What Is the HIPAA Omnibus Rule and Who Must Comply?

The HIPAA Omnibus Rule strengthened federal health privacy and security requirements by making business associates directly responsible for protecting health information and updating breach notification and patient-rights rules. It applies to covered entities and many vendors that handle protected health information (PHI) for them. Knowing which organizations and people are covered helps clarify when HIPAA duties apply—and when they do not.

What Is the HIPAA Omnibus Rule?

The HIPAA Omnibus Rule is a 2013 federal regulation that updated several parts of the Health Insurance Portability and Accountability Act (HIPAA). The U.S. Department of Health and Human Services (HHS) issued the rule to implement provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act and to make changes required by the Genetic Information Nondiscrimination Act (GINA).

Published as a final rule on January 25, 2013, the Omnibus Rule generally took effect on March 26, 2013. Covered entities and business associates had until September 23, 2013, to comply with most requirements. The rule amended the HIPAA Privacy, Security, and Enforcement Rules and revised the Breach Notification Rule.

“Omnibus” refers to the rule’s combination of changes addressing multiple HIPAA provisions. It did not replace HIPAA. Instead, it expanded and clarified obligations that apply to organizations handling PHI, including health care providers, health plans, health care clearinghouses, and many of their service providers.

What Did the Omnibus Rule Change?

The rule’s most consequential change was making business associates directly liable for certain HIPAA requirements. Before the changes, a covered entity generally relied on a written contract to require its business associates to safeguard PHI. The Omnibus Rule made those associates directly subject to specified HIPAA Privacy and Security Rule requirements and enforcement.

It also broadened the definition of business associate to include certain subcontractors that create, receive, maintain, or transmit PHI on behalf of another business associate. A chain of service providers can therefore have HIPAA responsibilities even when a subcontractor does not work directly with a hospital, insurer, or medical practice.

Other notable provisions included:

• Updated breach notification standards: The rule clarified how organizations assess whether an impermissible use or disclosure of unsecured PHI is a reportable breach.
• Limits on certain uses of PHI: It restricted the use of PHI for marketing and prohibited the sale of PHI without an applicable authorization or exception.
• Changes to patient rights: It addressed requests for electronic copies of health information and requests to restrict disclosures to health plans when a patient pays in full out of pocket.
• Genetic information protections: It generally prohibited health plans covered by HIPAA from using or disclosing genetic information for underwriting purposes.
• Enforcement updates: It implemented HITECH-related changes to civil monetary penalties and clarified liability for certain violations.

Who Must Comply With the HIPAA Omnibus Rule?

HIPAA compliance is not determined solely by whether an organization handles medical information. The central question is whether an organization is a HIPAA-covered entity or business associate, or whether a person is part of a covered entity’s or business associate’s workforce. Each category has different responsibilities.

Covered entities

HIPAA identifies three types of covered entities:

• Health care providers: Providers such as physicians, hospitals, dentists, pharmacies, psychologists, and nursing facilities are covered when they transmit health information electronically in connection with a transaction for which HHS has adopted a standard. Examples include electronic insurance claims and eligibility inquiries. A provider that does not conduct such standard electronic transactions may not meet HIPAA’s covered-entity definition based on provider status alone.
• Health plans: This category includes health insurers, health maintenance organizations, Medicare and Medicaid plans, employer-sponsored group health plans, and certain other plans that pay for health care. Some small, self-administered group health plans are excluded from the definition.
• Health care clearinghouses: These organizations process health information between nonstandard and standard formats or data content. A clearinghouse may receive information from a provider or plan and convert it into a format used for claims or other standard transactions.

Covered entities must follow the HIPAA Privacy, Security, and Breach Notification Rules as applicable to their operations. They are responsible for policies, workforce training, safeguards, patient-rights processes, and appropriate arrangements with business associates.

Business associates and their subcontractors

A business associate is generally a person or organization that performs a function or service for a covered entity involving the use or disclosure of PHI. Examples can include claims processors, billing companies, certain consultants, data-hosting providers, cloud service providers, and companies that provide electronic health record or document-management services.

Whether a particular vendor is a business associate depends on what it does and whether it creates, receives, maintains, or transmits PHI for a covered entity. A vendor does not become a business associate merely because it provides a product to a health care organization. For instance, a company that sells general office supplies without access to PHI is ordinarily not a business associate for that service.

The rule also reaches qualifying subcontractors. If a business associate hires another organization to perform work involving PHI, the subcontractor may itself be a business associate under HIPAA. This can apply even if the subcontractor only maintains encrypted PHI and does not hold the decryption key. Organizations should assess actual services and data access rather than relying only on a vendor’s label.

Business associates must comply directly with applicable HIPAA requirements, including relevant Security Rule safeguards and breach reporting duties. They must also enter into written agreements with covered entities, and subcontractors must enter into appropriate agreements with the business associates that engage them.

Workforce members

Employees, trainees, volunteers, and other people whose conduct is under an organization’s direct control may be members of its workforce for HIPAA purposes. Workforce members generally do not sign business associate agreements with their employer. Instead, the covered entity or business associate must establish appropriate policies, train staff, and apply sanctions when workforce members violate those policies.

Workforce members should access PHI only as permitted for their jobs, use approved systems, and report suspected incidents through established channels. Individual employees do not typically carry the same organizational compliance responsibilities as a covered entity or business associate, but their actions can create serious compliance and security risks.

Who Is Not Automatically Covered by HIPAA?

HIPAA does not cover every organization that collects health-related information, nor does it automatically protect every record that contains medical details. Employers acting in their role as employers are generally not covered entities simply because they hold employee health information. Employment records held by an employer in that role are excluded from HIPAA’s definition of PHI.

