When Congress passed HIPAA, it did not intend to constrain public health's data sharing in the same way as clinical or payers. In fact, HIPAA recognizes data sharing with public health as a matter of national priority and shields this function from its reach. However, a health department may offer services that bring it within HIPAA's purview, such as running a Children's Health Insurance Program or a laboratory that bills electronically. When this is the case, HIPAA requires all information and (...) departments be subject to HIPAA unless the public health authority chooses to hybridize. Health departments might re-assess their coverage and elect to become a hybrid entity, thereby restricting HIPAA to only where required and removing barriers to information sharing with communities. (shrink)

On January 25, 2013, theFederal Registerpublished the Department of Health and Human Services omnibus amendments to the Health Insurance Portability and Accountability Act Privacy, Security, Enforcement, and Breach Notification Rules. These modifications also include the final versions of the HIPAA regulation amendments mandated by the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act. Although the amended rules were effective on March 26, 2013, covered entities and their business associates have a compliance date of (...) September 23, 2013.It has been 10 years since the April 14, 2003 compliance date for the original HIPAA Privacy Rule. Despite HHS’ clarification of some issues by posting answers to frequently asked questions, there have been no significant amendments to the Privacy Rule since 2003. (shrink)