On January 17, 2013, the Office for Civil Rights of the U.S. Department of Health and Human Services (HHS) issued the long-awaited omnibus final rule (the Rule) implementing changes in current regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), pursuant to the Health Information Technology for Economic and Clinical Health Act (HITECH Act). Most of the Rule finalizes numerous proposed regulations set forth in a proposed rule dated July 14, 2010 (the Proposed Rule), which focused on the HITECH Act but also addressed other HIPAA provisions. The Rule also finalizes a proposed rule issued in 2009 that implements the HIPAA-related genetic privacy provisions of the Genetic Information Nondiscrimination Act (GINA).

The changes in the 563-page Rule are far-reaching and significantly strengthen privacy protections for patient health information, while enhancing HHS’ ability to enforce such protections. The Rule is effective on March 26, 2013, but Covered Entities1 and Business Associates subject to the Rule (collectively, Regulated Entities) are not required to comply with most of the Rule’s provisions until 180 days later, which is September 23, 2013. Below we provide an Executive Summary of the Rule, followed by a more detailed discussion. We conclude with our recommendations for preparing to comply.