The HIPAA Omnibus Rule of 2013 is the final rule that took the HITECH Act's statutory changes and turned them into concrete operating requirements. If HITECH was the law that promised stronger HIPAA enforcement, the Omnibus Rule is what actually wrote those promises into the regulations that products comply with day to day.
Three changes from the Omnibus Rule matter most to a telemedicine vendor. It made business associates and their subcontractors directly liable for compliance with the HIPAA Security Rule, so liability now flows all the way down the chain of anyone who touches PHI. It changed the breach standard: rather than requiring proof of harm, an impermissible use or disclosure of PHI is now presumed to be a reportable breach unless a documented risk assessment shows a low probability that the data was compromised — a meaningfully more demanding default. And it tightened the rules around marketing communications and the sale of PHI, requiring authorization in more situations.
For a vendor sitting in the PHI chain, this is the rule that put you personally on the hook. Before Omnibus, a hospital's vendor could argue that compliance was the hospital's problem; afterward, the vendor carries direct regulatory liability of its own. The practical implications are that your Business Associate Agreements (BAAs) must extend downstream to your own subcontractors, and that your breach-assessment process must be built around the presumption-of-breach standard — you document why something was not a reportable breach, rather than assuming it wasn't. The common pitfall is running an informal "we'd have noticed harm" judgment instead of the structured risk assessment the rule actually requires to rebut the presumption.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
The HIPAA Omnibus Rule made business associates directly liable, so every video vendor and subcontractor in your stack now carries HIPAA duties. We wrote seven volumes covering the whole video stack; for products shaped by the Omnibus Rule start with Volume 7: compliance, vertical playbooks and serving infrastructure. Volume 3 covers WebRTC, CDNs and DRM, the parts most often run by third parties. Written by Nikolay Sapunov, CEO at Fora Soft.
Not sure which vendors in your video stack the HIPAA Omnibus Rule makes liable?
We will map every service that touches session media or PHI, flag where a BAA is missing and suggest compliant replacements where needed. 250+ video products shipped since 2005.
