As we reported in a
March 2009 Paul Hastings Stay Current, the fiscal stimulus package (the Act) included large-scale expansion of the health information privacy and security provisions that are part of the Health Insurance Portability and Accountability Act of 1996 (HIPPA). The specifics of these provisions have remained uncertain, pending further rulemaking and guidance from Health and Human Services (HHS). On August 19, 2009, HHS issued an interim health information breach notification rule that fills in some of the gaps in the Act. The interim final rule is effective September 23, 2009 and comments regarding the interim final rule may be submitted to HHS on or before October 23, 2009.