The final rule related to HIPAA privacy and security became effective on March 26, 2013. Among other things, the final rule required certain changes to be made to business associate agreements. The final deadline for making these changes is September 22, 2014.
Health plans and business associates were required to comply with the rule by September 23, 2013. New contracts with business associates entered into on or after January 25, 2013 should incorporate the requirements of the rule.
Health plans and business associates (and business associate subcontractors) with contracts in effect on January 25, 2013, and which were not renewed or modified from March 26, 2013 through September 22, 2013, were allowed to continue to operate under those contracts until the earlier of:
- The date the contract is first renewed or modified on or after September 23, 2013*; or
- September 22, 2014.
See the Amend Business Associate Agreements reference material for more information.
*Contracts that renew automatically prior to September 22, 2014 without change or any other action on the part of the parties do not have to be modified as of the renewal date but can take advantage of the extension to September 22, 2014.