HIPAA Omnibus Rule: What It Changed for Therapists

A lot of what a HIPAA-covered therapy practice does today traces back to one rulemaking: the Business Associate Agreement your software company signs, the four factors you weigh when an email reaches the wrong person, a client's right to an electronic copy of their record, and several lines in your Notice of Privacy Practices. That rulemaking is the Omnibus Rule HIPAA covered entities have had to follow since September 23, 2013.

This guide reads the rule itself (published in the Federal Register at 78 FR 5566 on January 25, 2013) and HHS's own pages, and explains what each change means for a therapist in private practice now. You'll get a practice checklist and a short review list for your Notice of Privacy Practices to copy. There's also a section on what came after 2013 that people often mix up with it: the 2024 reproductive health privacy rule, most of which a court vacated in 2025; the proposed Security Rule update; and the 2024 rule for substance use disorder records.

What the HIPAA Omnibus Rule is

The HIPAA Omnibus Rule is the final rule that HHS's Office for Civil Rights (OCR) published on January 25, 2013, under the title "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules." It's called omnibus because it put four rules in one document (78 FR 5566):

The HITECH Act changes to the Privacy, Security and Enforcement Rules, proposed in July 2010: business associates directly liable, tighter limits on marketing and fundraising, a ban on selling PHI without authorization, new client rights, and a revised Notice of Privacy Practices.
The HITECH penalty tiers, finalizing a 2009 interim rule.
The final Breach Notification Rule, which replaced the 2009 interim rule's "harm" threshold "with a more objective standard."
The GINA changes, which bar most health plans from using genetic information for underwriting.

The dates that matter:

Published:January 25, 2013, at 78 FR 5566 to 5702.
Effective:March 26, 2013.
Compliance date:September 23, 2013, for covered entities and business associates.
Older business associate agreements:an agreement signed before January 25, 2013 that met the earlier rules could run until it was renewed or modified, or until September 22, 2014, whichever came first (78 FR 5702). That grace period is long over.

The rule's changes are written into the HIPAA regulations at 45 CFR Parts 160 and 164, so when you read the current regulation you're reading Omnibus Rule text in many places. HHS's Omnibus rulemaking page links the rule and its press release.

The changes at a glance

Business associates and their subcontractors are directly liable.Every vendor that stores or handles client information for you needs a BAA, and your vendors need BAAs with their own vendors.
A breach is presumed.After any impermissible use or disclosure of unsecured PHI, you notify, unless a documented four-factor risk assessment shows a low probability that the information was compromised.
Electronic copies.If you keep records electronically, a client can ask for an electronic copy in the form they want, if you can readily produce it.
Paid-in-full restrictions.If a client pays in full and asks you not to tell their health plan, you must agree, with narrow exceptions.
Marketing and sale of PHI.Paid third-party marketing to clients, and selling PHI, need the client's written authorization.
New statements in your notice.Your Notice of Privacy Practices needed new statements in 2013, and more changes came due on February 16, 2026.
Tiered penalties.Penalties rise with culpability, and business associates face them directly.
GINA.Family history is genetic information and PHI; the underwriting ban applies to health plans, not to you.

1. Business associates and subcontractors became directly liable

Before 2013, a business associate's duties came mostly from its contract with you. The Omnibus Rule made business associates "directly liable for compliance with certain of the HIPAA Privacy and Security Rules' requirements" (78 FR 5566). OCR can now investigate and fine your vendor itself.

Three parts of the change matter most to a small practice:

Storing counts.A business associate is anyone who "creates, receives, maintains, or transmits" PHI on your behalf (45 CFR 160.103). HHS said a company that keeps PHI for you is a business associate "even if the entity does not actually view the protected health information" (78 FR 5572). The "conduit" exception is "a narrow one," meant for courier-type services such as the Postal Service and internet service providers that only carry data (78 FR 5571).
Subcontractors are business associates too.If your practice software company uses a hosting company that stores your notes, the hosting company is a business associate of the software company. Your vendor must have a BAA with it; you aren't required to sign one with the subcontractor yourself (78 FR 5573).
Direct liability has a defined list.HHS's fact sheet on direct liability of business associates names what OCR can enforce against a vendor, including impermissible uses and disclosures, failing to comply with the Security Rule, failing to report a breach to you, failing to provide an electronic copy as its BAA requires, and failing to sign BAAs with its own subcontractors.

