On January 17, 2013, the U.S. Department of Health and Human Services (HHS) moved forward with additional rules to strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The new rule greatly enhances a patient’s privacy protections, provides individuals new rights to their health information, and strengthens the government’s ability to enforce the law. In the past, the HIPAA rules have focused on health care providers, health plans and other entities that process health insurance claims. The new changes recently announced expand many of the requirements to business associates of these entities that receive protected health information, such as contractors and subcontractors. According to HHS, some of the largest breaches have involved business associates.