U.S. HIPAA Administrative Simplification (2013 Omnibus Rule)

Why does it matter?

Before the Omnibus Rule, vendors that handled PHI for a covered entity answered mainly through their contracts. The rule made business associates directly liable for parts of the Privacy and Security Rules, replaced the breach “harm” threshold with an objective standard and set penalty tiers up to willful neglect.

Key benefits include:

• Business associates and subcontractors covered directly

The definition in 45 CFR 160.103 includes a subcontractor that creates, receives, maintains or transmits PHI for a business associate, and section 164.104(b) applies the standards to business associates where provided.

• A breach is presumed

An impermissible use or disclosure is presumed to be a breach unless a risk assessment shows a low probability that the PHI has been compromised (section 164.402).

• Stronger individual protections

Sale of PHI and marketing with remuneration need an authorization (section 164.508(a)(3) and (a)(4)), and a patient can restrict disclosures to a health plan for care paid in full out of pocket (section 164.522(a)(1)(vi)).

• Genetic information protected

A health plan, except a long-term care issuer, may not use or disclose genetic information for underwriting (section 164.502(a)(5)(i)).

• Penalties by level of culpability

Section 160.404(b)(2) sets four tiers, from a violation the entity did not know about to willful neglect not corrected within 30 days.

How does it work?

The HIPAA Rules sit in 45 CFR Part 160, which holds the general provisions and enforcement, and Part 164, which holds the Security Rule (subpart C), the Breach Notification Rule (subpart D) and the Privacy Rule (subpart E). The Omnibus Rule amended all of them, and covered entities and business associates apply them to PHI in any form, or to electronic PHI under the Security Rule.

A business associate needs a written contract that meets sections 164.504(e) and 164.314(a), and it needs the same kind of contract with each subcontractor (section 164.308(b)(4)). An older contract was deemed compliant until it was renewed or modified after September 23, 2013, or until September 22, 2014, whichever came first (section 164.532(e)).

After a breach of unsecured PHI, a covered entity notifies affected individuals without unreasonable delay and within 60 calendar days of discovery. For a breach involving more than 500 residents of a state it also notifies prominent media outlets (section 164.406) and HHS. For a breach of fewer than 500 people it keeps a log and reports to HHS within 60 days after the end of the calendar year (section 164.408(c)).

Key Elements

• Business associates and subcontractors

The business associate definition also names health information organizations, e-prescribing gateways, and persons that offer a personal health record on behalf of a covered entity (section 160.103).

• Breach risk assessment

A low probability of compromise must be shown from at least four factors: the nature and extent of the PHI, the person who used or received it, whether it was actually acquired or viewed, and the extent of mitigation (section 164.402).

• Authorizations and individual rights

The rule covers marketing and sale of PHI (section 164.508), fundraising opt-out (section 164.514(f)), electronic copies of records (section 164.524), restrictions for out-of-pocket care and revised notices of privacy practices (section 164.520).

• Genetic information and decedents

Genetic information may not be used for underwriting (GINA, section 164.502(a)(5)(i)), and PHI of a deceased person is protected for 50 years after death (section 164.502(f)).

• Student immunizations

A provider may disclose proof of immunization to a school that the law requires it to have, if a parent, guardian or the adult student agrees and the provider documents the agreement (section 164.512(b)(1)(vi)).

• Enforcement tiers

As adjusted on January 28, 2026, per-violation penalties are $145 to $73,011 when the entity did not know, $1,461 to $73,011 for reasonable cause, $14,602 to $73,011 for willful neglect corrected within 30 days, and $73,011 to $2,190,294 for uncorrected willful neglect (section 160.404).

What does it cover?

HIPAA applies to covered entities and their business associates, including subcontractors, that create, receive, maintain or transmit PHI. The statutory basis for the Omnibus Rule is the HIPAA Administrative Simplification provisions, the HITECH Act and GINA. OCR enforces the Rules, and its authority runs to both covered entities and business associates (section 160.402). The Privacy Rule protects PHI in any form, and the Security Rule protects electronic PHI.

What are its objectives?

The Omnibus Rule states a set of aims in its summary.

Implement the HITECH Act changes that strengthen privacy and security protection for individuals' health information.

Replace the breach notification “harm” threshold with a more objective standard.

Strengthen privacy protection for genetic information as GINA requires.

Increase flexibility for and decrease burden on regulated entities.

Harmonize certain requirements with the Human Subjects Protections regulations.

Framework in Context

The 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 Fed. Reg. 32976) was vacated by the Northern District of Texas on June 18, 2025 in Purl v. HHS, except its changes to section 164.520 (apart from 164.520(b)(1)(ii)(F), (G) and (H)). The proposed Security Rule revision (90 Fed. Reg. 898, January 6, 2025) has no final rule in the Federal Register as of October 14, 2026. Public Law 116-321 also lets HHS weigh recognized security practices in penalties.

Common Framework Mappings

HIPAA is often mapped to other security and privacy frameworks to simplify compliance, reduce audit complexity, and support integrated risk management across healthcare and related sectors.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2