The interim final rule for notifying individuals of a breach of unsecured protected health information was published in the Federal Register on Monday August 24, 2009.  The rule goes into effect on September 23, 2009. 

The Federal Register is available at: http://edocket.access.gpo.gov/2009/pdf/E9-20169.pdf

More information on the privacy rule is at: http:www.hhs.gov/ocr/privacy