What didn't change: you're still responsible. A covered entity is liable "in accordance with the Federal common law of agency" for the acts of its agents, and an agent can include a business associate (45 CFR 160.402(c)). Choosing a vendor without a BAA is your problem, not only the vendor's.

What a BAA must say. Since 2013, a BAA must require the business associate to (45 CFR 164.504(e)(2)):

use and disclose PHI only as the contract allows or the law requires;
use appropriate safeguards and comply with the Security Rule for electronic PHI;
report uses or disclosures the contract doesn't allow, including breaches of unsecured PHI;
make sure its subcontractors agree to the same restrictions;
make PHI available for clients' access, amendment and accounting requests;
make its books and records available to HHS;
return or destroy PHI when the contract ends, if feasible.

HHS published sample BAA provisions on the same day as the rule.

In a therapy practice, business associates usually include your practice software or EHR, your telehealth platform, your email provider if client email runs through it (see is Gmail HIPAA compliant), cloud storage and backups, online forms, a billing service, an answering service, and anyone who fixes your computer and can see client files. Another provider you send records to for a client's treatment is not your business associate. Our guide to HIPAA compliant telehealth platforms covers what to check before you sign up for video.

2. Breach notification: the "harm" test became a four-factor assessment

Under the 2009 interim breach rule, an impermissible disclosure was a breach only if it posed "a significant risk of financial, reputational, or other harm to the individual" (78 FR 5639). HHS said some people read that as "a much higher threshold for breach notification than we intended to set," and replaced it (78 FR 5641).

Since the Omnibus Rule, an impermissible acquisition, access, use or disclosure of PHI "is presumed to be a breach" unless you demonstrate "a low probability that the protected health information has been compromised," based on a risk assessment of at least four factors (45 CFR 164.402):

The nature and extent of the PHI, including the types of identifiers and the likelihood of re-identification.
The unauthorized person who used the PHI or received it.
Whether the PHI was actually acquired or viewed.
The extent to which the risk to the PHI has been mitigated.

The rule also removed an interim exception for limited data sets without dates of birth and ZIP codes (78 FR 5644), and said you may notify without doing the assessment at all (78 FR 5643). Three narrow exceptions remain: good-faith, unintentional access by your own workforce; an inadvertent disclosure between two people both authorized to see the PHI; and a disclosure where you believe in good faith the recipient couldn't have kept the information (HHS). Notification applies only to unsecured PHI, so a lost device encrypted to HHS's standard usually needs no notice. For factor 1, our list of the 18 HIPAA identifiers shows what counts as identifying.

An invented example, worked through. A therapist emails a client's intake summary, with name, date of birth, diagnosis and session dates, to another client with a similar name. The recipient replies that she opened it, then confirms in writing that she deleted it.

Nature and extent:fully identified, with a mental health diagnosis. This weighs toward compromise.
Recipient:a member of the public with no duty to protect it. This weighs toward compromise.
Acquired or viewed:yes, she opened it.
Mitigation:a written deletion confirmation helps, but it can't undo the reading.

On these facts it's hard to show a low probability of compromise, so the practice would notify. If the same email had gone to another covered provider's secure inbox and come back unopened with a written confirmation, the assessment could come out the other way. Write down your reasoning either way: the burden of proof is yours (45 CFR 164.414), and HIPAA documentation is kept for six years (45 CFR 164.530(j)).

The deadlines: notify affected clients without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404). Report breaches affecting fewer than 500 people to HHS within 60 days after the end of the calendar year, and breaches of 500 or more at the same time as you notify individuals, plus the media when more than 500 residents of a state are affected (45 CFR 164.406, 164.408). A business associate must notify you (45 CFR 164.410). For real cases against therapy practices, see our HIPAA violation examples.

