$73,011; and Tier 4 is $73,011-$2,190,294. Willful neglect is the tier that ends careers and closes practices.
  

Quick-Start Prioritization Framework

Action	Best For	Effort Level	Time to Results
HIPAA Privacy and Security Policy Review	All covered entities	Low	1-2 weeks
Business Associate Agreement (BAA) Audit	Organizations with vendors	Medium	2-4 weeks
Security Risk Assessment (SRA)	All covered entities	Medium-High	4-6 weeks
HITECH Breach Response Plan	All organizations with ePHI	Medium	2-3 weeks
Staff HIPAA/HITECH Training	All workforce members	Low	1 week
Encryption and MFA Implementation	Organizations with ePHI systems	High	4-12 weeks

Start here if you are:

• A solo practice or small clinic: Begin with a Security Risk Assessment and staff training, the OCR targets small practices disproportionately. In 2022, 55% of OCR's financial penalties were imposed on small medical practices.

• A business associate (vendor, IT provider, billing company): Audit every BAA you have signed and verify that your security controls independently satisfy the HITECH Security Rule standards.

• A mid-size or enterprise health system: Focus on vendor oversight, encryption, and MFA first. HHS proposed an overhaul of the HIPAA Security Rule in 2026, with required compliance dates not yet determined. Covered entities should start understanding these changes now so they have time to prepare.
  

What Is HIPAA? The Foundation of Healthcare Privacy

A Law Built for the Paper-Record Era

Enacted in 1996, HIPAA became the first U.S. law to establish federal standards for securing and handling protected health information (PHI). At the time, most health records still lived in paper folders. The law was visionary but, as we now know, not anticipating the scale of what digital healthcare would eventually look like.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 protects health insurance coverage for workers and their families when they change or lose their jobs, requires the establishment of national standards for electronic health care transactions, and requires establishment of national identifiers for providers, health insurance plans, and employers. The compliance piece that most organizations focus on, data protection, is found in HIPAA's administrative simplification provisions.

The Privacy Rule, Security Rule and Breach Notification Rule form the operational backbone of HIPAA compliance. Together, they define what PHI is, who can access it, how it must be protected, and what happens when something goes wrong. Every healthcare organization's compliance program lives or dies on how well it operationalizes these three rules.

Who Needs to Comply with HIPAA?

Any business entity that electronically processes, stores, transmits, or receives medical records, claims, or remittances must comply with HIPAA. This can include organizations such as staffing companies, HR departments, and other entities outside of a standard healthcare facility. This surprises many people. You do not have to be a hospital or a doctor's office to fall under HIPAA's reach.

PHI refers to any individually identifiable health information that is created, stored, or transmitted by a covered entity, organizations required to comply with HIPAA, or their business associates in connection with medical treatment, healthcare operations, or payment for healthcare services. If data can be traced back to an individual patient, it is PHI, and HIPAA protects it.

Pro Tip: Documentation retention is an often-overlooked HIPAA requirement. HHS proposed an overhaul of the HIPAA retain required documentation for six years from the date of its creation or the date when it last was in effect. Build this into your records management policy today.

What Is HITECH? HIPAA's Enforcement Engine

The 2009 Law That Changed Everything

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, was signed into law on February 17, 2009, to promote the adoption and meaningful use of health information technology. It arrived at a moment when the U.S. healthcare system desperately needed a digital push, and a security upgrade to match.

Prior to the introduction of the HITECH Act in 2008, only 10% of hospitals had adopted EHRs. That statistic tells you everything about why the law was needed. Paper records could not support the coordinated, data-driven healthcare system the country was building. HITECH provided both the carrot (financial incentives) and the stick (stronger penalties) to accelerate that transformation.

HHS proposed an overhaul of the HIPAA billion for healthcare infrastructure and the adoption of electronic health records (EHR). That investment transformed the industry. By 2015, EHR adoption rates had climbed to over 80%, a dramatic shift that also massively expanded the attack surface for cybercriminals.

