Modifications to the rules require action by group health plan sponsors and their vendors, including revisions to policies and procedures and new privacy notices.

Protocol provides clues regarding areas of focus for ongoing HIPAA audits assessing compliance with the Privacy, Security, and Breach Notification Rules.