Last week, Sue McAndrew, deputy director for health information privacy at the Office of Civil Rights in the Health and Human Services Department, said that OCR was “quite far along” on its efforts to adopt a final rule implementing changes to the HIPAA regulations pursuant to the HITECH Act.  She added that she anticipated the rule “certainly by the end of the year.” McAndrew made the remarks at a HIPAA conference, sponsored by OCR and the National Institute of Standards and Technology.  Previously, OCR had indicated that the final rule would be published in March.

As we have previously reported, the proposed rule, released last July, contains sweeping changes to the privacy, security, and enforcement rules promulgated under HIPAA. In prior blog entries, we explored aspects of the proposed rule relating to marketing, clinical research, and the sale of protected health information that, if included in the final rule, are likely to have a significant impact on the business operations of pharmaceutical and other life sciences companies. (Although generally not regulated under HIPAA directly, such companies often have arrangements with entities that are covered entities or business associates under HIPAA.)