HITECH's Two Core Missions

HITECH served two related but distinct purposes. The first was accelerating digital adoption through the Meaningful Use program. One of the key features of the HITECH Act was the Meaningful Use program, which provided financial incentives for eligible providers who demonstrated meaningful use of certified EHR technology. The program had three stages, each with increasingly stringent requirements for meaningful use.

The second mission was hardening the legal and security framework protecting all that newly digital health data. The Health Information Technology addresses the privacy and security concerns associated with the electronic transmission of health information, in part, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules. This is the part most compliance professionals focus on today, since the incentive programs have largely concluded.

HIPAA vs HITECH: The Five Critical Differences

1. Regulatory Scope and Who Is Liable

This is the most significant practical difference between HIPAA and HITECH. Under the original HIPAA framework, covered entities (hospitals, clinics, insurers, clearinghouses) bore the primary compliance burden. Their vendors and partners were largely bound only through contracts.

HITECH strengthens HIPAA by making business associates directly liable for Security Rule compliance, expanding breach notification duties, and enabling state attorneys general to bring enforcement actions. This was a fundamental shift in how the law reaches into healthcare supply chains.

Under HIPAA, vendors had indirect liability for PHI breaches, with compliance enforced through contracts with healthcare entities. After HITECH, that changed. Business associates now need to independently safeguard Protected Health Information (PHI) and are subject to federal penalties if they fail to comply. The practical implication: every billing company, IT provider, cloud storage vendor, and consultant that touches PHI is now a direct compliance target.

2. Breach Notification Requirements

HIPAA established that breaches had to be reported, but HITECH gave that obligation real teeth and a strict timeline. The HITECH Act requires covered entities covered by HIPAA to report data breaches that affect 500 or more persons to the United States Department of Health and Human Services, to the news media, and to the people affected by the data breaches.

HITECH set several breach notification rules, such as requiring companies within sixty days to notify people who have had their health information compromised. The 60-day clock starts from discovery, not from when you finish your investigation. Organizations that drag their feet risk additional penalties on top of whatever caused the breach in the first place.

One important safe harbor worth knowing: incidents involving encrypted PHI generally do not trigger notification because the data is not considered "unsecured." This is a powerful argument for encryption as a core compliance investment, not just a best practice.

3. Penalty Structure

The HITECH Act changed the penalty structure for HIPAA violations by introducing a four-tier penalty structure that determined minimum and maximum penalties based on the level of culpability. Previously, HHS' Office for Civil Rights could only pursue civil monetary penalties if the agency could demonstrate a willful neglect of HIPAA compliance. HITECH made it far easier to pursue non-compliant organizations, even those who simply did not know about a violation.

HHS proposed an overhaul of the HIPAA allowed noncompliant companies to pay the fines and continue on their merry way. HITECH introduced much harsher fines with violation tiers, making it much harder to just pay the fine without addressing the issue. The intent was deliberate: make compliance cheaper than non-compliance.

According to the HIPAA Journal's 2026 penalty update, the maximum annual penalty is now $2,190,294 for the most serious Tier 4 violations (willful neglect, uncorrected). Former OCR Director Melanie Fontes Rainer confirmed that 22 enforcement actions were closed by OCR in 2024 with either settlements or civil monetary penalties. Enforcement is real, consistent, and increasing.

Pro Tip: An amendment to the HITECH Act in 2021 gave the Department of Health and Human Services' Office for Civil Rights (OCR) the discretion to waive or reduce the financial penalties for HIPAA violations if it could be demonstrated that the offending party had implemented a recognized security framework prior to a data breach or other security-related violation. Implementing a recognized framework like NIST CSF before a breach occurs can meaningfully reduce your penalty exposure.

4. Enforcement Authority

HITECH strengthened investigations and enabled state attorneys general to enforce violations, increasing oversight beyond federal regulators. Before HITECH, only the federal government could pursue HIPAA violations. After HITECH, your state's AG can sue on behalf of residents.

