Section § 164.318Compliance dates for the initial implementation of the security standards

(a) Health plan. (1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.

(2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.

(b) Health care clearinghouse. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.

(c) Health care provider. A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.

HIPAA, the United States rules protecting health information, § 164.318

Text: 45 CFR Part 164, from the Electronic Code of Federal Regulations (eCFR) as it stood on 6 October 2026.