One Week to Get Business Associate Agreements Executed Under HIPAA Omnibus Rule’s Grandfather Clause

On Jan. 17, 2013, the long-awaited HIPAA “Omnibus Rule” went on display at the Federal Register, finalizing changes to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules. Davis Wright Tremaine will issue a client alert next week with an analysis of the new rule. A copy of the rule can be found here.

While the new rule establishes a compliance date of Sept. 23, 2013, it includes up to a one-year extension for covered entities and business associates to revise their business associate agreements if such agreements were entered into and compliant with HIPAA as of Jan. 25, 2013, the expected date of formal publication of the new rule in the Federal Register.

The grandfathering provision under the new rule provides:

(1) If the parties have a HIPAA compliant agreement in place before Jan. 25, 2013, and the agreement is not renewed between March 26, 2013 and September 2013, then they can rely on that agreement until Sept. 23, 2014.

(2) If the parties don’t have a compliant agreement in place by Jan. 25, 2013, then they will need to enter into a compliant agreement by Sept. 23, 2013, which is a year earlier than for grandfathered agreements.

Under any scenario, if an agreement is renewed between Sept. 23, 2013 and Sept. 23, 2014, it must comply with the new rule. The benefit under scenario (1) is that, if it is not renewed during that period, then the parties have until Sept. 23, 2014 to revise it.

What does this jumble mean in practice? It means that if parties currently are working on a business associate agreement and execute it before Friday, Jan. 25, 2013, then they may not need to revisit it until Sept. 23, 2014. In contrast, if they execute it on or after Jan. 25, 2013, then the parties will want to either ensure that it complies with the new rule or plan on revising the agreement this year, no later than Sept. 23, 2013, to bring the agreement into compliance with the new rule.

If you have any questions, you may contact Adam Greene or Rebecca Williams. In addition, Davis Wright Tremaine will host a series of  webinars covering the new rule. The first two will be:

  • “The Wait is Over: Overview of the HIPAA Omnibus Rule,” Friday, Jan. 25, 2013 at 10:00 a.m. Pacific/ 1:00 p.m. Eastern
  • “The Brave New World of Business Associates,” Wednesday, Jan. 30, 2013 at 10:00 a.m. Pacific/ 1:00 p.m. Eastern

Invitations to both webinars are forthcoming.


Written by:

Published In:

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Davis Wright Tremaine LLP | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »

All the intelligence you need, in one easy email:

Great! Your first step to building an email digest of JD Supra authors and topics. Log in with LinkedIn so we can start sending your digest...

Sign up for your custom alerts now, using LinkedIn ›

* With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name.