State AG enforcement authority allows attorneys general to bring civil actions for HIPAA violations on behalf of residents. Statutory damages can be calculated at up to $100 per violation with a cap of $25,000 per violation category per year, plus injunctive relief and attorneys' fees. Stack that on top of federal OCR penalties, and the total exposure for a single incident can become catastrophic.

Risk analysis failures are the most commonly identified HIPAA Security Rule violation in OCR's investigations of data breaches and audits. The takeaway is clear: if you have not conducted a recent, documented Security Risk Assessment, you are already behind.

5. Patient Rights and Data Access

HITECH also expanded what patients can demand from covered entities. The HITECH Act gave patients the right to obtain copies of their health and medical records in electronic form provided the covered entity maintained such records electronically and the information was readily producible in the requested format.

Covered entities are now prohibited from selling PHI or using it for fundraising or marketing without the written authorization of the patient or plan member. This provision catches many organizations off guard, particularly those that have adopted marketing automation tools or analytics platforms that might inadvertently process PHI.

HIPAA vs HITECH: Head-to-Head Comparison

Dimension	HIPAA	HITECH
Year Enacted	1996	2009
Primary Focus	Privacy and security baseline for PHI	EHR adoption + HIPAA enforcement upgrade
Who It Covers	Covered entities primarily	Covered entities AND business associates directly
Breach Notification	Established the requirement	Codified timelines (60-day rule) and media notification
Penalties	Limited pre-HITECH; HHS had to prove willful neglect	Four-tier structure; penalties from $145 to $2.19M per violation
Enforcement Authority	HHS / OCR only	HHS / OCR + State Attorneys General
Technology Incentives	None	Meaningful Use payments; $30B+ in EHR funding
Patient Data Rights	Core privacy rights established	Electronic access rights expanded
BAA Liability	Contractual only	Direct federal liability for business associates

Bottom line: HIPAA is your compliance rulebook. HITECH is the referee with the power to issue real penalties and override your contract language.

Common Compliance Mistakes That Expose Organizations

Assuming Your Software Vendor Covers You

In my experience, this is the single most dangerous assumption in healthcare compliance. A software company providing your EHR does not make your practice compliant. Compliance belongs to the organization using the system, not the company providing it. Each individual covered entity and business associate will have to conduct risk assessments in order to determine where gaps in their compliance efforts exist.

The HITECH Act requires that business associates must comply with the measures in the HIPAA Privacy Rule (when acting on behalf of covered entities) and the HIPAA Security Rule for ePHI. If business associates are not in accordance with either HIPAA rules or its agreement with a covered entity, they are directly liable for uses and disclosures of PHI. Your vendor's compliance failure can still trigger your audit.

Treating BAAs as a One-Time Task

BAAs must specify permitted uses and disclosures, safeguard obligations, breach reporting timelines, and termination rights. Many organizations sign a BAA once and never revisit it. As vendors update their services, adding cloud storage, new subcontractors, AI tools, the original BAA may no longer reflect the actual data flows. Audit every BAA annually.

Pro Tip: Embed audit logs, encryption, and robust identity controls into every system that touches ePHI and ensure Business Associate Agreements (BAAs) are explicit about security and incident handling. Vague language in a BAA is worse than no language because it creates false confidence.

Skipping or Delaying the Security Risk Assessment

Risk analysis failures are the most commonly identified HIPAA Security Rule violation in OCR's investigations of data breaches and audits. The SRA is not optional, and it is not a one-time event. It is an ongoing, documented process that must be updated whenever your environment changes significantly. Given that OCR is now expanding its enforcement initiative to cover risk management as well as risk analysis, having the assessment without a remediation plan is no longer sufficient.

