View Rule

Statement of Need: The Office for Civil Rights will issue rules to modify the HIPAA Privacy rule to implement the privacy provisions in sections 13400-13410 of the Health Information technology for economic and clinical health Act (Title XIII of division a of the American Recovery and Reinvestment Act of 2009, Pub. L. 111-5). these regulations will improve the privacy and security protection of health information.

Summary of the Legal Basis: Subtitle D of the Health Information Technology for Economic and Clinical Health Act (Title XIII of the American Recovery and Reinvestment Act of 2009) requires the Office for Civil Rights to modify certain provisions of the HIPAA Privacy and Security Rules to implement sections 13400-13410 of the Act.

Alternatives: The Office for Civil Rights is statutorily mandated to make modifications to the HIPAA Privacy and Security Rules to implement the privacy provisions at sections 13400-13410 of the Health Information Technology for Economic and Clinical Health Act (Title XIII of the American Recovery and Reinvestment Act of 2009).

Anticipated Costs and Benefits: These modifications to the HIPAA Privacy Rule are intended to benefit health care consumers by strengthening the privacy and security protections that govern how their health information is used and disclosed by HIPAA covered entities and their business associates. The Agency believes that there may be costs associated with the regulations that will affect HIPAA covered entities and their business associates. These may include costs to redraft existing business associate contracts as well as for the training on new policies and procedures as a result of these regulations.