On January 17, 2013, the U.S. Department of Health and Human Services (HHS) issued a final rule under HIPAA making substantial changes to the rules for vendors that provide services to HIPAA-covered plans, such as third-party administrators, pharmacy benefit managers and certain brokers – known in the HIPAA world as “Business Associates.” Under this final rule, Business Associates are required, for the first time, to comply with the HIPAA Security Rule, many provisions of the HIPAA Privacy Rule and are subject to direct enforcement by HHS. As a brief reminder, and as we discussed in our Employee Benefits Update 2013 End of Year Plan Sponsor “To Do” List Part 2 – Health and Welfare, existing agreements with Business Associates must be amended to comply with the requirements of this final rule on or before September 22, 2014.