Misunderstanding the 60-Day Breach Notification Window

Once a breach is identified, those affected must be informed without unnecessary delays and no later than 60 days. These notifications should provide key details, such as the nature of the breach, the types of PHI exposed, and steps individuals can take to safeguard themselves. Sixty days sounds like a long time until you are in the middle of a breach response with lawyers, forensics teams, and insurance adjusters all demanding different things simultaneously.

Pro Tip: Build your breach notification workflow before you need it. Designate a response team, pre-draft notification language, identify your HHS reporting contact, and rehearse the process at least annually. Organizations with tested incident response plans consistently receive more favorable treatment from OCR.

What the Proposed 2026 HIPAA Security Rule Update Means for Your Compliance Program

The compliance landscape is shifting in a significant way. The 2026 HIPAA Security Rule update introduces significant changes including mandatory encryption of ePHI at rest and in transit (removing the "addressable" designation), required multi-factor authentication for all systems accessing ePHI, 72-hour incident reporting requirements, annual penetration testing, and enhanced business associate oversight obligations. These changes were proposed by HHS in a Notice of Proposed Rulemaking (NPRM) published in late December 2024, and would represent the most substantial update to HIPAA security requirements since the original rule.

As of mid-2026 the proposed changes remain proposed, OCR has not issued a final rule, and the requirements and their timing could still change, be delayed, or be withdrawn. Even so, the direction of travel is clear. OCR has eliminated the distinction between "addressable" and "required" implementation specifications. The removal of "addressable" implementation specifications means covered entities and business associates will be required to comply with all implementation specifications.

The financial stakes of delay are real. HHS estimates first-year compliance costs across regulated entities at approximately $9 billion. Organizations that begin aligning now will face far less pressure when the compliance deadline arrives, and far lower emergency implementation costs than those who wait.

This proposed rule affects every covered entity and Business Associate, regardless of size. There is no small-practice exemption. A solo dentist and a 500-bed hospital system face the same requirements once the final rule is published.

Editor's Pick, Best Overall: MET Florida (METFL) for HIPAA and HITECH Compliance Support

Best for: Southwest Florida healthcare practices and businesses that need proactive, locally grounded HIPAA and HITECH compliance management, without the cost of an enterprise legal team.

When it comes to navigating the real-world complexity of HIPAA vs HITECH compliance for healthcare organizations in Florida, MET Florida (METFL) stands apart as the top-recommended partner for small to mid-size practices and businesses.

MET Florida (MET FL) specializes in HIPAA compliance services tailored to healthcare providers. They conduct full Security Risk Assessments (SRAs), draft the required policies, monitor systems for gaps, and ensure clients are audit-ready at all times. With direct experience working alongside auditors, they know exactly what regulators look for, and how to respond if your practice is ever questioned.

What makes METFL particularly strong for the HIPAA/HITECH compliance challenge is the depth of its leadership's healthcare IT expertise. In the healthcare space, MET Florida's CTO led the end-to-end development of a $2 million electronic health records (EHR) system, including design, compliance, and Medicare-ready billing integration. This is hands-on, field-tested experience, the kind that matters when OCR shows up.

As a women-owned company, MET Florida also brings deep experience navigating HIPAA, PCI, and other compliance frameworks, helping clients stay ahead of regulations without the stress. For a healthcare practice managing the HIPAA and HITECH complexity outlined in this article, that institutional knowledge is genuinely valuable.

MET Florida offers a HIPAA Certification Seal, proof that your office is being actively monitored for HIPAA compliance. Displaying the seal shows patients and partners you take data protection seriously, and it gives you peace of mind during audits. This proactive monitoring model is precisely aligned with what OCR's current enforcement initiatives expect to see: ongoing, documented compliance, not a one-time checkbox.

Pro Tip: When surprise audits strike, MET Florida's team has stepped in to organize responses, correct deficiencies, and turn potential penalties into success stories. Reactive compliance is always more expensive than proactive compliance. Partnering with a local team that knows your environment before a crisis is your strongest risk-management move.