3. Clients' right to an electronic copy of their record

The HITECH Act gave individuals a right to electronic copies of PHI in an electronic health record; the Omnibus Rule applied it to any PHI you keep electronically in a designated record set. If a client asks for an electronic copy, you must provide it "in the electronic form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to" by you and the client (45 CFR 164.524(c)(2)(ii)). Where possible, HHS expects "a machine readable copy" (78 FR 5631).

The rest of the access right, as the rule left it:

30 days.Act on a request within 30 days, with one 30-day extension if you tell the client in writing why and when you'll finish. The Omnibus Rule removed the old 60-day allowance for records kept off-site (78 FR 5637).
Sending a copy to someone else.The rule let a client direct you, in writing, to send the copy to a person they choose. In 2020 a federal court narrowed that: HHS says the court in Ciox Health v. Azar vacated the third-party directive beyond requests for an electronic copy of an electronic health record, and the fee limit no longer applies to requests to send records to a third party (HHS). A client's request for their own copy is unaffected.
Fees.You may charge a reasonable, cost-based fee covering only labor for copying, supplies for paper or portable media, postage, and a summary if the client agrees to one. HHS's fee FAQ lists what may and may not go into that fee, and says practices should give clients their copies without charge.
Unencrypted email, on request.HHS: "covered entities are permitted to send individuals unencrypted emails if they have advised the individual of the risk, and the individual still prefers the unencrypted email," and you aren't responsible for interception in transit after that (78 FR 5634).
Psychotherapy notes are outside the right of access.A request for them is an unreviewable ground for denial (45 CFR 164.524(a)(2)); progress notes are part of the record. Our guide to psychotherapy notes vs progress notes explains the line. State law may give clients more access.

In practice: decide now which formats you can produce (a PDF of notes and forms, an export from your software), how clients ask, and who watches the 30-day clock.

4. Restricting disclosures to a health plan when the client pays in full

Before 2013 you could decline any restriction request. Now you must agree to a client's request to restrict a disclosure to a health plan when both of these are true (45 CFR 164.522(a)(1)(vi)):

the disclosure is for payment or health care operations and isn't otherwise required by law; and
the PHI is solely about a service the client, or someone other than the plan on the client's behalf, has paid you for in full.

What HHS said in the rule's preamble:

A plan contract doesn't excuse you. "We would not consider a contractual requirement to submit a claim or otherwise disclose protected health information to an HMO to exempt the provider" (78 FR 5629).
Medicare works too. A beneficiary can refuse to authorize a claim and pay out of pocket; you must then restrict the disclosure to Medicare, and Medicare's limits on what you may charge still apply (78 FR 5628).
You may require payment in full when the client asks (78 FR 5630). If a payment bounces, make a reasonable effort to collect before you bill the plan.
It doesn't follow the client. HHS encourages providers to tell clients they must ask each provider separately (78 FR 5629).
You can't end it yourself. You can't terminate this kind of restriction on your own (45 CFR 164.522(a)(2)(iii)).

An invented example. A client with employer coverage asks to pay for every session herself so her plan never sees a mental health claim. Record the request and the date, flag the account so no claim goes out, take payment in full each session, and tell her that if she later sends a superbill to her plan herself, the plan will see what she sends.

5. Marketing and the sale of PHI

Marketing. Under HIPAA, marketing is a communication about a product or service that encourages people to buy or use it (45 CFR 164.501). The Omnibus Rule drew the line at money: if you receive "financial remuneration" from a third party whose product or service you describe, the communication needs the client's written authorization, and the authorization must say payment is involved (45 CFR 164.508(a)(3)). HHS treats "all subsidized treatment communications as marketing" (78 FR 5624). Face-to-face communications and promotional gifts of nominal value are exempt from the authorization requirement.

