The long wait for the final HIPAA regulations just got longer. Earlier today, June 22, 2012, the federal Office of Management and Budget (OMB) announced that it has extended its review of the final HIPAA Privacy, Security, Enforcement, and Breach Notification Regulations.

The Department of Health and Human Services sent the final HIPAA regulations to OMB in late March, and OMB generally has ninety days to conduct its review. It was therefore expected that the regulations would be released in June.

The OMB regulation review period may be extended by thirty days by the Director of OMB or indefinitely by the head of the rulemaking agency. OMB has not indicated which type of extension is in effect for the HIPAA regulations. As a result, it is unknown when OMB will complete its review.

HHS revised the HIPAA regulations as a result of the 2009 HITECH Act. The Interim Final Breach Notification Rule was issued in August 2009. Proposed regulations regarding the Privacy, Security, and Enforcement Rules were issued in July 2010. The regulations impact numerous areas of HIPAA compliance, including business associates, marketing, fundraising, and breach notification. Text of these rules is available on the Bricker & Eckler HIPAA Resource Center.

We will continue to provide updates on the final HIPAA regulations.