Public Law 104-191 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was passed on August 21, 1996.
The Secretary of HHS is required by Sections 261 through 264 of HIPAA to make public guidelines for the electronic transaction, privacy, and public protection of health information. These are referred to as the Administrative Simplification provisions.
If Congress did not pass the law within three years of the enactment of HIPAA, the law requires the Secretary to issue privacy regulations covering individually identifiable health information.
Due to the lack of privacy legislation passed by Congress, HHS created a draft rule and made it available for public discussion on November 3, 1999. Over 52,000 public statements were submitted to the Department, and on December 28, 2000, the Privacy Rule, the final regulation, was issued.