On August 24, 2009, the U.S. Department of Health and Human Services (“HHS”) published interim final regulations (the “Regulations”) implementing the security breach notification provisions of the Health Information Technology for Economic and Clinical Health Act (“HITECH”). The Regulations become effective September 23, 2009. HHS has indicated, however, that it will not impose penalties based on violations of the Regulations prior to February 22, 2010.