What’s in HHS’ Proposed HIPAA Security Rule Overhaul?

A proposed overhaul of federal cybersecurity regulations for the healthcare industry could mean difficult and expensive heavy lifting for many organizations, said experts.

See Also: Using the Netskope HIPAA Mapping Guide

The U.S. Department of Health and Human Services published on Friday plans for a massive renovation of the HIPAA Security Rule, the first major update in more than two decades. Among its proposals is to convert some high-level recommendations such as deploying encryption and multifactor authentication into requirements (see: White House Clears HIPAA Security Rule Update).

“It’s a fundamental rewrite of the Security Rule and an overall change in the entire direction of the rule,” said privacy attorney Kirk Nahra of the law firm WilmerHale.

“It goes from a process-oriented approach that was designed to allow the enormous variety of entities subject to the rule to adopt appropriate procedures in their specific situation to a much more regimented overall approach,” he said.

The long list of proposals include much more specificity about how to conduct security risk analysis. Regulators say industry performance of risk analysis has been a long-standing weakness, a point often made during breach investigations and compliance audits.

The proposal would require regulated firms to prepare an annual technology asset inventory and network map and require business associates to verify at least once every 12 months that they have deployed technical safeguards required by the rule. Any organization regulated by HIPAA would have to establish written procedures to restore the loss of relevant information systems and data within 72 hours.

“Many covered entities and business associates have plans to restore access to data as soon as possible,” said regulatory attorney Sara Goldstein of the law firm BakerHostetler.

“But in reality, it can sometimes take organizations much longer to restore due to unforeseen issues, and implementing a 72-hour requirement is likely not realistic for most covered entities and business associates, as it can take longer than that to confirm that an incident is contained and if access to systems is restored too quickly, there is a risk of a second incident occurring.”

The proposed rule update also calls for vulnerability scanning at least every six months and penetration testing at least once every 12 months; requires network segmentation; and mandates separate technical controls for backup and recovery of electronic-protected heath information and relevant electronic information systems.

The regulatory renovation comes as HHS has seen reports of large health data breaches increased by 102% between 2018 and 2023, and the number of individuals affected by those incidents explode by 1,002%, primarily because of increases in hacking and ransomware attacks. In 2024, one hacking incident alone – a ransomware attack on UnitedHealth Group’s Change Healthcare IT services unit – affected 100 million individuals.

HHS estimates that the first-year costs attributable to the proposed rule will total approximately $9 billion. “These costs are associated with regulated entities and health plan sponsors engaging in the regulatory actions” described in the proposal, HHS wrote. “For years two through five, estimated annual costs of approximately $6 billion are attributable to costs of recurring compliance activities,” HHS said.

“The costs to fulfill these provisions will be enormous,” said Errol Weiss, chief security officer of the Health Information Sharing and Analysis Center. “Where is the money coming from to pay for all this? It can’t be from future savings from avoided breach penalties. Financially strained healthcare providers, especially small rural hospitals, don’t have the resources to support these new proposals,” he said.

Any regulatory requirements like this will need to come with funding assistance so that healthcare providers can acquire the proper technology and, more importantly, recruit and retain experienced cybersecurity professionals to adequately protect their networks, Weiss said.

Regulators are underestimating the cost of compliance, particularly to small and medium size practices, charged regulatory attorney Iliana Peters of Polsinelli. “Given that this effort arguably results from President Biden, I wonder whether it will survive the next administration,” she said.

The proposed rule, which is slated for publication Jan. 6 in the Federal Register, will be open for public comment for 60 days. After assessing the comments, HHS OCR will decide how to move forward with a final rule. But with the Trump administration – and new HHS leadership coming into office later this month, the fate of the proposed rule is uncertain.