45 CFR § 164.318
Compliance dates for the initial implementation of the security standards
April 14, 2021
(a) Health plan.
(1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.
(2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.
(b) Health care clearinghouse. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.
(c) Health care provider. A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.