Introduction

The enactment of HIPAA in 19961 and promulgation of HIPAA Privacy, Security, and Enforcement Rules2 established standards for the use and disclosure of health information.  Subsequent legislation required changes to those privacy and security requirements, as well as new and expanded requirements for enforcement (including penalties) and breach notification.  Specifically, the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 (HITECH),3 enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA), established legal standards and programs to foster and support the use of interoperable health information technology and health information exchange.  To ensure the privacy of protected health information, HITECH modified provisions of the Social Security Act related to the HIPAA rules and required significant changes to strengthen the HIPAA Privacy, Security, and Enforcement Rules themselves.  Another recently enacted statute, the Genetic Information Nondiscrimination Act of 2008 (GINA),4 prohibits the use of genetic information by certain health plans for underwriting purposes, which required changes to the HIPAA Privacy Rule to specifically protect genetic information like other protected health information. 

On January 17, 2013, the U.S. Department of Health and Human Services (HHS) released the long-awaited omnibus final rule5 including modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules required by the HITECH Act and revisions to the HIPAA Privacy Rule as required by GINA.  HHS also used its regulatory authority to make a number of other changes to make the rules consistent with other Departmental regulations. 

The omnibus Final Rule includes four separate rulemakings:

1. Final rule implementing modifications to the HIPAA Privacy, Security, and Enforcement Rules as required by HITECH that was included in a proposed rule on July 14, 2010.6
2. Final rule implementing changes to the HIPAA Enforcement Rule as required by HITECH that was published as an interim final rule on October 30, 2009.7
3. Final rule implementing changes to the Breach Notification for Unsecured Protected Health Information as required by HITECH that was published as an interim final rule on August 24, 2009.8
4. Final rule modifying the HIPAA Privacy Rule as required by GINA that was published as a proposed rule on October 7, 2009.9

This Final Rule does not address the HITECH accounting for disclosures requirement10 that was addressed in a proposed rule on May 31, 2011.11  HHS indicated that a separate final rule would be released in the future.

The Final Rule will be effective on March 26, 2013.  HHS is allowing covered entities and business associates 180 days beyond the effective date to come into compliance with most of the provisions, including the modifications to the Breach Notification Rule and the GINA changes to the HIPAA Privacy Rule.  However, this grace period does not apply to the HITECH breach of unsecured protected health information provisions that became effective through the Interim Final Rule on September 23, 2009.

This section-by-section analysis gives a detailed description of the changes made in the Final Rule, as well as significant comments received and HHS’ response.  Also available at www.healthinfolaw.com are an overview highlighting the most significant changes and a side-by-side table comparing the proposed and final rules. 

Download PDF by clicking here. [Updated April 18, 2016]