One Week to Get Business Associate Agreements Executed Under HIPAA Omnibus Rule’s Grandfather Clause

On Jan. 17, 2013, the long-awaited HIPAA “Omnibus Rule” went on display at the Federal Register, finalizing changes to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules. Davis Wright Tremaine will issue a client alert next week with an analysis of the new rule. A copy of the rule can be found here.

While the new rule establishes a compliance date of Sept. 23, 2013, it includes up to a one-year extension for covered entities and business associates to revise their business associate agreements if such agreements were entered into and compliant with HIPAA as of Jan. 25, 2013, the expected date of formal publication of the new rule in the Federal Register.

The grandfathering provision under the new rule provides:

(1) If the parties have a HIPAA compliant agreement in place before Jan. 25, 2013, and the agreement is not renewed between March 26, 2013 and September 2013, then they can rely on that agreement until Sept. 23, 2014.

(2) If the parties don’t have a compliant agreement in place by Jan. 25, 2013, then they will need to enter into a compliant agreement by Sept. 23, 2013, which is a year earlier than for grandfathered agreements.

Under any scenario, if an agreement is renewed between Sept. 23, 2013 and Sept. 23, 2014, it must comply with the new rule. The benefit under scenario (1) is that, if it is not renewed during that period, then the parties have until Sept. 23, 2014 to revise it.

What does this jumble mean in practice? It means that if parties currently are working on a business associate agreement and execute it before Friday, Jan. 25, 2013, then they may not need to revisit it until Sept. 23, 2014. In contrast, if they execute it on or after Jan. 25, 2013, then the parties will want to either ensure that it complies with the new rule or plan on revising the agreement this year, no later than Sept. 23, 2013, to bring the agreement into compliance with the new rule.

If you have any questions, you may contact Adam Greene or Rebecca Williams. In addition, Davis Wright Tremaine will host a series of  webinars covering the new rule. The first two will be:

• “The Wait is Over: Overview of the HIPAA Omnibus Rule,” Friday, Jan. 25, 2013 at 10:00 a.m. Pacific/ 1:00 p.m. Eastern
• “The Brave New World of Business Associates,” Wednesday, Jan. 30, 2013 at 10:00 a.m. Pacific/ 1:00 p.m. Eastern

Invitations to both webinars are forthcoming.