Final HIPAA / Hitech Regulations Published: Subcontractors Are Required To Directly Comply With HIPAA

The long-awaited HIPAA/HITECH Final Rule is out! The Final Rule is effective March 26, 2013, but Covered Entities, Business Associates and Subcontractors will have 180 days beyond the effective date to come into compliance, which 180 days expire on September 23, 2013.

The HITECH Act made a big leap by expanding HIPAA’s reach to cover Business Associates directly. But the Department of Health and Human Services (HHS) has taken an equally big leap in now expanding HIPAA’s reach to directly cover Subcontractors, a change that was forecasted in the Notice of Proposed Rulemaking that was published in July 14, 2010. Subcontractors are now required to comply with HIPAA and the HITECH Act in the same manner as Business Associates, and are subject to liability and enforcement, including civil monetary penalties, for a failure to comply.