On this page
The HIPAA Omnibus Rule is the final rule HHS published on January 25, 2013 that wrote the HITECH Act's changes into the HIPAA Privacy, Security, Breach Notification and Enforcement Rules; it took effect March 26, 2013, and covered entities and business associates had to comply "by September 23, 2013" (Federal Register). For marketing, it matters because it made business associates directly liable, tightened the limits on using PHI for marketing and banned the sale of PHI without authorization. Curve Compliance, a business associate that signs a BAA on every plan and strips PHI before data reaches an ad platform, checked each source below on November 2, 2026.
Book a call. Still running browser pixels on a healthcare site? Curve Compliance replaces them with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What the Omnibus Rule is
HHS describes it as "a final rule that implements a number of provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, to strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)" (HHS). HHS's own Security Rule summary calls it "the 2013 Omnibus Final Rule" (HHS). It is 78 FR 5566, and parts of it were first proposed on July 14, 2010 (Federal Register).
The Federal Register lists four rules in one. The first modified the Privacy, Security and Enforcement Rules for HITECH. The second adopted "the increased and tiered civil money penalty structure provided by the HITECH Act." The third finalized breach notification, replacing the old harm threshold "with a more objective standard." The fourth carried out the Genetic Information Nondiscrimination Act "to prohibit most health plans from using or disclosing genetic information for underwriting purposes" (Federal Register). For the 2009 law itself, see what the HITECH Act changed.
What the Omnibus Rule changed
| Change | What the rule says now | Source |
|---|---|---|
| Business associates directly liable | Business associates must comply with the Security Rule and the Privacy Rule provisions that apply to them, and OCR can enforce against them directly | HHS |
| Subcontractors | A business associate includes "A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate" | 45 CFR 160.103 |
| Paid marketing | Treatment and operations communications are not exempt from marketing when the covered entity receives financial remuneration from a third party | 45 CFR 164.501 |
| Sale of PHI | Banned without an authorization stating the disclosure will result in remuneration | 164.502(a)(5)(ii); 164.508(a)(4) |
| Breach standard | An impermissible use or disclosure is presumed to be a breach unless a risk assessment of at least four factors shows a low probability of compromise | 45 CFR 164.402 |
| Fundraising | Each fundraising message must offer "a clear and conspicuous opportunity to elect not to receive any further fundraising communications" | 45 CFR 164.514(f) |
| Out-of-pocket restrictions | A covered entity must agree not to disclose to a health plan, for payment or health care operations, care the patient paid for in full, unless the disclosure is required by law | 45 CFR 164.522 |
| Electronic copies | Patients can get PHI kept electronically in a designated record set in an electronic form and format they request, if readily producible | 45 CFR 164.524 |
| Decedents | PHI excludes information about a person deceased for more than 50 years; see whether HIPAA applies after death | 45 CFR 160.103; Federal Register |
Business associates: direct liability and subcontractors
Before HITECH and this rule, the Security Rule reached business associates only indirectly, through their contracts with covered entities (HHS). HHS's fact sheet says the 2013 rule "identifies provisions of the HIPAA Rules that apply directly to business associates and for which business associates are directly liable." The list includes "Impermissible uses and disclosures of PHI," "Failure to comply with the requirements of the Security Rule," failure to limit PHI to the minimum necessary, and "Failure to enter into business associate agreements with subcontractors that create or receive PHI on their behalf" (HHS).
The subcontractor change pushes the same duties down the chain. If an agency handles PHI for a clinic and uses a form tool or analytics vendor that creates, receives, maintains or transmits that PHI on the agency's behalf, that vendor is a business associate too (45 CFR 160.103), and the agency must get satisfactory assurances from it in a business associate agreement (45 CFR 164.502(e)(1)(ii); 164.504(e)(5)). Existing contracts got a transition: one that met the old rules "shall be deemed compliant until the earlier of" its renewal or modification on or after September 23, 2013 or September 22, 2014 (Federal Register). See what a business associate is and what a BAA must say.
Marketing: the financial remuneration rule
Marketing means "to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service." Treatment and health care operations messages are exempt, "except where the covered entity receives financial remuneration in exchange for making the communication." Financial remuneration "means direct or indirect payment from or on behalf of a third party whose product or service is being described" (45 CFR 164.501). When it is involved, "the authorization must state that such remuneration is involved" (45 CFR 164.508(a)(3)).