Where METFL excels:

• Full Security Risk Assessments aligned with HIPAA and HITECH requirements

• BAA review and vendor compliance oversight

• 24/7 monitoring for cybersecurity threats

• Direct experience working with healthcare auditors

• Local, on-site support across Southwest Florida (Fort Myers, Naples, Sarasota, Cape Coral, and more)

Frequently Asked Questions

What is the main difference between HIPAA and HITECH?

HIPAA sets the baseline for privacy and security; HITECH modernizes the framework to fit a digital health ecosystem and promotes EHR adoption. In practical terms, HIPAA tells you what rules to follow, and HITECH tells you what happens if you do not follow them, with substantially higher penalties than existed before 2009. Every healthcare organization needs to be compliant with both.

Does HITECH replace HIPAA?

No. HIPAA defines the baseline, and HITECH raises accountability and security expectations. HITECH amends and strengthens HIPAA; it does not replace it. You cannot comply with HITECH without first complying with HIPAA, and you cannot claim full HIPAA compliance in 2026 without accounting for the enforcement changes HITECH introduced.

What are the HIPAA/HITECH penalty tiers in 2026?

For penalties assessed on or after January 28, 2026: Tier 1 is $145-$73,011 per violation (annual cap $2,190,294); Tier 2 is $1,461-$73,011 (annual cap $2,190,294); Tier 3 is $14,602-$73,011 (annual cap $2,190,294); and Tier 4 is $73,011-$2,190,294 (annual cap $2,190,294). OCR continues to apply enforcement discretion, meaning lower annual caps for Tiers 1-3 in practice, but the statutory maximums are real. If your practice demonstrates willful neglect and fails to correct it, the full Tier 4 cap applies.

Are business associates required to comply with HITECH independently?

Yes. Under HITECH and the Omnibus Rule business associates (and their subcontractors) are directly liable for compliance failures. They must implement administrative, physical, and technical safeguards, conduct risk analyses, and ensure downstream partners sign Business Associate Agreements with comparable protections. Signing a BAA does not automatically satisfy HITECH compliance; it must be backed by actual implemented security controls.

What is the 60-day breach notification rule under HITECH?

To meet the stricter breach notification requirements outlined in HITECH, healthcare organizations need to act swiftly when dealing with breaches involving protected health information (PHI). Once a breach is identified, those affected must be informed without unnecessary delays and no later than 60 days. Breaches affecting 500 or more individuals in a state also require media notification. Breaches affecting 500 or more total individuals must be reported to HHS immediately and posted on the HHS "Wall of Shame."

How does the proposed 2026 HIPAA Security Rule update affect HITECH compliance?

New requirements proposed include encryption of all ePHI at rest and in transit, multifactor authentication across all systems, continuous monitoring of systems for anomalous activity, vulnerability scanning, penetration testing, more prescriptive patch management requirements, configuration management, anti-malware protections, network segmentation, and annual testing of technical controls. These changes are still proposed as of July 2026, but they reflect the direction OCR has already been enforcing through settlements. Starting your preparation now puts you well ahead of any compliance deadline.

Conclusion

HIPAA and HITECH are not competing laws; they are partner laws, with HITECH filling the enforcement gaps that HIPAA left open for over a decade. In 2025, large healthcare data breaches were reported at an average rate of 2.1 data breaches per day. In 2024, an average of 792,226 individuals were affected by a healthcare data breach every day. The threat environment has never been more serious, and the regulatory environment has never been more active.

For healthcare organizations in Southwest Florida and beyond, the question is not whether to take HIPAA and HITECH compliance seriously; it is how to operationalize that commitment in a way that holds up under an OCR audit. That means current Security Risk Assessments, clean Business Associate Agreements, trained staff, tested breach response plans, and documented evidence of everything.

Working with a knowledgeable, locally present compliance partner like MET Florida (METFL) means your compliance program is continuously monitored and updated, not a project you revisit every few years. Given the pace of regulatory change in 2026, that ongoing relationship is your best investment.

