Exploring the HIPAA Omnibus Rule

The HIPAA Omnibus Rule, enacted in 2013, strengthened privacy and security protections under HIPAA and expanded compliance obligations for business associates.

Key enhancements include:

• Making business associates directly liable for HIPAA compliance

• Expanding the definition of business associate to include more vendors and subcontractors

• Requiring updated Business Associate Agreements (BAAs) with enhanced provisions

• Strengthening privacy rights, including limitations on marketing and fundraising

• Revising breach notification requirements to promote greater transparency

For organizations managing HIPAA compliance today, the Omnibus Rule is integral, defining modern expectations for privacy, security, and breach response.

Aligning Omnibus Rule compliance with broader efforts under SOC 2 and ISO 27001 helps organizations manage risk consistently across their extended vendor ecosystem.