Excerpt: The American Recovery and Reinvestment Act of 2009 ... included provisions making significant improvement in the privacy and security standards for health information. The provisions on privacy and security (generally in ARRA's Title XIII, Subtitle D and some parts of Subtitle A) can be grouped into four broad categories: Substantive changes to HIPAA statute and privacy and security regulations; Changes in HIPAA enforcement; Provisions to address health information held by entities not covered by HIPAA (as either covered entities or business associates); Miscellaneous: Administration/Studies/Reports/Educational Initiatives[.]