8 pages. Excerpt: This White Paper discusses guidance issued by the U.S. Department of Health and Human Services under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), part of the American Recovery and Reinvestment Act of 2009, which requires covered entities, business associates, vendors of personal health records (PHR) and related entities to notify individuals when their unsecured protected health information and PHR identifiable health information is subject to a breach of security.