On March 24, 2012, the Department of Health and Human Services (HHS) sent the much-anticipated rule implementing the HITECH Act changes to HIPAA (HITECH Rule) to the Office of Management and Budget (OMB). This starts the clock running on the 90-day period allowed for OMB review. It is expected that, given the scope of the regulations, OMB will take most, if not all, of its allotted 90 days. In any event, the HITECH Rule is expected by late June 2012. While the authors have noted references to this as the "Final Rule" in publications about the HHS document released to the OMB, the HHS announcement actually states that what was released to the OMB will be a "notice and comment rulemaking, as required by the administrative procedures act." Thus, the final rule will not be published until after the notice and comment period has ended. (See the discussion at the end of this article as to possible effective dates.) According to HHS, the HITECH Rule will include changes to the regulations regarding:

- Business associate liability;

- Limitations on the sale of protected health information;

- Marketing and fundraising communications; and

- Individual rights to access electronic medical records and restrict the

disclosure of certain information.