A New Decade Of HIPAA – What Can We Expect?

As the decade winds down, it's hard to believe that the HIPAA Privacy and Security Rules are almost twenty years old. It has been ten years since the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published the first breach notification rule – the one based on the harm standard. And the Omnibus Rule's "low probability of compromise" standard is almost seven years old! Regulators and regulated entities are heading into the new year and decade with a lot of momentum on some important issues. As we prepare to welcome 2020, we'd like to indulge in a bit of hindsight – as well as speculation – about what the new decade might hold for HIPAA-regulated entities.