Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.


The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Tentative Schedule for Publication of HIPAA Administrative Simplification Regulations

The Department of Health and Human Services (DHHS) is planning to issue HIPAA regulations under the following schedule. The time from publication of the Notice of Proposed Rule Making (NPRM) to publication of the final rule is needed to review and respond to the large number of comments received on the NPRMs. (For example, we received over 17,000 comments on the Transactions and Code Sets NPRM alone.) Both the logistics of handling the large volume of comments, and the analysis of the issues raised by the comments affect the time it takes to develop a final rule. Once written, the final rules must be reviewed by the Department of Health and Human Services and a number of its subordinate agencies, as well as by several other Federal departments affected by the rules. This schedule is, of course, subject to change.

Where dates are missing, HHS has not yet set any specific target dates.

NPRMs Already Published:


NPRM Published

Expected Final Rule Publication

Expected Date Compliance Required*

Transactions and Code Sets 5/07/1998 Published August 17, 2000
Preamble | Regulation Text
October 16, 2002
National Provider Identifier 5/07/1998    
National Employer Identifier 6/16/1998    
Security 8/12/1998    
Privacy 11/3/1999 Published December 28, 2000
Preamble (in 3 parts) | Regulation Text
April 14, 2003


NPRMs in Development:


Expected NPRM Publication

Expected Final Rule Publication

Expected Date Compliance Required*

National Health Plan Identifier      
Claims Attachments      
National Individual Identifier On hold.

*Standards are required to be implemented generally within 2 years of the effective date of the final rule. (The effective date of the final rule is generally 60 days after its publication.) However, the effective date for the National Provider Identifier is likely to be delayed a few months to allow enough time for HHS to develop the system for implementing the identifier.