The HIPAA Privacy Rule applies to covered entities – health plans, health care clearinghouses, and most health care providers. After the HITECH Act, Business Associates (BAs) will also be required to comply with most of the HIPAA regulations¹. HIOs are Business Associates of covered entities under HIPAA, because HIOs handle health information on behalf of the health care providers participating in HIE. HIOs will have to comply with most of the HIPAA Privacy and Security regulations as of eight months after the final HIPAA regulations are published.

As Business Associates, HIOs will need to have extensive policies and procedures in place to comply with the HIPAA Privacy and Security regulations, and will have to have contracts in place with their subcontractors that receive health information. For example, HIOs will need to have policies that control how the HIOs will use and disclose health information and how they will implement patient rights. The eHI resources on this issue will assist.

In addition, Business Associates are presently required to comply with the HIPAA breach notification regulations. This requires HIOs to notify the covered entities participating in the HIO. The covered entities then are required to notify patients and HHS of a breach of health information if there is a significant risk of financial, reputation or other harm to the patients.

Finally, HIOs are required to comply with state privacy regulations. HIPAA only preempts state laws that are "contrary" to HIPAA, unless the state law is more protective of patient privacy. HIOs thus must be vigilant to their own state laws.