On January 17, 2013, the Department of Health and Human Services ("HHS") released its longawaited final HIPAA rule, which significantly expands certain obligations for covered entities and their business associates (the "Final Rule"). The Final Rule, which was published in the Federal Register on January 25, 2013, has been described as "the most sweeping changes to the HIPAA Privacy and Security Rules since they were first implemented." In general, the Final Rule expands HIPAA obligations for business associates and their subcontractors, revises the requirements regarding the use and disclosure of patient information, expands patient rights, clarifies the content of Notice of Privacy Practices to be provided by healthcare providers, modifies the breach notification requirements, and expands enforcement provisions and penalties. Covered entities and business associates have about sixty (60) days (i.e., until September 23, 2013 -- and in limited circumstances with respect to amending business associate agreements, until September 23, 2014) to achieve compliance with the new provisions.

Covered Entities: In order to achieve compliance, covered entities should undertake the following steps before September 23, 2013...