The HIPAA-specific parts of ARRA are found in the Health Information Technology for Economic and Clinical HealthAct (HITECH), which Congress included in the overall ARRA legislation.HITECH broadens the scope of HIPAA to cover all business associates of Health Care Organizations (HCOs). This means that any accounting firm, legal firm, IT consultancy, or other business partner of an HCO must comply with HIPAA security mandates to protect PHI.