Jay P. Anstine (jay.anstine@bannerhealth.com) is the Area Compliance Program Director for Banner Health’s Western Region Rural Hospitals, based in Greeley, CO.

When the Health Insurance Portability and Accountability Act of 1996 (HIPAA)^[1] was passed, life was different. Email was still new, there were no text messages, and Mark Zuckerberg was 12. Since then, the timeline has changed—we average six years in between regulatory changes. For example, it took seven years (2003) for the Privacy Rule^[2] and nine years (2005) for the Security Rule^[3] to be introduced. Four years later, the Health Information Technology for Economic and Clinical Health Act^[4] provided the breach notification regulations, among other changes. Finally, in 2013, the Omnibus Final Rule^[5] was passed, further refining the privacy and security regulations. Given the seven years since the Omnibus Final Rule, are we due for another change? If so, what is likely to change? I’m no fortune-teller, but here are some thoughts.