Senate Confirms Trump Pick RFK Jr. to Lead HHS

The U.S. Senate on Thursday confirmed controversial nominee Robert F. Kennedy Jr. to lead the U.S. Department of Health and Human Services. The votes fell mostly along party lines, 52 to 48, with one notable Republican senator – Mitch McConnell – breaking ranks to vote against President Donald Trump’s pick for HHS secretary.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

Despite many hours of scrutiny by lawmakers during two recent Senate committee confirmation hearings, not much – if anything – is publicly known about Kennedy’s stance on health data privacy and cybersecurity issues, in contrast to his much discussed reputation as a vaccine skeptic and conspiracy theorist (see: Trump Picks Robert F. Kennedy Jr. to Head HHS).

“Our predictions are cloudy about how a RFK Jr. HHS will handle cybersecurity regulation or policy,” said Greg Garcia, executive director of the public-private Health Sector Coordinating Council.

Career officials at HHS since Trump’s inauguration have been directed to suspend external communications about policy or regulation during the transition review, so most likely they are as speculative about Kennedy’s positions on cybersecurity and related issues “as we in the health industry are,” Garcia said.

“I’m not aware of discussions about healthcare cybersecurity during his confirmation hearings or elsewhere, but if the default position of this administration is anti-regulation, perhaps they will take a hard look at the HIPAA security rule notice of proposed ruling making published in December,” Garcia said.

In the final weeks of the Biden administration, HHS’ Office for Civil Rights published a proposed update to the 20-year-old HIPAA security rule. The proposed regulations are open for public comment until March. 7 (see: What’s in HHS’ Proposed HIPAA Security Rule Overhaul?).

The proposals range from mandates for security controls such as encryption and multifactor authentication, to specificity about how to conduct security risk analysis, as well as a long list of other requirements.

Many HSCC members who have shared their views about the proposed regulations “are broadly concerned that compliance with this tome would be extremely costly, time consuming, wasteful and inefficient, and ultimately ineffective and distracting against the imperative of achieving actual cybersecurity,” Garcia said.

HSCC “will soon offer the government higher level principles that we believe will get us to a stronger cybersecurity posture than what this proposed regulation demands,” he said.

The College of Healthcare Information Management Executive – a professional association of healthcare CISOs and CIOs – is also “profoundly concerned” about the Biden administration’s proposed HIPAA Security Rule, said Chelsea Arnone, CHIME director of federal affairs.

“We are hopeful that the new HHS secretary will take our concerns seriously, rescind the proposal and collaborate with the healthcare sector to develop a more balanced approach,” Arnone said.

“It is critically important that HHS recognizes the substantial and meaningful cybersecurity investments that healthcare providers are already making. Future regulatory efforts should support these existing investments rather than imposing new, overly prescriptive regulations,” she said.

What’s Next for HIPAA?

The direction that HHS’ OCR will take with HIPAA regulatory and enforcement work also will depend upon who is named to lead the agency.

For now, until a new director is chosen, the agency is being headed by acting director Anthony Archeval, who previously served as director of the office of civil rights, diversity and inclusion at another HHS agency, the Health Resources and Services Administration. During most of the Biden administration, HHS OCR was led by Melanie Fontes Rainer under HHS Sec. Xavier Becerra.

“I expect the White House to set the HHS policy, regardless of who the HHS secretary is,” said regulatory attorney Paul Hales of the Hales Law Group.

During his confirmation hearings, Kennedy – who in past supported abortion rights – told lawmakers that his position now is the same as Trump’s, “that every abortion is a tragedy.”

How Kennedy’s apparently changed view on abortion might translate into HHS’ HIPAA regulatory and enforcement plans could play out in how HHS OCR supports – or doesn’t support – a final HIPAA privacy rule update that went into effect last June under the Biden administration providing enhanced privacy safeguards for reproductive health information (see: HHS Beefs Up Privacy Protections for Reproductive Health Info).

HHS’ 291-page final HIPAA Privacy Rule to Support Reproductive Health Care Privacy prohibits the use or disclosure of protected health information when it is sought to investigate or impose liability on individuals, healthcare providers, or others who seek, obtain, provide or facilitate reproductive healthcare that is lawful under the circumstances in which such healthcare is provided.