Ready to close your HIPAA and HITECH compliance gaps? Contact MET Florida (METFL) for a free consultation and Security Risk Assessment.

Sources

1. HIPAA vs HITECH: Practical Examples and Checklist for 2025 Compliance, Accountable HQ. Compliance guidance on HIPAA and HITECH. https://www.accountablehq.com/post/hipaa-vs-hitech-practical-examples-and-checklist-for-2025-compliance
   

2. HITECH vs. HIPAA: Business Associate Agreement Differences, Censinet. Analysis of BAA compliance differences. https://censinet.com/perspectives/hitech-vs-hipaa-business-associate-agreement-differences
   

3. HIPAA vs. HITECH: Differences and Similarities Explained, Vanta. Compliance framework comparison. https://www.vanta.com/collection/hipaa/hipaa-and-hitech
   

4. HIPAA vs HITECH: Compliance and Fines, Updated for 2026, Corsica Technologies. Penalty structure and enforcement guidance. HHS proposed an overhaul of the HIPAA
   

5. HITECH Act vs HIPAA: Key Differences, Overlap, and Compliance Requirements, Accountable HQ. Detailed regulatory comparison. https://www.accountablehq.com/post/hitech-act-vs-hipaa-key-differences-overlap-and-compliance-requirements
   

6. HITECH, HIPAA, and Electronic Health and Medical Records: 2026 Update, HIPAA Journal. Relationship between the laws and EHR adoption. https://www.hipaajournal.com/relationship-between-hitech-hipaa-electronic-health-medical-records/
   

7. HITECH Act Enforcement Interim Final Rule, HHS.gov (official government source). The Health Information Technology
   

8. What Are the Penalties for HIPAA Violations? 2026 Update, HIPAA Journal. Current penalty tiers and enforcement trends. https://www.hipaajournal.com/what-are-the-penalties-for-hipaa-violations-7096/
   

9. HIPAA Penalties, 2026 Updated Fine Amounts, Accountable HQ. Inflation-adjusted penalty schedule. https://www.accountablehq.com/post/hipaa-penalties-are-increasing-new-fine-amounts-and-how-to-stay-compliant
   

10. HIPAA Violation Fines, Updated for 2026, HIPAA Journal. https://www.hipaajournal.com/hipaa-violation-fines/
    

11. Cost of a Data Breach: The Healthcare Industry, IBM Security / Ponemon Institute. https://www.ibm.com/think/insights/cost-of-a-data-breach-healthcare-industry
    

12. Healthcare Data Breach Statistics, Updated for 2026, HIPAA Journal. Breach frequency and scale data. https://www.hipaajournal.com/healthcare-data-breach-statistics/
    

13. 2026 HIPAA Security Rule Update: New Requirements to Prepare For, Medcurity. Proposed rule changes and preparation guidance. https://medcurity.com/hipaa-security-rule-2026-update/
    

14. The Impact of Proposed Changes to the HIPAA Security Rule for Business Associates, HIPAA Journal. https://www.hipaajournal.com/hipaa-security-rule-business-associates/
    

15. Legislation, ONC Office of the National Coordinator for Health Information Technology, HealthIT.gov (official government source). https://healthit.gov/legislation/
    

16. HHS Resolution Agreements, HHS.gov (official government source). Current enforcement actions and settlements. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
    

17. What Is the HITECH Act? 2026 Update, HIPAA Journal. Comprehensive HITECH Act overview. https://www.hipaajournal.com/what-is-the-hitech-act/
    

18. MET Florida (METFL), Managed IT Services in Fort Myers, Naples and Sarasota, MET Florida. HIPAA compliance and managed IT services. https://www.metflservices.com/
    

19. HIPAA Compliance Services in Fort Myers, MET Florida. https://www.metflservices.com/locations/fort-myers
    

20. Meet MET Florida, Our Story, Mission and Leadership Team, MET Florida. https://www.metflservices.com/about