Omnibus Final Rule Issued on HIPAA/ HITECH Act: Significant Changes for ‘Business Associates’

The Final Rule expands the reach of the HIPAA Rules by clarifying that those who “maintain and transmit” protected health information on behalf of covered entities are subject to many of those rules as business associates of those covered entities. Moreover, certain subcontractors of business associates are now to be treated as business associates themselves. As a result, business associates and those subcontractors are required to enter into business associate agreements with each other, and those subcontractors will be responsible for HIPAA compliance not only under those contracts but also directly under the HIPAA Rules themselves. Finally, the Final Rule also changes a number of the mandated terms of business associate contracts and will require covered entities, business associates and subcontractors to revisit their existing agreements for compliance with the Final Rule’s new requirements.

The Final Rule takes effect March 26, 2013, and compliance generally is required by September 23, 2013. Business associate contracts that were in effect on January 25, 2013, and that complied with the HIPAA Rules in effect on that date, may qualify for an extension of the compliance deadline if those contracts are neither modified nor renewed between March 26 and September 23, 2013. Business associate contracts that do not qualify for the extension must be brought into compliance by September 23, 2013. After that date, contracts that do qualify for the extension must be brought into compliance when they are renewed or modified and in no event later than September 22, 2014.

Download: Omnibus Final Rule Issued on HIPAA/ HITECH Act: Significant Changes for ‘Business Associates’