The HIPAA Omnibus Rule changes, finalized on January 17, 2013 and enforceable beginning September 23, 2013, reshaped health privacy law by making business associates and their subcontractors directly liable to federal regulators, replacing the old harm-based breach standard with a presumption that any impermissible disclosure is a reportable breach, expanding patient control over electronic records and out-of-pocket services, and locking in a tiered civil penalty structure alongside new limits on marketing, the sale of health data, and the use of genetic information.1HHS.gov. Omnibus HIPAA Rulemaking2Public Health Reports. The HIPAA Omnibus Rule: Implications for Public Health Policy and Practice It was the most significant update to HIPAA since the statute’s original 1996 passage.
Business Associates and Subcontractors Became Directly Liable
Before 2013, a business associate that mishandled protected health information (PHI) could only be pursued contractually by the covered entity it worked for. HIPAA’s enforcement teeth stopped at the covered entity’s door. The Omnibus Rule closed that gap by making business associates directly answerable to HHS for violations of the Security Rule, for impermissible uses and disclosures of PHI, and for failing to report breaches.3HHS.gov. Direct Liability of Business Associates
The rule also extended the same treatment down the vendor chain. Subcontractors that handle PHI on behalf of a business associate are themselves treated as business associates under HIPAA. A cloud storage vendor holding records for a billing service that works for a hospital is now directly on the hook to HHS, not just answerable to the billing company. Business associates must sign written agreements with their subcontractors spelling out HIPAA obligations, and they must take reasonable steps to address any material breach of those agreements.3HHS.gov. Direct Liability of Business Associates
Breach Notification Was Rewritten
The pre-Omnibus rule only required notification when the covered entity concluded a breach posed a significant risk of financial, reputational, or other harm to the individual. That gave organizations broad discretion to decide no harm was likely and stay silent. The Omnibus Rule reversed the presumption. Every impermissible use or disclosure of unsecured PHI is now presumed to be a reportable breach unless a risk assessment demonstrates a low probability that the information was actually compromised.4HHS.gov. Breach Notification Rule
The risk assessment must evaluate at least four factors:5eCFR. 45 CFR 164.402 – Definitions
- The nature and extent of the PHI involved, including what identifiers were exposed and how easily individuals could be re-identified.
- Who received or used the information. An accidental disclosure to another covered entity looks different from data landing on a public website.
- Whether the PHI was actually acquired or viewed. An encrypted laptop recovered unopened poses less risk than one that was accessed.
- The extent to which risk was mitigated afterward, such as retrieving the data or obtaining assurances of destruction.
Notification Deadlines
Once a breach is confirmed, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. When a business associate discovers a breach, it must notify the covered entity, which handles individual notifications.4HHS.gov. Breach Notification Rule
Reporting to HHS depends on scale. Breaches affecting 500 or more people must be reported to the HHS Secretary within 60 calendar days of discovery. Smaller breaches can be logged and reported within 60 days after the end of the calendar year in which they were discovered.6HHS.gov. Submitting Notice of a Breach to the Secretary A breach affecting 500 or more residents of a single state or jurisdiction also triggers a separate obligation to notify prominent media outlets serving that area within the same 60-day window.4HHS.gov. Breach Notification Rule
Patients Gained New Rights Over Their Records
Electronic Copies
If a covered entity keeps PHI electronically, individuals now have the right to receive their records in an electronic format. Access must be provided within 30 calendar days of the request, with one 30-day extension available if the entity notifies the individual in writing.7HHS.gov. Individuals’ Right under HIPAA to Access their Health Information The right reaches all PHI in the designated record set, not just what sits in an electronic health record system. Paper records that can readily be scanned must be produced electronically on request.8HHS.gov. If an Individual Requests an Electronic Copy Fees for copies are limited to reasonable, cost-based amounts.