For a therapy practice:

Your own services aren't HIPAA marketing. Telling clients about your own health-related services, such as a new group, isn't marketing under the definition when no third party pays you to send it. Email consent rules and your ethics code still apply.
Paid recommendations are. If an app, a publisher or a wellness company pays you, by a fee or a referral payment, to recommend its product to clients by email or text, you need each client's authorization first.
Affiliate links in a client newsletter likely fall on the paid side. Ask a lawyer before you add them.

Sale of PHI. A covered entity or business associate "may not sell protected health information" without an authorization stating that the disclosure will result in payment (45 CFR 164.502(a)(5)(ii)). The exceptions include treatment and payment, public health, research at a cost-based fee, giving clients their own records, and "the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence." So selling your practice, records included, to another covered entity isn't a prohibited sale of PHI under HIPAA, though state law and your board's rules on record custody still apply. Selling or renting a client list to a vendor is a sale.

Fundraising. If you run a nonprofit clinic that raises funds from clients, each fundraising communication must offer a way to opt out (45 CFR 164.514(f)).

6. What the rule added to your Notice of Privacy Practices

HHS called its NPP changes "material changes" that required covered entities to revise their notices (78 FR 5625). A notice written before 2013 and never updated is out of date. The rule added these statements (45 CFR 164.520(b)):

What needs authorization. The notice must say that "most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures of protected health information for marketing purposes, and disclosures that constitute a sale of protected health information require authorization," and that other uses not described will be made only with authorization (78 FR 5624).
The psychotherapy notes statement is for practices that keep them. HHS: "covered entities that do not record or maintain psychotherapy notes are not required to include a statement" about them (78 FR 5624). If you keep separate psychotherapy notes, include it.
The paid-in-full restriction. A provider's notice must say you're required to agree to a restriction on disclosures to a health plan when the client pays in full.
Breach notification. A statement that you must notify affected individuals after a breach of unsecured PHI. HHS said "a simple statement" is enough (78 FR 5624).
Fundraising, only if you fundraise.

Providers don't need the GINA statement; it's for health plans that underwrite (78 FR 5668).

How you give out the notice didn't change for providers: give it to each new client by the first session and make a good-faith effort to get a written acknowledgment, post it at your office if you have one, and hand it to anyone who asks (45 CFR 164.520(c); 78 FR 5625). Two rules matter for online practices. If you have a website about your services, you "must prominently post" the notice on it. If the first service is electronic, such as a telehealth session booked online, you must send the notice electronically "automatically and contemporaneously" in response to the client's first request for service.

If you're building a practice website, put the notice on your launch list next to your booking page, because that page is where many clients first ask for a session. You can look at TranqBay's template practice sites and the booking page clients use at practice.tranqbay.health to see the steps a client takes before a first appointment.

The notice changed again after 2013: by February 16, 2026, covered entities that create or keep substance use disorder records protected by 42 CFR Part 2 had to add statements about them, and HHS revised its model notices of privacy practices in February 2026. More on that below.

A short Notice of Privacy Practices review list

Copy this and check your current notice line by line. A "no" is something to fix.

Wording to copy26 lines

NPP review for a therapy practiceDate reviewed:Reviewed by:

Required header, word for word: yes / noEffective date shown: yes / noExamples for treatment, payment, operations: yes / noOther uses without authorization described: yes / noPsychotherapy notes need authorization (if kept): yes / noMarketing needs authorization: yes / noSale of PHI needs authorization: yes / noOther uses only with written authorization: yes / noAuthorization can be revoked: yes / noRight to restrict; must agree if paid in full: yes / noRight to confidential communications: yes / noRight to a copy, including electronic: yes / noRight to amend: yes / noRight to an accounting of disclosures: yes / noRight to a paper copy of the notice: yes / noDuty to notify after a breach: yes / noHow to complain to you and to HHS: yes / noNo retaliation for complaining: yes / noContact name or title and phone number: yes / noPart 2 statements, if you hold Part 2 records: yes / noCompared with HHS's February 2026 model: yes / noPosted on your website: yes / noGiven at first session, acknowledgment kept: yes / no

