It is being widely reported that the HIPAA/HITECH Act Omnibus Final Rule will be issued in March 2012. This omnibus rule is expected to include:
- A final breach notification rule.
- A final HIPAA Enforcement Rule, implementing changes mandated by the HITECH Act.
- A final rule implementing changes in the Privacy and Security Rules mandated by the HITECH Act, as well as other changes to the Privacy Rule proposed in July 2010.
- A final rule implementing changes to the Privacy Rule required by the Genetic Information Nondiscrimination Act.
The reported March 2012 date is based on the date set forth for the final rule in HHS’s Semiannual Regulatory Agenda (dated Fall 2011, but published February 13, 2012), as well as HHS’s Retrospective Regulatory Review January 2012 Update, which was also recently released. However, the March 2012 date may not be fixed. The Update noted that the draft final rule was to be sent to OMB for review (under Executive Order 12866) by early January 2012. Based on publicly released information concerning OMB reviews under the Executive Order, however, the rule does not yet appear to have been submitted to OMB for review. (Under Executive Order 12866, OMB has up to 90 days to review rules, and the review time may be extended beyond the 90 days.)
The HHS Semiannual Regulatory Agenda indicates that the Final Rule for HIPAA/HITECH Act Accounting for Disclosures is anticipated to be published in June 2012, although the January 2012 Update of HHS Retrospective Regulatory Review indicates mid- to late- 2012.