2009 was a very busy year for rules and regulations and DataPath has compiled the most important changes of the year.

The year started out with a memorandum from the newly inaugurated President Obama’s Chief of Staff listing three requests: (1) that no proposed or final regulations be sent to the Office of the Federal Register (OFR) for publication in the Federal Register until reviewed and approved by an appointee or designee of President Obama; (2) that proposed or final regulations that have been delivered to OFR but have not yet been published in the Federal Register be withdrawn for further review and approval; and (3) that consideration be given to extending for 60 days the effective date of regulations that have been published but are not yet effective. This only delayed the 2009 activity, but did not decrease it.

• The U.S. Department of Health and Human Services (HHS) published two sets of final regulations modifying HIPAA's electronic transaction standards and code sets. (Jan. 2009)
  
• On February 4, 2009, President Obama signed into law the Children's Health Insurance Program Reauthorization Act of 2009, which extended and expanded the state children's health insurance program (CHIP).
  
• On July 29, 2009, the Federal Trade Commission (FTC) adopted the Extended Enforcement Policy: Identity Theft Red Flags Rule (16 CFR 681.1). This policy requires certain businesses and organizations to implement written identity theft prevention programs designed to detect the warning signs ("red flags") of identity theft in their day-to-day operations and to reduce the risk of identity theft. At first, the deadline for enforcement was delayed until November 2009, but later this delay was extended to June 2010.
  
• August 4, 2009, HHS announced that it has delegated to the Office for Civil Rights (OCR) authority under HIPAA to administer and enforce the security standards for the protection of electronic protected health information. (This authority had previously been delegated to the Centers for Medicare and Medicaid Services (CMS)).
  
• In August 2009, HHS and FTC issued final rules on health information breach notification requirements.
  
• FTS published final rules on health information breach notification published with a quick effective date. [Health Breach Notification Rule, 16 CFR Part 318, 74 Fed. Reg. 42961 (Aug. 25, 2009)]. (However, FTC announced it will not bring enforcement actions for failures to provide the required notifications until February 22, 2010.)
  
• The IRS issued final regulations on excise tax reporting and HSA comparability. [Treas. Reg. Secs. 54.4980B-2, 54.4980D-1, 54.4980E-1, 54.4980G-1, 54.4980G-3, 4.4980G-4, 54.4980G-6, 54.4980G-7, 54.6011-2, 54.6061-1, 54.6071-1, 54.6091-1, and 54.6151-1, 74 Fed. Reg. 45994 (Sept. 8, 2009)]
  
• The IRS issued guidance on expanding automatic enrollment and contributing unused leave amounts to 401(k) plans. [Rev. Ruls. 2009-30, 2009-31, and 2009-32 (Sept. 5, 2009); IRS Notices 2009-65, 2009-66, 2009-67, and 2009-68 (Sept. 5, 2009)]
  
• The DOL approved use of a summary prospectus to comply with ERISA Section 404(c). [DOL Field Assistance Bulletin 2009-03 (Sept. 8, 2009)]
  
• The Genetic Information Nondiscrimination Act of 2008 (GINA) released final rules addressing collection and use of genetic information and limiting scope of health risk assessments. [Interim Final Rules Prohibiting Discrimination Based on Genetic Information in Health Insurance Coverage and Group Health Plans, 74 Fed. Reg. 51664 (Oct. 7, 2009); HIPAA Administrative Simplification: Standards for Privacy of Individually Identifiable Health Information, 74 Fed. Reg. 51698 (Oct. 7, 2009)]
  
• A new law expanded FMLA leave rights for employees who are relatives of veterans and members of the Armed Forces. [National Defense Authorization Act for Fiscal Year 2010, Pub. L. No. 111-84 (Oct. 28, 2009)]
  
• The IRS delayed the effective date of electronic payment card guidance for transit expenses until 2011. [IRS Notice 2009-95 (Dec. 14, 2009)]
  
• The COBRA premium subsidy was extended from nine to fifteen months and the eligibility period was extended through February. [Department of Defense Appropriations Act for Fiscal Year 2010, Pub. Law No. 111-118 (Dec. 19, 2009)]