7. Penalty tiers from the HITECH Act

The Omnibus Rule finalized four penalty tiers based on what the practice knew and how fast it fixed the problem (45 CFR 160.404). In 2013 the ranges per violation were $100 to $50,000, $1,000 to $50,000, $10,000 to $50,000, and at least $50,000, with a $1.5 million calendar-year cap for identical violations. HHS adjusts them for inflation every year. As listed in 45 CFR 102.3 after HHS's January 28, 2026 adjustment, the amounts per violation are:

Did not know, and with reasonable diligence would not have known: $145 to $73,011.
Reasonable cause, not willful neglect: $1,461 to $73,011.
Willful neglect, corrected within 30 days: $14,602 to $73,011.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294.

The regulation's yearly cap for identical violations is $2,190,294 in every tier. Since 2019, HHS has applied lower yearly caps of $25,000, $100,000, $250,000 and $1.5 million for the four tiers, "as adjusted for inflation," under a notice of enforcement discretion that is a policy, not a regulation.

The rule also changed enforcement. HHS will investigate any complaint when a preliminary review suggests possible willful neglect, and it no longer has to try informal resolution first (78 FR 5578). Business associates face the same tiers.

8. GINA: family history is protected health information

Under the rule, genetic information includes "the manifestation of a disease or disorder in family members" of the individual, in other words family medical history (45 CFR 160.103). A family history of depression on your intake form is genetic information and PHI. The rule bars health plans, other than long-term care insurers, from using or disclosing genetic information for underwriting (45 CFR 164.502(a)(5)(i)). Providers don't underwrite, so this adds no task for you beyond protecting family history like the rest of the record. Our therapy intake form guide covers what to ask.

Smaller changes worth knowing

Records of clients who have died. Information about a person who has been dead for more than 50 years is no longer PHI (45 CFR 160.103). You may share relevant information with family members or others who were involved in the client's care or payment before death, unless that goes against a preference the client expressed and you know of (45 CFR 164.510(b)(5)).
Authorizations. The rule made it easier to combine research authorizations. An authorization for psychotherapy notes can still be combined only with another psychotherapy notes authorization (45 CFR 164.508(b)(3)); our release of information form guide explains why that authorization goes on its own form.
The Security Rule now applies to business associates directly, so your vendors must do their own risk analysis and safeguards.

What changed after 2013, and what people confuse with it

Status as of October 25, 2026, read from the Federal Register, the eCFR (current to October 22, 2026), HHS's pages and the federal regulatory agenda.

2020: the Ciox ruling.A federal court vacated part of the Omnibus Rule's third-party directive, as described in section 3 (HHS).
2024: the reproductive health privacy rule, mostly vacated.HHS published it on April 26, 2024 (89 FR 32976), effective June 25, 2024, with compliance by December 23, 2024, and by February 16, 2026 for its notice changes. On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order "declaring unlawful and vacating most of" the rule (Purl v. HHS, No. 2:24-cv-00228-Z). For the notice, the court vacated only 45 CFR 164.520(b)(1)(ii)(F), (G) and (H); HHS says the other notice changes "remain in effect," with compliance required by February 16, 2026 (HHS). HHS's page says it "will determine next steps." We found no HHS rule on the vacatur in the Federal Register as of October 25, 2026, and the eCFR still prints the vacated paragraphs, so don't copy them into your notice from the eCFR.
2024: the Part 2 rule for substance use disorder records.Published February 16, 2024 (89 FR 12472), effective April 16, 2024, with compliance required by February 16, 2026. Part 2 applies to federally assisted programs that provide substance use disorder diagnosis, treatment or referral, and some of its rules reach HIPAA covered entities that receive Part 2 records. It allows a single client consent for treatment, payment and operations, applies HIPAA's breach notification and penalties to Part 2 records, and bars using the records in legal proceedings against the client without consent or a court order and subpoena. HHS says covered providers that create or keep Part 2 records must describe them in their notice (HHS). If you treat substance use, ask a lawyer whether you're a Part 2 program.
Proposed: the Security Rule update.HHS proposed it on January 6, 2025 (90 FR 898); comments closed March 7, 2025. The proposals include removing the distinction between "required" and "addressable" safeguards, encrypting all electronic PHI at rest and in transit with limited exceptions, multi-factor authentication, a technology asset inventory and network map, restoring critical systems within 72 hours, and a compliance audit at least every 12 months. HHS's page says "the current Security Rule remains in effect" (HHS). The federal regulatory agenda lists it as a long-term action with a final rule targeted for July 2027 (reginfo.gov). A target isn't a date, and no final rule had been published as of October 25, 2026.
Proposed: Privacy Rule changes from 2021.HHS proposed them on January 21, 2021 (86 FR 6446), including cutting the time to answer a records request to 15 calendar days and dropping the written acknowledgment of the notice. HHS held a Tribal consultation on the proposal on February 6, 2026 (91 FR 1481), and the regulatory agenda targeted a final rule for August 2026. None had been published as of October 25, 2026, so 30 days and the acknowledgment still apply.
Every year: penalty amounts.The figures in section 7 change each year in 45 CFR 102.3.

