They are over 1500 pages long. They are substantially different than the rules proposed in November, 1999.
Patients have a right to access, copy and amend their records.
Compliance for companies doing interstate business is incrementally more expensive and difficult. This issue prevented Congress from reaching closure last time. Congress may act to modify these regulations through statute. Congress could act to extend the regulations to such business associates. Your due diligence of potential subcontractors must consider their privacy capabilities.