45 C.F.R. § 164.318 – Compliance dates for the initial implementation of the security standards.

(a) Health plan.
1. (1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.
2. (2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.
(b) Health care clearinghouse. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.
(c) Health care provider. A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.