The Department of Health and Human Services (HHS) issued a notice of proposed rulemaking today to modify the Privacy, Security, and Enforcement Rules issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The proposed modifications to the HIPAA Rules issued today include provisions extending the applicability of certain of the Privacy and Security Rules’ requirements to the business associates of covered entities, establishing new limitations on the use and disclosure of protected health information for marketing and fundraising purposes, prohibiting the sale of protected health information, and expanding individuals’ rights to access their information and to obtain restrictions on certain disclosures of protected health information to health plans. In addition, the proposed rule adopts provisions designed to strengthen and expand HIPAA’s enforcement provisions.