On Jan. 17, the Department of Health and Human Services (HHS) released “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules.” Among the changes are an increase in penalties to $1.5 million per year and allowing a patient the ability to insist a provider not share their patient-care records with their insurance company if the care is paid for by the patient out-of-pocket. Read a succinct summary of the 563-page rule on Dr. John Halamka’s blog.