Similarly, many direct-to-consumer health apps, fitness trackers, and websites are not HIPAA-covered entities or business associates. Their status depends on their relationships and activities, not just the sensitivity of the information they collect. Other federal or state laws may still apply, including rules enforced by the Federal Trade Commission, state consumer privacy laws, and specific health-data statutes.

A health care provider’s patient records may be subject to HIPAA, while the same provider’s employment records about an employee may not be PHI under HIPAA. The legal role in which information is held matters. Organizations should not assume either that all health data is covered or that data outside HIPAA is unregulated.

Key Omnibus Rule Requirements in Practice

Business associate agreements

A covered entity generally must obtain satisfactory written assurances from a business associate through a business associate agreement (BAA). The agreement describes permitted uses and disclosures, requires appropriate safeguards, and establishes obligations for reporting incidents and breaches, supporting individual rights, and returning or destroying PHI when the relationship ends where feasible.

Business associates must also have written agreements with subcontractors that handle PHI. A BAA does not eliminate an organization’s own legal duties. Organizations should confirm that agreements reflect the actual services and data flows, keep them current, and monitor whether vendors follow applicable safeguards.

Breach notification

The Breach Notification Rule applies to breaches of unsecured PHI. Under the Omnibus Rule’s approach, an impermissible use or disclosure is generally presumed to be a breach unless the organization demonstrates, through a documented risk assessment, a low probability that the PHI was compromised or an exception applies.

The assessment considers at least four factors: the nature and extent of the PHI involved, including identifiers and the likelihood of re-identification; who received or used the information; whether the PHI was actually acquired or viewed; and the extent to which the risk was mitigated. Encryption that meets HHS guidance can render PHI unusable, unreadable, or indecipherable to unauthorized people and may affect whether notification is required.

When notification is required, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. Breaches affecting 500 or more residents of a state or jurisdiction also require notice to prominent media outlets serving that area. Covered entities must notify HHS; smaller breaches may be reported to HHS on an annual basis. Business associates must notify the covered entity as required by the rule and their agreement, so the covered entity can meet its deadlines.

Privacy, marketing, and sale of PHI

The rule placed tighter limits on certain uses and disclosures of PHI for marketing. When a communication involves financial remuneration to the covered entity from a third party whose product or service is being marketed, individual authorization is generally required, subject to regulatory exceptions. The definition of marketing and its exceptions are specific, so organizations should review the purpose, payment arrangements, and content of a proposed communication.

The sale of PHI generally requires an individual’s authorization, with exceptions specified in the Privacy Rule. Payment for certain permitted activities, such as some public health or research-related disclosures, does not necessarily constitute a sale. Because exceptions are detailed, organizations should not treat every payment involving PHI as either automatically allowed or automatically prohibited.

Individual rights and genetic information

When a covered entity uses or maintains electronic PHI in one or more designated record sets, individuals may request an electronic copy. The entity must provide the copy in the requested form and format if readily producible, or agree on a readable alternative. Applicable fee limits and timing rules also govern access requests.

An individual may also ask a health plan not to disclose information about a particular service to the plan for payment or health care operations if the individual, or someone other than the plan, pays the provider in full for that service and the disclosure is not otherwise required by law. The restriction does not apply in the same way to disclosures needed for treatment or other legally required disclosures.

For health plans covered by the relevant HIPAA provisions, genetic information is treated as health information and generally cannot be used or disclosed for underwriting purposes. The rule also addressed genetic information in the context of preexisting-condition exclusions, consistent with GINA and the applicable regulations.

How HIPAA Penalties Apply

The Omnibus Rule made business associates directly liable for certain violations and implemented HITECH changes to civil monetary penalties. HHS’s Office for Civil Rights (OCR) investigates complaints, conducts compliance reviews, and can pursue corrective action or civil money penalties. In appropriate cases, violations may also lead to other legal consequences under applicable federal or state law.

Penalty exposure depends on factors such as the nature and extent of the violation, the organization’s history, its level of culpability, and efforts to correct the problem. HIPAA’s penalty structure has been subject to statutory and regulatory changes, and amounts may be adjusted for inflation. A single fixed penalty figure should therefore not be treated as universally applicable to every case.

OCR may resolve matters through technical assistance, corrective action plans, or settlements, depending on the circumstances. A prompt response, documented risk analysis, effective training, and reasonable safeguards can support compliance, but they do not guarantee that a violation will be excused.

Practical Compliance Steps

Organizations can use the following steps to assess Omnibus Rule responsibilities:

1. Determine HIPAA status: Identify whether the organization is a covered entity, business associate, subcontractor, or none of these under the activities it performs.
2. Map PHI flows: Document what PHI is created, received, maintained, or transmitted, where it resides, and which employees and vendors can access it.
3. Review contracts: Identify required BAAs and subcontractor agreements, then confirm that their terms match actual services and legal obligations.
4. Assess safeguards: Conduct and document a security risk analysis, address identified risks, and maintain administrative, physical, and technical safeguards appropriate to the organization.
5. Prepare for incidents: Maintain a response process for suspected privacy or security incidents, including breach risk assessments, notification decisions, and required records.
6. Train the workforce: Provide role-appropriate training, communicate access rules, and establish a process for reporting concerns and applying sanctions.
7. Support individual rights: Maintain procedures for access requests, amendments, restrictions, and other Privacy Rule rights that apply to the organization.

HHS provides regulatory text, guidance, and tools through its HIPAA for Professionals website. The controlling requirements appear in the HIPAA regulations, including 45 CFR Part 160 and 45 CFR Part 164. Since applicability depends on organizational role, data flows, and specific activities, those sources—and qualified legal or compliance advice—can help resolve questions that a general overview cannot.