As a quick review, HIPAA passed through Congress in 1996 as a broad attempt at health care reform. The act's main objective was to maintain the security and confidentiality of patient health information. In 2009, Congress amended and strengthened HIPAA through the Health Information Technology for Economic and Clinic Health Act, or the HITECH Act. It's the HITECH Act that established the penalty structure for HIPAA violations.