The objective of HIPAA was to allow workers to maintain health insurance coverage when they changed employers or had their employment terminated. This meant that health plans and health care providers would be transmitting health care information and most likely doing so in an electronic form. Congress sought to standardize the transmission of this information, with special attention given to the filing and remittance of claims.

With all this health care information zipping along the information superhighway, Congress was concerned that the wrongful dissemination of personal health care data was only a keystroke away so it authorized the Department of Health and Human Services (HHS) to issue regulations that would implement and govern this vast electronic exchange of information.

An overriding emphasis was placed on simplifying this process. You can guess what happened next. It took HHS until November 1999 to issue its proposed privacy rules that covered all oral and written exchanges of healthcare information as well as electronic transmissions. This lead to a landslide of 52,000 public comments on the proposed rules. In view of this, HHS published its "final" privacy regulations in December 2000.

The regulations took effect in April 2001 but all covered entities were given until April 14, 2003 to comply. With the change in presidential administrations, HHS then issued "proposed modifications" in March 2002. This lead to another 11,000 public comments. Then in August 2002, HHS issued its "final modifications." It is widely anticipated that these "modifications" will yet again be modified.