The 2013 HIPAA Omnibus Rule: business associates on the hook, a presumption of breach, and the penalty tiers every compliance program is built on

What it says#

The Omnibus Rule is one Federal Register document, 137 pages at 78 FR 5566 to 5702, that the Department of Health and Human Services describes as four final rules combined: the modifications to the Privacy, Security and Enforcement Rules required by the HITECH Act of 2009, the final version of the tiered civil money penalty structure first issued as an interim rule in October 2009, the final Breach Notification Rule replacing the August 2009 interim rule, and the changes to the Privacy Rule required by the Genetic Information Nondiscrimination Act. It took effect March 26, 2013, and covered entities and business associates had 180 days, to September 23, 2013, to comply with most of it. HHS estimated first-year compliance costs of $114 million to $225.4 million, the largest single item being new notices of privacy practices for about 700,000 covered entities.

The business associate provisions are what changed the vendor relationship. Business associates became directly liable for compliance with the Security Rule and with certain Privacy Rule requirements, rather than being bound only by contract with the covered entity. The definition grew to name health information organizations, e-prescribing gateways and other services that transmit PHI and require routine access to it, and personal health record vendors acting on a covered entity's behalf. It also reached down the chain: a subcontractor, defined as "a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate," is itself a business associate when that work involves creating, receiving, maintaining or transmitting PHI. The conduit exception survived but the preamble calls it narrow, meant for courier services like the Postal Service and their electronic equivalents; a conduit transports information and does not access it other than on a random or infrequent basis. Agreements in place before January 25, 2013 that were not renewed or modified between March 26 and September 23, 2013 were deemed compliant until they were next changed or until September 22, 2014, whichever came first.

The breach rule is the second pillar. The 2009 interim rule had required notification only where an impermissible use or disclosure posed a significant risk of harm to the individual. This rule removed that standard and wrote in a presumption: an impermissible use or disclosure is a breach unless the covered entity or business associate demonstrates through a risk assessment that there is a low probability the PHI has been compromised, considering at least four factors: the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; the unauthorized person who used the PHI or to whom it was disclosed; whether the PHI was actually acquired or viewed; and the extent to which the risk has been mitigated. The burden of proof sits with the practice, which must keep documentation sufficient to carry it. The three statutory exceptions remain: unintentional, good-faith acquisition or use by a workforce member within the scope of authority; inadvertent disclosure between people authorized to access PHI at the same entity; and a disclosure the entity has a good-faith belief the recipient could not reasonably have retained. Notice to individuals goes out without unreasonable delay and in no case later than 60 calendar days after discovery. HHS is notified at the same time for a breach involving 500 or more individuals, and otherwise on an annual log submitted no later than 60 days after the end of the calendar year; prominent media outlets are notified where more than 500 residents of a state or jurisdiction are involved.

The penalty tiers come third. The rule adopts the HITECH structure in a table: for a violation the entity did not know about and could not have known about with reasonable diligence, $100 to $50,000 per violation; for reasonable cause and not willful neglect, $1,000 to $50,000; for willful neglect corrected within 30 days, $10,000 to $50,000; and for willful neglect not corrected, at least $50,000; with all violations of an identical provision capped at $1,500,000 in a calendar year. HHS says in the same passage that it "will not impose the maximum penalty amount in all cases" and will set amounts based on the nature and extent of the violation and the harm. Those are the figures as published in 2013; check the current enforcement regulations in 45 CFR Part 160 before relying on a number.

The rest is a list of Privacy Rule changes an office feels at the front desk. Uses and disclosures for marketing and fundraising were tightened, and the sale of PHI without the individual's authorization was prohibited. Patients gained a right to receive an electronic copy of their electronic health information, and a right to restrict disclosures to a health plan about treatment they have paid for out of pocket in full. Covered entities had to modify and redistribute their notices of privacy practices. Proof of a child's immunization can go to a school with a parent's agreement rather than a signed authorization, family members can be given a decedent's information in defined circumstances, and PHI of a person dead for more than 50 years is no longer protected. Under GINA, most health plans may not use or disclose genetic information for underwriting.

Who it applies to#

A dental practice that submits claims or checks eligibility electronically is a covered entity, and every vendor that creates, receives, maintains or transmits its patients' information is a business associate: the practice management software company and whoever hosts it, the IT firm with remote access, a billing or collections service, an off-site records or shredding company. Each of those vendors' own subcontractors that touch the data are business associates too, and since this rule they answer to HHS directly, not only to you through the contract. The conduit exception is narrower than vendors tend to claim; the preamble ties it to entities that merely transport data and do not access it beyond a random or infrequent basis.

Your workforce, employees, volunteers and trainees under your direct control, are not business associates; their conduct is yours. A dentist who keeps paper records and never transmits a covered transaction electronically is outside HIPAA altogether, a situation that is rare enough now to be worth confirming rather than assuming.

What changed#

Before this rule, a business associate's obligations existed only in its contract with you, and a subcontractor two steps removed might have had none. The interim breach rule from 2009 let an office decide that a misdirected record posed no significant risk of harm and move on. The penalty tiers had been in force since the 2009 interim rule but the enforcement provisions for willful neglect had not been finalized. The Omnibus Rule closed all three gaps at once, and it added the patient rights, marketing and sale limits, decedent and immunization provisions and the GINA changes described above.

The practical shift was in the paperwork: new business associate agreements with subcontractor flow-down language, a documented four-factor risk assessment for every incident, and a revised notice of privacy practices. Those three documents are what an OCR investigation asks for first. This page will be updated if HHS finalizes further changes to the HIPAA Rules.

Where the source is#

The full rule, preamble and regulatory text, is on govinfo as the Federal Register issue of January 25, 2013, in HTML and PDF; the Federal Register site's document page links the docket and the CFR parts affected. The codified rules as they stand today are in 45 CFR Parts 160 and 164 on eCFR. HHS's Office for Civil Rights hosts its own summary page for the Omnibus Rule and sample business associate agreement provisions, but hhs.gov could not be reached from this environment when the entry was written, so those pages are not linked here; the OCR breach reporting portal is. All of it is public and free to copy.