Omnibus Rule checklist for a therapy practice

Paste this into your compliance file and date it. Run it once a year and whenever you add a tool, hire someone or change your forms.

Checklist to copy35 lines

Omnibus Rule checklist for a therapy practiceDate:Completed by:

BUSINESS ASSOCIATESList of every vendor that holds client info: yes / noBAA signed or accepted for each one: yes / noEach BAA covers the Security Rule: yes / noEach BAA covers breach reporting to you: yes / noEach BAA covers subcontractors: yes / noNo client info in tools without a BAA: yes / no

BREACHWritten breach procedure: yes / noFour-factor risk assessment form ready: yes / noLaptops, phones and backups encrypted: yes / no60-day notice deadline in the procedure: yes / noLog of breaches under 500 people, sent yearly: yes / no

CLIENT RIGHTSHow clients request records, written down: yes / noElectronic formats you can produce, listed: yes / no30-day clock tracked for each request: yes / noCost-based fee policy: yes / noEmail risk warning for clients who want email: yes / noPaid-in-full restrictions recorded and flagged: yes / noPsychotherapy notes kept separate, if kept: yes / no

MARKETING AND SALE OF PHINo paid third-party promotions without authorization: yes / noNo client lists sold, rented or traded: yes / no

NOTICE OF PRIVACY PRACTICESIncludes the 2013 statements: yes / noUpdated for February 2026, where needed: yes / noPosted on your website and at your office: yes / noAcknowledgment kept for each new client: yes / no

TRAINING AND RECORDSYou and any staff trained on this list: yes / noPolicies and assessments kept six years: yes / no

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. In Omnibus Rule terms, TranqBay is a business associate when it handles client information for a therapist who is a covered entity. Here is what that covers:

A BAA that applies when you accept the Terms. TranqBay's Business Associate Agreement applies automatically when a therapist who is a covered entity accepts the Terms of Service; there's no separate document to sign. It addresses the points the Omnibus Rule added: subcontractors that handle PHI must agree in writing to the same restrictions, a breach of unsecured PHI is reported "no later than 10 business days after discovery," and TranqBay won't sell PHI or use or disclose it for marketing. You can read TranqBay's Business Associate Agreement before you decide anything.
Video sessions that are end-to-end encrypted and HIPAA-ready, so sessions don't run on a consumer app without a BAA.
Client forms filled in online. A form library of ready-made templates, including intake, consent to treat, telehealth consent, release of information, PHQ-9 and GAD-7, that you send to a client for a session. The client fills them in online and the answers wait with the session. TranqBay doesn't score the measures automatically.
Session notes in one place, written from BIRP, DAP, SOAP or GIRP templates or as a blank note. The structured formats are part of the advanced note templates, which some plans include.
A practice website with online booking, so clients find you and book in one place.