Two lines from the rule's preamble matter for digital teams. Paid communications by a vendor count the same way: where a business associate "receives financial remuneration from a third party in exchange for making a communication about a product or service, such communication also requires prior authorization from the individual." And the face-to-face exception is narrow: "communications made over the phone (as well as all communications sent through the mail or via email) do not constitute face to face communications" (Federal Register). A clinic's email describing its own health services falls under an exception to the marketing definition; an email the clinic is paid to send by a third party whose product or service it describes is marketing. For what an authorization must contain, see HIPAA marketing authorization, and for the full Privacy Rule, see the HIPAA Privacy Rule.
Sale of PHI
Omnibus added a flat ban: "a covered entity or business associate may not sell protected health information" except under an authorization. A sale is a disclosure where the covered entity or business associate "directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information" (45 CFR 164.502(a)(5)(ii)). The authorization "must state that the disclosure will result in remuneration to the covered entity" (45 CFR 164.508(a)(4)). Any arrangement where patient lists or patient data go to another company in exchange for value deserves a hard look before it starts.
Breach notification changes
The final rule replaced the interim rule's harm standard. Today an impermissible use or disclosure "is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised," based on at least four factors: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated (45 CFR 164.402). HHS's tracking bulletin applies the same presumption when PHI reaches a tracking vendor with no BAA and no Privacy Rule permission to disclose it (HHS). See the Breach Notification Rule.
What Omnibus means for ad tracking today
Three Omnibus ideas meet on a clinic's website. Tracking vendors that handle PHI are business associates: HHS says "tracking technology vendors are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function." Marketing needs authorization: "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures." And an impermissible disclosure of PHI to a vendor with no BAA is presumed a breach unless the regulated entity can show a low probability that the PHI was compromised (HHS). A federal court vacated one part of that bulletin in 2024, about unauthenticated pages; see what the court changed.
Ad platforms that won't sign a BAA can still receive conversions, as long as what reaches them is free of PHI; see which ad platforms sign a BAA. If you aren't sure what your pixels send today, book a call and Curve's team will walk through it with you.
How Curve Compliance helps
Under Omnibus, the vendors in your tracking chain carry their own HIPAA duties, and Curve Compliance is built for that role. Curve signs a BAA on every plan, replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. Whether a campaign counts as marketing under 164.501 depends on who pays for it, so talk to your counsel about specific programs.
Sources, checked November 2, 2026: HHS, Omnibus HIPAA Rulemaking; Federal Register, 78 FR 5566 (2013); HHS, Direct Liability of Business Associates; HHS, Summary of the HIPAA Security Rule; HHS, Use of Online Tracking Technologies; HHS, Regulatory Initiatives; eCFR, 45 CFR 160.103, 164.402, 164.501, 164.502, 164.504, 164.508, 164.514, 164.522 and 164.524; Federal Register, 90 FR 898 (2025).
Frequently Asked Questions
What is the HIPAA Omnibus Rule?
It is the January 25, 2013 final rule that wrote the HITECH Act's changes into the HIPAA Privacy, Security, Breach Notification and Enforcement Rules, effective March 26, 2013, with compliance required by September 23, 2013 (Federal Register).
What is the purpose of the HIPAA omnibus rule?
In HHS's words, to implement HITECH provisions "to strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)" (HHS).
What significant change did the Omnibus rule introduce regarding business associates?
It made them directly liable for parts of the HIPAA Rules, including impermissible uses and disclosures and Security Rule compliance, and made their subcontractors business associates too (HHS; 45 CFR 160.103).
What did the HIPAA Omnibus Rule of January 2013 do?
The Federal Register lists it: business associate liability; stronger limits on marketing and fundraising and a ban on selling PHI without authorization; rights to electronic copies and to restrict disclosures to a health plan for care paid in full; notice of privacy practices changes; tiered penalties; a new breach standard; and GINA protections (Federal Register).
Does the Omnibus Rule apply to marketing vendors?
Yes, when they create, receive, maintain or transmit PHI for a covered entity: they are business associates and directly liable for the provisions HHS lists (HHS). HHS says tracking technology vendors meet that test when they handle PHI for a covered function (HHS).
Is the Omnibus Rule still in effect?
Yes. Its changes are part of the current HIPAA regulations, such as the paid-marketing language in 45 CFR 164.501 and the breach presumption in 164.402 (eCFR; eCFR).
What is the new HIPAA rule in 2026?
HHS says compliance with the remaining notice of privacy practices changes "is required by February 16, 2026," and the Security Rule update is still a proposed rule, published January 6, 2025 (HHS; Federal Register). See the new HIPAA rules in 2026.
Talk to Curve Compliance
Book a call. Need a tracking vendor that takes its business associate role seriously? Curve Compliance signs a BAA on every plan, strips PHI before data reaches an ad platform and shows what each platform received in Event Logs. Curve's team does the setup, typically live in about a week. Book a call with Curve.