HHS has temporarily pulled a final breach notification rule until further consideration. The Interim Final Rule for Breach Notification for Unsecured Protected Health Information issued pursuant to the HITECH Act was published in the Federal Register Aug. 24, 2009 and became effective Sept. 23, 2009. After the 60-day public comment period, HHS is withdrawing the rule and intends to publish a final rule in the Federal Register in the coming months, according to a notice issued by HHS.

"This is a complex issue and the Administration is committed to ensuring that individuals’ health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur,” according to the notice.