Vedder Price

Vedder Thinking | Articles HIPAA Omnibus Final Rule

Enforcement Action Following September 23 Compliance Deadline


Reader View

As of September 23, 2013, Covered Entities and Business Associates are expected to be in compliance with the HIPAA Omnibus Final Rule. To assist in its efforts to enforce HIPAA and respond to patient complaints of noncompliance, the Office for Civil Rights (OCR) is empowered to assess tiered penalties tied to corresponding levels of culpability and prescribed to initiate mandatory investigations or compliance audits in instances of willful neglect. In addition to the revised enforcement role of the OCR, there were several modifications made to the affirmative defenses available to Covered Entities and Business Associates under the Final Rule.

This bulletin (available for download below) discusses the following topics:

  • Mandatory Action for Willful Neglect
  • Tiered Penalties
  • Determining Number of Violations and Civil Monetary Penalty Amount
  • Affirmative Defenses
  • Disclosure of PHI

For more information about the Final Rule or compliance with HIPAA, do not hesitate to contact a member of the Vedder Price HIPAA Task Force or any other Vedder Price attorney with whom you work.


Christopher T. Collins


Kelly A. Starr


Kathryn L. Stevens


Gregory G. Wrobel