Restricting Disclosures for Out-of-Pocket Services
Previously, a provider could decline a patient’s request to keep treatment information from a health plan. The Omnibus Rule made one type of restriction mandatory. If you pay for a service entirely out of pocket and ask the provider not to share information about that service with your insurer, the provider must honor the request, provided the disclosure would have been for payment or healthcare operations and is not otherwise required by law.9HHS.gov. Under HIPAA, May an Individual Request That a Covered Entity Restrict How It Uses or Discloses That Individual’s Protected Health Information This gives patients real leverage when they want a specific visit, such as reproductive care, mental health treatment, or substance use counseling, kept off the insurer’s radar.
Selling PHI Was Prohibited, Marketing Was Tightened
The rule added a flat prohibition on the sale of PHI. A covered entity or business associate cannot receive payment in exchange for disclosing PHI without the individual’s written authorization, and “sale” is defined broadly to include any direct or indirect remuneration. Exceptions cover public health disclosures, research disclosures where only a reasonable cost-based fee changes hands, routine treatment and payment operations, transfers between a covered entity and its business associate under a written agreement, and giving individuals their own records.10eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information – General Rules
The definition of marketing also expanded. Any communication encouraging the purchase of a product or service now counts as marketing if the covered entity receives payment from a third party for making it. Written authorization is required for marketing uses of PHI, with narrow exceptions for face-to-face communications and promotional gifts of nominal value.11HHS.gov. Marketing Fundraising communications must include a clear, easy opt-out that costs the patient no more than a nominal amount, and once someone opts out the entity must stop contacting them for fundraising until they opt back in.
Genetic Information Was Barred From Underwriting
The Omnibus Rule folded protections from the Genetic Information Nondiscrimination Act into HIPAA’s Privacy Rule. Health plans are explicitly prohibited from using or disclosing genetic information for underwriting purposes, which includes eligibility decisions, premium calculations, and applying pre-existing condition exclusions.12HHS.gov. Genetic Information A health insurer cannot look at your genetic test results or family medical history to decide whether to cover you or how much to charge.
Civil Penalties Were Locked Into a Four-Tier Structure
The rule finalized the four-tier penalty framework that HITECH had created, tying the size of the fine to the violator’s level of culpability. The tiers apply equally to covered entities and business associates:
- Did not know: the entity was unaware of the violation and could not reasonably have known.
- Reasonable cause: the violation went beyond simple ignorance but was not due to willful neglect.
- Willful neglect, corrected within 30 days of discovery.
- Willful neglect, not corrected. HHS must impose a penalty in this category, with no discretion to waive.
Per-violation minimums, per-violation maximums, and annual caps rise across the tiers and are adjusted for inflation each year.13Federal Register. Annual Civil Monetary Penalties Inflation Adjustment In 2019, HHS issued a separate enforcement discretion notice that lowered the effective annual caps for the three less-culpable tiers, reserving the highest cap for uncorrected willful neglect. That enforcement discretion remains in effect.14Federal Register. Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties
Smaller Operational Changes
Research Authorizations
A single authorization form can now cover multiple research studies, and it can be combined with the informed consent document for a clinical trial. Researchers can also obtain authorization for future, not-yet-specified studies as long as the authorization describes the expected future use clearly enough that a reasonable person would understand how their information might be used.15HHS.gov. Research
School Immunization Records
Sharing a child’s proof of immunization with a school that requires it under state law no longer requires a formal signed authorization. A provider can act on oral or written agreement from the parent or guardian. The agreement must be documented, but a note in the medical record about a phone conversation is sufficient.16HHS.gov. Student Immunizations
Updated Notice of Privacy Practices
Every covered entity had to revise its Notice of Privacy Practices to reflect the new rules. At minimum, the updated notice must inform patients of the entity’s duty to notify them after a breach of unsecured PHI, explain that the entity must honor restriction requests for services paid entirely out of pocket, and disclose that marketing uses and any sale of PHI require the patient’s written authorization.17HHS.gov. Model Notices of Privacy Practices