White House Clears HIPAA Security Rule Update

The U.S. Department of Health and Human Services is ramping up digital efforts to protect Americans in a year that’s witnessed hackers targeting sensitive patient data and major breaches at Ascension and UnitedHealth.

See Also: Using the Netskope HIPAA Mapping Guide

HHS is set to unveil a notice of proposed rulemaking requiring healthcare companies to encrypt data, conduct routine compliance checks and update certain cyber standards under the Health Insurance Portability and Accountability Act. The proposal would add new cybersecurity mandates and improve existing HIPAA security regulations, which has not seen a security update in over a decade (see: White House Reviewing Updates to HIPAA Security Rule).

“One of the most concerning and really troubling things we deal with is the hacking of hospitals, hacking of healthcare data,” said Deputy National Security Advisor for Cyber and Emerging Technologies Anne Neuberger. She added during a Friday media briefing that HHS is updating the security rule due to “chronic compliance deficiencies” across the sector that in allowed historic breaches like the Change Healthcare attack earlier this year, which experts say could cost UnitedHealth Group nearly $2.9 billion (see: Change Healthcare Attack Cost Estimate Reaches Nearly $2.9B).

“The cost of not acting is not only high, it also endangers critical infrastructure and patient safety,” Neuberger said. The White House estimates the updated security rule will cost $9 billion to implement in the first year, then $6 billion over the following four years.

HHS’ Health Sector Cybersecurity Coordination Center has been calling on healthcare organizations to enhance their defenses amid a surge in threats, issuing a series of recent alerts that highlight the growing sophistication and frequency of attacks. Living-off-the-land techniques that exploit existing systems are among the tactics making the sector increasingly vulnerable, experts say (see: Feds Warn Health Sector of an Array of Cyberthreats).

Millions of Americans received breach notification letters in 2024 from healthcare organizations like Change Healthcare, which first posted a substitute HIPAA breach notice on its website for affected organizations and individuals on June 20.

HHS did not immediately respond to requests for comment.