On January 25, the Office for Civil Rights of the Department of Health and Human Services published long-awaited final regulations modifying the privacy, security, enforcement and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH), implementing the most significant changes to health care privacy and security law in a decade.
The final rule impacts all HIPAA-covered entities (health plans, health care providers and health care clearinghouses) and, most significantly, "business associates" to those covered entities and their subcontractors. The final rule is effective March 26, with compliance generally required by September 23.
