While there is much to say about the broadening of the definition of business associate, the new obligations of business associates and their subcontractors, increased protections provided to patients (in terms of being able to opt out from marketing communications and being able to request records in formats most convenient for the patient), enforcement changes (fines of as much as $1.5 million per violation may be imposed in some cases) and more, in this post I will focus on the breach notification rule.