on february 17, 2009, president obama signed the american recovery and reinvestment act into law. the law is better known publicly as the stimulus bill. while the policy of the law was to stimulate faster recovery from our economic recession, buried within the massive bill were significant changes to the federal laws governing health care information. these changes soon will become known as the “hitech” changes (which is short for the health information technology for economic and clinical health act that was tucked into the stimulus bill). the effect of the new hitech laws likely will not be felt for some time, but agency rulemaking mandated by the law should be well underway. in fact, the bill requires initial hitech rulemaking, which is expected to be voluminous, to be adopted not later than december 31, 2009. most notably, hitech is an enabling statute that creates a powerful new interagency coordination office within the department of health and human services (hhs) to oversee the development of health information technology. this appears to be a continuation of the work originally ordered by president bush. the ultimate charge of the new office is to reach the goal of utilization of an electronic health record for each person in the united states by 2014. in addition to faster development of health information technology, hitech also expanded the federal privacy provisions under the health insurance portability and accountability act (hipaa). here, in a dramatic change from hipaa law, business associates of entities subject to hipaa (e.g., accounting firms, auditing firms, billing companies, computer consultants, law firms, etc.) essentially will be treated as though they are covered entities under hipaa because they must follow applicable terms of hipaa regulations and now may be subject to hipaa’s civil and criminal penalties. also, a new definition was added to federal law for a “vendor of personal health records.” this new definition appears to be a first attempt to apply some of hipaa’s standards to independent companies that manage health records at a patient’s request. hitech delegates rulemaking related to vendors to the federal trade commission (ftc) rather than hhs. finally, new hipaa enforcement provisions are added to expand jurisdiction for hipaa enforcement to state attorneys general. in short, the stimulus bill will greatly increase the federal regulation of health information.