In January 2013, the U.S. Department of Health and Human Services (HHS) released final regulations which revised existing regulations under the Health Insurance Portability and Accountability Act (HIPAA). Because group health plans are subject to HIPAA, sponsors of group health plans should review the plan’s HIPAA policies, privacy notices and business associate agreements and revise such documents as necessary to comply with the final regulations by the September 23, 2013 deadline. Revisions to business associate agreements existing prior to January 25, 2013 that are already compliant with HIPAA may be delayed until the earlier of the renewal of the agreement or September 22, 2014. Changes to the HIPAA privacy notice require more immediate action. The final regulations require material modifications to the HIPAA privacy notice; therefore, the revised notice must be posted on the group health plan’s website by September 23, 2013 (and should be delivered to participants at the next annual mailing). If the group health plan does not have its own website, the notice must be delivered to participants by November 23, 2013. Plan sponsors should now be taking the necessary steps, while there is still time, to ensure that their group health plans’ HIPAA compliance documents timely satisfy the requirements of the final regulations.