When a Final Rule is published, it is unlikely Covered Entities will have to comply with it immediately. When the original Privacy Rule Final Rule was published in 2002, Covered Entities were given a year to make systems, policies, and procedures HIPAA compliant. Small health plans were given two years. Consequently, if a Final Rule is published in 2023, OCR will most likely allow a similar period of time for Covered Entities to make the necessary adjustments.