Proposed Rule Change to Strengthen the Cybersecurity of Electronic PHI Updated Timeline
The Department of Health and Human Services (HHS) published a proposed rule change on January 6, 2025, to modify the “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information” (ePHI). These updates aim to enhance the cybersecurity of ePHI in response to the evolving healthcare environment, increasing cyberattacks, and observed compliance deficiencies.
While the updates were originally scheduled for May 2026, the final rule is now slated for July 2027.
Table of Contents
HIPAA Changes Resource
This comprehensive 125-page document provides detailed guidelines for the protection of PHI and ePHI. Here is a high-level summary of the key proposals that covered entities and Business Associates need to know (please read the proposal here for more details; https://www.govinfo.gov/content/pkg/FR-2025-01-06/pdf/2024-30983.pdf).
Key Proposed HIPAA Changes
Removal of "Addressable" vs. "Required" Standards: All implementation specifications are now mandatory, eliminating the previous flexibility in interpretation- Mandatory Documentation: Written documentation of all policies, procedures, plans, and analyses is required to ensure thorough and consistent compliance
- Technology Asset Inventory and Network Mapping: Entities must maintain an up-to-date inventory of technology assets and a network map illustrating ePHI movement. This inventory and map must be updated annually or as needed
- Enhanced Risk Analysis Requirements: The proposed rule specifies greater detail for conducting risk analyses, including identifying threats, vulnerabilities, and potential impacts on ePHI
- Regular Security Testing: Annual compliance audits, penetration tests, and biannual vulnerability scans are now required to ensure ongoing security and compliance
- Data Restoration Procedures: Entities must develop procedures to restore critical data within 72 hours, prioritizing the most critical data to minimize disruption
- Vendor Management: Entities are required to verify the security measures of business associates and contractors to ensure they meet the new standards
- Encryption and Multifactor Authentication: These measures are now explicitly required safeguards to enhance the security of ePHI
- Removal of Unnecessary Software: Entities must actively remove unused software and disable unused network ports to reduce potential vulnerabilities
Additional HIPAA Changes Points of Interest
Public Comment Period: Stakeholders have until March 7, 2025, to submit comments on the proposed rule. This is an opportunity for covered entities, business associates, and other stakeholders to provide feedback and suggestions- Tribal Consultation: The HHS is seeking input from Tribal governments on the proposed rule, indicating a commitment to inclusive consultation
- Impact on Small Entities: The proposed rule changes are expected to have a significant impact on small entities, including small healthcare providers and business associates. Key points include: Increased Compliance Costs: Small entities may face higher costs to comply with the new mandatory requirements, such as maintaining detailed documentation, conducting regular security testing, and implementing advanced security measures like encryption and multifactor authentication. Resource Allocation: Small entities might need to allocate more resources, both financial and human, to meet the enhanced cybersecurity standards. This could be challenging for organizations with limited budgets and staff. Operational Adjustments: The need to maintain an up-to-date technology asset inventory and network map, conduct comprehensive risk analyses, and verify the security measures of business associates may require significant operational changes.
- Compliance Timeline: The proposed rule outlines specific timelines for compliance to ensure that covered entities and business associates have adequate time to implement the new requirements: Public Comment Period: Stakeholders have until March 7, 2025, to submit comments on the proposed rule. Final Rule Publication: The final rule is expected to be published sometime in 2026. Grace Period: Once the final rule is published, there will be a six-month grace period for compliance, allowing entities time to adjust their policies and procedures to meet the new standards.
- Enforcement and Penalties: The proposed rule includes detailed enforcement mechanisms and potential penalties for non-compliance: Enforcement Mechanisms: The Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) will oversee the enforcement of the new standards. This includes conducting audits and investigations to ensure compliance. Penalties for Non-Compliance: Entities that fail to comply with the new requirements may face significant penalties. The proposed rule emphasizes the importance of adhering to the standards to avoid fines and other enforcement actions. Increased Accountability: The proposed rule aims to enhance accountability by requiring detailed documentation of security measures and regular security testing. This ensures that entities are actively maintaining and improving their cybersecurity practices.
HIPAA Update
I recently checked the status of the proposed rule change and found that there are 4,747 comments on the proposal. This is a significant number. What I found profoundly interesting were the comments themselves. Most seem to support the changes, with many asking for additional modifications, including clearer language, which aligns with my own comments.
Some comments discuss the size and complexity of organizations, spreading myths that smaller organizations are not targets. My experience shows that criminals often have little knowledge about the organization, especially in ransomware situations. Additionally, whenever an organization makes the news, attacks tend to increase significantly. If you are a consultant, I encourage you to share your experiences. I have often responded to incidents where the victim organization believed they were too small to be targeted.
In reality, all healthcare organizations are entrusted with large amounts of data that need protection. They should be required to reasonably protect this data. While cost is a very real factor, I teach CEOs that security and profitability can coexist if we run a risk-based program.
If passed, we will have six months to implement the program. Contact JTS for assistance.
There are many ways to build a cybersecurity program based on the true needs of the organization. I have saved companies more than my service costs by looking at their organization through a risk-based lens.
If this rule is passed in 2026 and we have six months to implement the program, we have time to transition slowly. However, many companies come to me at the end of the timeline asking for a quick solution. My guess is this will happen again at some level. Start now; spreading the effort over time makes it much easier.
What should you do now to limit the impact of these HIPAA changes?
Conduct a comprehensive risk assessment: Look at all risks, from misdirected faxes to third-party software and hosted systems. Know each system's specific risks, how they are protected, and what vulnerabilities exist.- Check your backup processes: Test them thoroughly. If your business requires data within a day but recovery takes three weeks, you need a new strategy.
- Involve Executives: This is not just IT's job; it's everyone's responsibility, especially executives and doctors. A well-implemented strategy makes it easy for everyone to know their role.
- Start your documentation: Policies and procedures are critical to program success.
- Run vulnerability tests: This is a normal part of risk assessment and often reveals concerning issues. If systems are too fragile to test, this should be a major concern.
- Hold your vendors accountable: Test their security through simple tabletop exercises or validations.
- Set up "gold images": Ensure your systems are based on these standardized images.
- Remove local administrative rights: Control what can be installed and run on systems.
- Ensure basic protections: Implement antimalware, logging with remote storage and constant monitoring, identity and access management, etc.
Whether these changes happen or not, don't be the reason for more rules and regulations or become a breach victim. It's amazing how we can get a company to a good place with limited funds by building a strategic approach.
Ready to Prepare for the 2026 Proposed HIPAA Changes?
JTS Health Partners is ready to join you in preparation for the 2026 proposed HIPAA changes. Let our experienced team develop a plan to mitigate disruptions in your organization.
Leave a Reply