TranqBay's BAA covers TranqBay. Your notice, your inbox, your phone and your other vendors are still on the checklist above.

Questions to take to a lawyer

Whether you're a covered entity at all, especially if you don't bill insurance.
Whether a paid referral, sponsorship or affiliate link counts as marketing that needs authorization.
How a paid-in-full restriction works with your plan contracts, state law and any Medicare enrollment.
Whether you hold Part 2 records or are a Part 2 program, and what your notice must say.
How to sell, merge or close a practice: record custody, client notice and state retention rules.
State laws stricter than HIPAA on records access, minors, breach notice and health data.
How the Ciox ruling applies to a request to send records to a third party.
Whether a specific incident is a reportable breach.

Frequently asked questions about the HIPAA Omnibus Rule

What is the HIPAA Omnibus Rule?

It's the final rule HHS published on January 25, 2013 (78 FR 5566) that put the HITECH Act and GINA changes into the HIPAA Privacy, Security, Breach Notification and Enforcement Rules, plus other changes. It made business associates directly liable, replaced the breach "harm" test with a four-factor risk assessment, expanded client rights, limited marketing and the sale of PHI, revised the Notice of Privacy Practices, and finalized the tiered penalties.

When did the Omnibus Rule take effect?

It took effect on March 26, 2013, and compliance was required by September 23, 2013. Some business associate agreements already in place could run until September 22, 2014.

What did the HIPAA Omnibus Rule of 2013 do?

It combined four rules: the HITECH changes to the Privacy, Security and Enforcement Rules; the HITECH penalty tiers; the final Breach Notification Rule; and the GINA ban on health plans using genetic information for underwriting.

Under the Omnibus Rule, what can clients request?

An electronic copy of PHI you keep electronically, in the form they ask for if you can readily produce it; a copy sent to someone they designate, now limited by the Ciox ruling; and a restriction on disclosures to their health plan when they pay in full, which you must agree to. They also have a right to be notified after a breach of their unsecured PHI.

Who does the Omnibus Rule apply to?

Covered entities (health plans, clearinghouses and health care providers who conduct standard electronic transactions, such as billing insurance electronically) and their business associates, including subcontractors. If you're unsure whether you're covered, see who HIPAA applies to.

Is the Omnibus Rule the latest update to HIPAA?

It was the last broad update, but not the last change. The 2024 notice changes for Part 2 records came due on February 16, 2026, most of the 2024 reproductive health rule was vacated in 2025, the Security Rule update and the 2021 Privacy Rule changes are still proposals, and penalty amounts change every year.

Do I need a BAA with my vendor's subcontractors?

No. Your vendor needs a BAA with its subcontractors. You need a BAA with each vendor you work with directly.

Does the Omnibus Rule require encryption?

No. Under the current Security Rule, encryption is an addressable safeguard: you assess whether it's reasonable and appropriate and document your decision. But encrypted PHI that meets HHS's guidance isn't "unsecured," so a lost encrypted laptop usually needs no breach notification. The 2025 proposal would require encryption, with limited exceptions, if it's finalized.

Do I have to give clients their psychotherapy notes?

Not under HIPAA. Psychotherapy notes are excluded from the right of access, and a denial on that ground isn't reviewable. Progress notes are part of the record clients can get. State law can give clients broader access.

Before you update your notice

Start with two documents: your vendor list and your Notice of Privacy Practices. Check every vendor for a BAA, run your notice through the review list, and file both checklists with today's date. That covers most of what the Omnibus Rule asks of a small practice.

If you're also setting up the place clients find and book you, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

26 sources

Regulations 15HHS 10States 1

Laws and regulations15

U.S. Department of Health and Human Services10

State boards and laws1

26Reginfo.gov, regulatory agenda entry RIN 0945-AA22 (Security Rule)reginfo.govhttps://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22

Updated October 25, 2026. Found it useful? Send it to a colleague.