Modifications to the rules require action by group
health plan sponsors and their vendors, including revisions to
policies and procedures and new privacy notices.
On January 17, the Office for Civil Rights of the U.S.
Department of Health and Human Services (HHS) released final
regulations under the Privacy Rule, the Security Rule, and the
Enforcement Rule under the Health Insurance Portability and
Accountability Act (HIPAA) and the Breach Notification for
Unsecured Protected Health Information Rule (Breach Notification
Rule) under the Health Information Technology for Economic and
Clinical Health (HITECH) Act.1
The final rules are effective on March 26, 2013, and covered
entities and business associates generally must comply with the
applicable requirements by September 23, 2013. Employer group
health plan sponsors and the business associates that service them
will be impacted by several modifications under the new rules, as
described below.
