There is a lot of confusion among providers caused by therecent publication of new rules under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). On January 25, 2013, the HIPAA final omnibus rule (“Final Rule”) issued by the U.S. Department of Health and Human Services (“HHS”) was published in the Federal Register (78 FR 5565). The Final Rule is actually four rules rolled into one massive 523-page rule. The Final Rule changes the requirements necessary to protect the privacy and security of protected health information (“PHI”) under the HIPAA Privacy, Security and Enforcement Rules. The Final Rule strengthens protection for PHI and heightens breach-reporting obligations. For providers, it will require:

1. Revising Existing Notices of Privacy Practice

2. Revising Existing Business Associate Agreements

3. Requiring Business Associates to Execute Business Associate Agreements With Subcontractors