On January 25, 2013, HHS published sample business associate agreement provisions on its website to help covered entities and business associates comply with the requirements of the HIPAA Omnibus Final Rule, which was released on January 17, 2013 and published in the Federal Register on January 25, 3013. Part of the Omnibus Final Rule revised the HIPAA compliance obligations for business associates and provided a transition period for updating business associate agreements that (i) were in effect prior to January 25, 2013 and (ii) have not been renewed or updated between March 26, 2013 and September 23, 2013. For these “qualified” pre-existing business associate agreements, the parties have until the earlier of the date the agreement is renewed or modified on or after September 23, 2013, or September 22, 2014 to come into compliance with the new business associate contract requirements. HHS has been clear that the recently published sample provisions are “only sample language[,] and use of these sample provisions is not required for compliance with the HIPAA Rules.” King & Spalding’s Client Alert, OCR Issues Long-Awaited Omnibus HIPAA/HITECH Rules, which discusses the provisions of the Omnibus Final Rule in detail, is available by clicking here. The HIPAA Omnibus Final Rule is available by clicking here.

Reporter, Susan Banks, Washington, D.C., +1 202 626 2953, sbanks@kslaw.com.