Under the Trump administration, the proposed update to the HIPAA Security Rule – issued in the final weeks of the Biden administration – is likely to get trimmed but not totally cut, predicted regulatory attorney Sharon Klein of the law firm Blank Rome.
“That’s because the Security Rule clearly needs updating after 20 years,” she said (see: What’s in HHS’ Proposed HIPAA Security Rule Overhaul).
“The iPhone wasn’t even released when the Security Rule was first adopted. So, technology is certainly advanced but the law has not,” she said in an interview with Information Security Media Group.
“The original Security Rule mandated the what, not the how. So, for example, the old rule stated that patient data must be unreadable and masked in some way which was addressable, not required and that allowed for some flexibility and implementation. But the proposed new rule now requires encryption,” she said.
Indeed, all of the technology measures in the proposed rule are required, she said. “And while these measures are all good things proven to reduce unauthorized exposure of patient data, the issue is that these measures cost multi-millions of dollars and years to fully implement.”
The proposals, such as encryption, multi-factor authentication, and asset and inventory data classification will require organizations to launch complex change management plans to upend their current processes, she said.
“Community hospitals and small practitioners will be hard-pressed to afford these proposed security measures, which ultimately means increased costs passed on to patients and consumers,” she said.
Still, “the first 100 days of the new administration will be very telling. We predict the Security Rule proposal will be scaled back but not totally eliminated,” she said. “The Security Rule clearly needs updating after 20 years. But the scaling back is so that healthcare institutions will not have to do everything the new rule requires all at once, which is unrealistic and unaffordable.”
In this audio interview with Information Security Media Group (see audio link below photo), Klein also discussed:
- How regulated organizations need to step up their cybersecurity practices despite the uncertainty involving regulations under the Trump administration;
- Why the courts will have “more of say” on the enforcement and fate of certain regulations, such as changes to the HIPAA Privacy Rule for reproductive healthcare information, made by HHS under the Biden administration;
- State and federal cybersecurity regulations and legislation for the healthcare sector to watch, including measures involving consumer health data that falls outside of HIPAA’s umbrella;
- Critical issues involving the use of artificial intelligence in healthcare;
- Lessons emerging from the major cyberattacks and breaches last year in healthcare, including the ransomware attack on Change Healthcare.
Klein is a partner at Blank Rome and co-chair of the firm’s privacy, security and data protection group. She advises businesses on assessing and mitigating risks related to the privacy and security of personal data, ownership, and commercialization of data artificial intelligence; planning, drafting, and implementing privacy, security, and data protection policies and best practices; compliance with global, federal, and state privacy and security laws, regulations, and rules; data governance; and breach response, crisis management, and remedies for non-compliance. Klein is also certified as an information privacy professional by the International Association of Privacy Professionals.