HHS Modifies HIPAA Privacy, Security, Enforcement and Breach Notification Rules

Health Law Alert

January 24, 2013
Health Law Alert

The U.S. Department of Health and Human Services (HHS) Office of Civil Rights has issued final regulations modifying the HIPAA privacy, security, enforcement and breach notification rules (collectively “the Omnibus Rule”). In a release from HHS, the Office of Civil Rights Director, Leon Rodriguez, indicated that “the final Omnibus Rule makes the most sweeping changes to the HIPAA privacy and security rules since they were first implemented.” He added, “these changes not only greatly enhance a patient’s privacy rights and protections, but also strengthen the ability of my office to vigorously enforce the HIPAA privacy and security protections, regardless of whether the information is being held by a health plan, health care provider, or one of their business associates.”

The final Omnibus Rule will be effective March 26, 2013; however, covered entities and business associates will have until September 23, 2013, to comply with it. The 563-page rule was posted on the Federal Register Public Inspection Desk on January 17, 2013. Hinshaw & Culbertson LLP will provide more information regarding the rule in the coming days.

The final Omnibus Rule contains an executive summary which indicates that the final rule strengthens the privacy and security protections established under HIPAA. The executive summary indicates that provisions of the Omnibus Rule do the following:

The final rule also adopts changes to the HIPAA enforcement rule to incorporate the increased and tiered civil money penalty structure provided by HITECH. Significantly, the breach notification requires that a potential breaching party perform a risk-factor analysis, the effect of which may reduce discretion regarding whether a breach must be disclosed to the affected individuals, the government and potentially the media.

For more information, please contact Roy M. Bossen, Michael A. Dowell or your regular Hinshaw attorney.

Download PDF


This alert has been prepared by Hinshaw & Culbertson LLP to provide information on recent legal developments of interest to our readers. It is not intended to provide legal advice for a specific situation or to create an attorney-client relationship.