HIPAA Glossary · Laws & rules
Omnibus Rule
The 2013 final rule implementing HITECH — direct business associate liability, the revised breach standard, and updated authorisation requirements.
Context
The Omnibus Rule is the single most important regulatory update since HIPAA's original rules. It made business associates directly liable for Security Rule compliance (previously only via contract), reversed the breach harm standard to a presumption-of-breach, and tightened authorisation requirements. Most of what practitioners experience as "the HIPAA rules today" is the post-Omnibus text.
Related terms
- HITECH Act — The 2009 law that strengthened HIPAA — created breach notification, extended direct liability to business associates, and set the four-tier penalty structure.
- Business associate — A person or organisation that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.