While many of the proposed modifications to the HIPAA Security Rule are reasonable expectations, others will be extremely onerous to implement – especially within a short time frame – if federal regulators finalize the rule’s overhaul as it’s written today, said Samantha Jacques of McLaren Health and Stephen Goudreault of security firm Gigamon.
The proposed update to the HIPAA Security Rule was published in the final days of the Biden administration, and so far the U.S. Department of Health and Human Services’ Office for Civil Rights under the Trump administration has not yet indicated how it might move forward with the rulemaking (see: What’s In HHS’ Proposed HIPAA Security Rule Overhaul?).
The 393-page rule was open for 60 days of public comment, in which HHS received about 2,000 comments, many criticizing the proposals as being too staggering to implement.
“The business behind cybersecurity and the business behind trying to stop threat actors has to be a priority for the government, and so I understand why they made all of these recommendations around strengthening HIPAA,” Jacques said in an interview with Information Security Media Group.
“But let’s say all of this is agreed to lock, stock and barrel – any covered entity would have 180 days to actually implement all 400 pages of this document. Obviously that would be a huge lift,” she said. “There are massive number of things to implement in 180 days.”
That includes an exhaustive list of new requirements, ranging 24-hour deadlines to notify all business associates and partners whenever an employee with access to protected health information is terminated, to detailed implementation expectations around network segmentation and amendments to many other security standards.
Some of the proposed new requirements will be especially challenging for smaller entities that also need to catch up with basic security practices, Goudreault said in the same interview with ISMG.
“If you don’t really understand how your data is flowing, you’re probably going to have a disruptive segmentation rollout,” he said.
But despite the difficulties the proposed updated HIPAA rule might pose to many entities, finding ways to strengthen healthcare sector cybersecurity is critical, he said.
“We now live in a world where we have dedicated adversaries and state level threat actors that are financed by the state or allowed to operate openly. These are no longer kids or people in the basement and their primary 9 to 5 job is to make money off us and disrupt our institutions,” he said.
“We’re not doing it just for the sake of doing it. We’re doing it because it’s going to lead to better security outcomes or make us a harder target,” he said.
In the interview (see audio link below photo), Jacques and Goudreault also discussed:
- Requirements contained in the proposed rulemaking that entities should already be implementing or considering;
- Top security considerations when purchasing and implementing new technologies and devices in healthcare environments;
- Other federal developments that could significantly affect healthcare sector cybersecurity efforts.
Jacques, PhD, is the vice president of clinical engineering at McLaren Health. She manages medical devices throughout the McLaren system including 13 hospitals, ambulatory surgery centers, imaging centers, and Michigan’s largest network of cancer centers. Prior to McLaren, Jacques was at both Penn State Health and Texas Children’s Hospital. She is also vice chair of the Health Sector Coordinating Council cybersecurity task group.
Goudreault is cloud security evangelist at security firm Gigamon. He has more than 20 years of experience in networking, intrusion prevention and detection, deep packet inspection, and network performance.