On July 8, 2010, the HHS released its proposed rule modifying the HIPAA Privacy, Security, and Enforcement Rules to implement the privacy, security, and certain enforcement provisions of the Health Information Technology for Economic and Clinical Health Act, included in the American Recovery and Reinvestment Act of 2009 (ARRA). The proposed modifications to the HIPAA Rules include provisions: extending the applicability of certain of the Privacy and Security Rules’ requirements to business associates of covered entities, establishing new limits on the use and disclosure of protected health information for marketing and fundraising purposes, prohibiting the sale of protected health information, and expanding individuals’ rights to access their information and to obtain restrictions on certain disclosures of protected health information to health plans. In addition, the proposed rule strengthens and expands HIPAA’s enforcement provisions. Importantly, HHS has stated that the new HIPAA regulations will not be enforced until 180 days after the final rule has become effective. Comments are due 60 days after publication. The official version will be published July 14, 2010.