The Wait Is Over! HHS Finally Issues Revised HIPAA Privacy And Security Regulations

Nearly four years after the passage of the HITECH Act and its amendments to HIPAA, and nearly three years after it proposed regulatory amendments, the U.S. Department of Health and Human Services ("HHS") has finally issued major revisions to HIPAA's privacy and security regulations.

While we are still making our way through all 563 pages of the regulations and related regulatory comments (and will have a more detailed analysis shortly in this space), here are some of the highlights we (and the HHS press release) have noted so far:

• Many of HIPAA's privacy and security requirements will now directly apply to business associates;
• Business associates may also be liable for the increased penalties for noncompliance based on the level of negligence up to a maximum penalty of $1.5 million;