The Omnibus Final Rule (Final Rule) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was issued in January 2013 and became effective on March 26, 2013 with a general compliance date of September 23, 2013. However, Covered Entities were given additional time to get their pre-Final Rule Business Associate Agreements (BAAs) in compliance. That compliance deadline is fast approaching on September 23, 2014.
If a Covered Entity or a Business Associate had a BAA that was entered prior to January 25, 2013 and has not been modified to comply with the Final Rule, those BAAs must be updated or amended to be in compliance with the additional requirements imposed by the Final Rule. Some of the changes include the definition of Protected Health Information (PHI), marketing practices using PHI, increased responsibilities for business associates and their subcontractors, and changes related to breaches.
Covered Entities and Business Associates need to update immediately to ensure that BAAs are in compliance with the Final Rule.
By Denise Bloch