The HIPAA Omnibus Final Rule is effective today, March 26, 2013.  Among the provisions effective today are changes to the HIPAA Enforcement Rule, including the increased enforcement duties of the U.S. Department of Health and Human Services Office of Civil Rights (OCR) and the increased civil money penalties structure.  Additional provisions of the Final Rule, including new requirements for covered entity fundraising and use of decedent health information, are also effective today.

Today’s effective date excludes Omnibus Rule provisions regarding extended business associate liability as well as various consumer rights. Although today is the Final Rule’s effective date, the compliance date for most of the rule is not until September 23, 2013. This means that covered entities and business associates are not required to be in full compliance with new regulations until September.  Regardless, HIPAA covered entities, business associates, and subcontractors should begin preparations now in order to ensure compliance by the compliance date.

Our full summary of the Omnibus Final Rule is available here.