Impact on Health Sector Cyber, HIPAA Regs

With Donald J. Trump set to return to the White House in January to serve another four-year term as U.S. president, what might the healthcare sector expect to see when it comes to his next administration’s cybersecurity priorities and HIPAA regulations and enforcement?

See Also: Why Compliance Matters for Healthcare Industries

For one, don’t expect the Trump administration to support final changes that the Biden administration made this year to the HIPAA Privacy Rule aimed at enhancing the privacy of reproductive health information, experts said. The changes came in response to the 2022 Supreme Court ruling that overturned Roe v. Wade and the 50-year national right to obtain an abortion.

HHS’ 291-page final HIPAA Privacy Rule to Support Reproductive Health Care Privacy, which was published in April and went into effect in June, prohibits the use or disclosure of protected health information when it is sought to investigate or impose liability on individuals, healthcare providers, or others who seek, obtain, provide or facilitate reproductive healthcare that is lawful under the circumstances in which such healthcare is provided (see: HHS Beefs Up Privacy Protection for Reproductive Health Info).

“While it takes meaningful effort to reverse an existing regulation, I expect the Trump administration to downplay any compliance obligations stemming from the recent Dobbs-related changes to the Privacy Rule,” said privacy attorney Kirk Nahra of the law firm WilmerHale.

But some experts think the Trump administration will go even further.

“I expect that the 2024 updates to the Privacy Rule will be under attack on a number of fronts,” said privacy attorney Adam Greene of the law firm Davis Wright Tremaine.

“First, I do not expect the Trump administration to enforce it,” he said. “Second, in the Northern District of Texas case in which the Texas attorney general is challenging the lawfulness of the 2024 amendments, I expect the new administration to drop any opposition to the attorney general’s position – at least with respect to the reproductive health amendments.”

The Texas lawsuit filed in September by State Attorney General Ken Paxton against HHS Secretary Xavier Becerra and HHS Office for Civil Rights Director Melanie Fontes Rainer seeks to vacate the Biden administration’s 2024 update to the HIPAA Privacy Rule to enhance privacy protections for reproductive health data (see: Texas AG Hopes to Upend HIPAA Rules to Investigate Abortions).

Greene predicts the Northern District of Texas will vacate the 2024 amendments made by the Biden administration to the HIPAA privacy rule. “I expect the new administration to begin the process of proposing to delete the amendments,” he added.

But before Trump left office after his first term in January 2021, his administration also issued its own proposed changes to the HIPAA Privacy Rule. The Biden administration then left that rulemaking effort by the wayside (see: HHS HHS Reveals Proposed Changes to HIPAA Privacy Rule).

The Trump administration changes “are relatively uncontroversial, but have laid dormant as the Biden administration focused on other priorities,” Greene said.

Nahra agreed. “I would expect the Trump administration to complete a long-delayed change to the privacy rule related to opioid disorders and social service organization, since that was initiated in the first term although was not a priority because of how long it took to get a proposed rule in place,” he said.

Enforcement Priorities

One top HIPAA enforcement priority kicked off by the first Trump administration’s HHS OCR leadership also remained a priority with Biden’s team: Enforcing HIPAA’s provision providing individuals with the right to access their health records. Since April 2019, HHS OCR has issued enforcement actions in 50 such cases (see: Dental Center Chain Settles Data Breach Lawsuit for $2.7M).

During Trump’s first term, HHS OCR was led all four years by attorney Roger Severino – a leader of The Heritage Foundation, a conservative think tank and the authors of Project 2025, an agenda document for the second Trump administration.

While headed by Severino, HHS OCR added an enforcement section to its organization focused on civil rights issues related to religious freedom and conscience.

“So, that effort may again be a priority – meaning that the existing sections on privacy and civil rights may actually get less attention,” Nahra predicts.

When it comes to other healthcare sector cybersecurity issues, some experts said the differences between Trump and Biden’s stances might be less clear.

“While the priorities related to privacy will likely differ significantly between the Biden administration OCR and Trump administration OCR, in my experience, cybersecurity is a non-partisan issue,” said regulatory attorney Sara Goldstein of law firm BakerHostetler.

Assuming that the second Trump administration has the same priorities as the first Trump administration, cybersecurity will likely be a focus and the new HHS leadership might opt to continue some of the work of the previous team with regard to cybersecurity initiatives, she predicts.

“Based on the actions of the OCR during Trump’s previous term, the OCR and other federal agencies will likely continue to work on implementing stronger cybersecurity practices in both healthcare and other industries,” she said.

The Biden administration last December issued a concept paper outlining ways to improve the healthcare and public health sector’s cybersecurity posture.

That plan included potentially mandating HHS cybersecurity performance goals – initially introduced as voluntary goals – into new requirements for hospitals – and possibly for other healthcare sector constituents later, which could be tied to Medicare payment incentives and penalties (see: Could New Cyber Regs Be In the Future for Clinicians?).

Biden’s plan included $1.3 billion in proposed funding in fiscal 2025 for financial help, such as grants, for hospitals to invest in cybersecurity over the next several years.

But the budget proposal also includes financial penalties in the form of reduced Medicare payments to certain hospitals that fail to meet cybersecurity standards, starting in fiscal 2029 (see: Feds Wave Sticks, Carrots at Health Sector to Bolster Cyber).

If the Trump administration were to also move forward with any new cybersecurity demands for the healthcare sector, resources to help entities would still be crucial, some experts said.

“Any cybersecurity mandates for hospitals need to be accompanied by funding to support those programs,” said Errol Weiss, chief security officer of the Health Information Sharing and Analysis Center.

“Historically, hospitals have been underfunded in cybersecurity, leaving organizations without the technology, and more importantly, the experienced cybersecurity people, to properly protect those networks,” he said.

“The funding should also support a virtual CISO program for hospitals that don’t have a full-time CISO, so they can properly build a strategic plan, implement an effective cybersecurity program and stay up to date on emerging threats and best practices.”

Another critical component of Biden’s cybersecurity plan for healthcare that will likely be dissected by Trump’s team also swings back to HIPAA: Updating the 20-year-old HIPAA Security Rule.

The Biden administration’s HHS OCR last month submitted a proposed HIPAA Security Rule update to the White House’s Office for Management and Budget for review, with plans to publish the notice of proposed rulemaking in December, with 60 days of public comment before issuing final rule (see: White House Reviewing Updates to HIPAA Security Rule).

If those plans to publish the NPRM in December stick, then clearly it will be up to Trump’s new HHS OCR leadership to decide what to do next with the rule – if anything – once public comment is gathered (see: What’s in Store for HIPAA Regulations).

“I am not aware of any particular views in the incoming administration on these issues but I would not expect them to move forward quickly on anything started by the Biden team,” Nahra said.

But Greene is a bit more optimistic. “I expect that HHS will release proposed updates to the HIPAA Security Rule in the next month that will include more detailed and stringent requirements,” he said. “The Trump administration is likely to review all proposed rules from the Biden administration with close scrutiny, but likely will proceed with finalizing changes to the Security Rule,” he said.

“I think there is bipartisan recognition of the need for increased cybersecurity efforts in the healthcare sector.”