The Biden administration modified the privacy rule in response to the 2022 Supreme Court Dobbs v. Jackson ruling that overturned a national right to obtain an abortion.

But right now, 15 state attorneys general are trying to have a Texas federal court vacate the HIPAA privacy rule modifications, alleging the regulations are preventing the states from investigating child abuse and other potential crimes (see: 15 States Sue HHS to Drop HIPAA Reproductive Health Info Reg).

“Campaign rhetoric indicates HHS will use its enforcement discretion and neither investigate nor enforce reproductive health privacy violations,” Hales predicts.

In the meantime, state attorneys general retain authority to enforce HIPAA privacy protections for reproductive health information, Hales said.

That means that while attorneys general of those 15 states are trying to have the privacy rule vacated, attorneys general of other states could choose to enforce the updated regulations for reproductive health information safeguards.

As for the Biden administration’s December rulemaking proposal to update the HIPAA security rule, that faces intense challenges to survive in-tact, as well, some experts predict.

“Specific security rule modifications face strong opposition from the healthcare industry lobby. This year, HHS may make substantial changes before publishing the final security rule modifications,” Hales predicted.

“Strengthening cybersecurity protections across all sectors is crucial. Legislative initiatives and the work of executive agencies like the National Institute of Standards and Technology will lead cybersecurity development, and HHS will follow,” Hales said.

Regulatory attorney Rachel Rose said that based on HHS OCR’s activities during the first Trump administration, she expects HIPAA privacy and security rule enforcement will carry on under new HHS leadership for several reasons.

“Given the enforcement actions taken under the first Trump administration, as well as the increased threat landscape and the 2024 Change Healthcare breach, which adversely impacted a variety of providers’ revenue cycles, HIPAA enforcement of the Privacy Rule and Security Rule are likely to continue,” she said.

“Moreover, a cornerstone of HIPAA is to protect confidences between a covered entity – and a provider in particular – and a patient,” she said.

Other Health Sector Cyber Issues

Besides HIPAA related issues, Kennedy will face other healthcare cybersecurity regulatory matters as well.

When Kennedy dropped out as a candidate in the 2024 presidential race and endorsed Trump in exchange of a role in a second Trump administration, Trump said he had given Kennedy permission to “go wild on health.” Kennedy also had announced plans a major shakeup of the U.S. Food and Drug Administration, which he accused as being “corrupt” on public health issues.

But if Kennedy does move forward with major changes at the FDA, some experts doubt that the agency’s work in medical device cybersecurity – which has been intensifying in recent years – will get caught in the turmoil.

“I don’t think anyone wants to be blamed for causing the death of patients by repealing safeguards meant to ensure proper functioning and promoting cybersecurity to thwart attacks,” Rose said. “The reality is that medical device cybersecurity is a shared responsibility between patients, providers and device manufacturers.”

Others have similar assessments. “Given the level of importance that device security has in provider, patient and caregiver confidence in the healthcare system, we would expect Secretary Kennedy to continue support for the medical device cybersecurity advancements,” said Tom Leary, senior vice president and head of government relations and the Healthcare Information and Management Systems Society.

In addition, Leary said HIMSS hopes the Trump administration and Congress will “get on the same page” on cybersecurity policy and AI policy, including how it pertains to healthcare.

“Other parts of the world are actively engaged in modernizing policies that impact these two critical areas. The U.S. must pass meaningful legislation or be left with U.S. organizations following the legislative and regulatory frameworks designed in other capitals,” he said.

While Kennedy – and the rest of the Trump administration – settle in, it’s important the healthcare sector cybersecurity momentum is not significantly stalled, some experts said.

“Every four years there is a transition in the U.S. government, whether it is a new administration or existing one. There is turnover and some initiatives may be put on hold,” said Denise Anderson, president of the Health Information Sharing and Analysis Center.

“As a result, new staff and leadership have to be made aware of issues and partnerships within the sector, and actions can be temporarily placed on hold, slowed down, changed or eliminated as people come up to speed, she said.

Threat actors often take advantage of transitions within government to execute malicious activity, she said. “These situations perfectly illustrate where ISACs and sector coordinating councils bring value as steady, reliable industry communities who serve to make sure that critical infrastructure sectors like health remain resilient in the face of threats.”