On January 17, 2013, nearly 3 years after its initial proposed rule, the US Department of Health and Human Services (HHS) issued the long-awaited and much- anticipated HIPAA “omnibus” rule, extending the scope of the privacy law beyond providers to their business associates and subcontractors and adding increased penalties.1 Regulated entities must be in compliance with the new rules by September 22, 2013, although covered entities and business associates will have up to 1 year after the 180-day compliance date to modify existing contracts to comply with these revised rules. Oncology practices should begin examining their policies now to ensure a seamless transition to these new rules.