The Joint Committee on Employee Benefits met Tuesday with representatives of OCR regarding the HIPAA privacy and security rules. We certainly appreciate the willingness of the OCR representatives to meet and discuss with us important issues facing employers and health plans. One of the issues we discussed was how to treat Business Associate Agreements entered into between January 25, 2013 and September 23, 2013. The final regulations allow for an extended transition period to revise and update Business Associate Agreements, entered into prior to January 25, 2013. However, the final regulations were silent on agreements newly entered into after that date. This led some covered entities taking the position that the general 6-month compliance date under the final regulations for general HIPAA changes did not apply to new Business Associate Agreements. OCR confirmed informally that the 6-month compliance deadline was in fact meant to apply to all changes, including those affecting Business Associate Agreements. Thus, Business Associate Agreements entered into between January 25, 2013 and September 23, 2013 are not required to be updated for the final regulations until September 23, 2013. However, from a practical perspective covered entities and business associates would probably want to enter into an already updated agreement during that time period, rather than entering into an old agreement, and then having to update it a few months later (i.e., by September 23, 2013).