The HITECH Act not only expands the responsibility of maintaining the privacy of personal health records, but also requires implementation of very detailed breach notification requirements. This presentation will discuss the new Business Associate Agreement requirements along with what constitutes a breach of personal health information and what actions are required from a notification standpoint to be in compliance. In addition, it will discuss case studies of personal health information breaches and some pre- and post- breach risk initiatives to minimize the potential damage.