---
title: "45 CFR 160.104 HIPAA: Modifications"
canonical: "https://dposchool.com/hipaa/section/160.104"
source: "https://www.ecfr.gov/current/title-45/section-160.104"
source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR."
text_as_of: "2026-10-29"
language: "en"
publisher: "DPO School"
---

45 CFR 160.104 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart A: General Provisions

# 45 CFR 160.104 HIPAA: Modifications

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

## Official text

### 45 CFR 160.104(a)

**(a)** Except as provided in paragraph (b) of this section, the Secretary may adopt a modification to a standard or implementation specification adopted under this subchapter no more frequently than once every 12 months.

### 45 CFR 160.104(b)

**(b)** The Secretary may adopt a modification at any time during the first year after the standard or implementation specification is initially adopted, if the Secretary determines that the modification is necessary to permit compliance with the standard or implementation specification.

### 45 CFR 160.104(c)

**(c)** The Secretary will establish the compliance date for any standard or implementation specification modified under this section.

#### 45 CFR 160.104(c)(1)

**(1)** The compliance date for a modification is no earlier than 180 days after the effective date of the final rule in which the Secretary adopts the modification.

#### 45 CFR 160.104(c)(2)

**(2)** The Secretary may consider the extent of the modification and the time needed to comply with the modification in determining the compliance date for the modification.

#### 45 CFR 160.104(c)(3)

**(3)** The Secretary may extend the compliance date for small health plans, as the Secretary determines is appropriate.

## Source

Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.

Source credit: \[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 38019, May 31, 2002\]

[45 CFR 160.104 on eCFR](https://www.ecfr.gov/current/title-45/section-160.104)

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.104

Previous: [45 CFR 160.103 HIPAA: Definitions](https://dposchool.com/hipaa/section/160.103)

Next: [45 CFR 160.105 HIPAA: Compliance dates for implementation of new or modified standards and implementation specifications](https://dposchool.com/hipaa/section/160.105)

## For AI agents

- Machine-readable index: https://dposchool.com/hipaa/llms.txt
- JSON API: https://dposchool.com/hipaa/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents