On December 27, 2024, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking (NPRM) to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. This proposed rule aims to enhance cybersecurity protections for electronic protected health information (ePHI).
Brief Background
The HIPAA Security Rule establishes national standards for the protection of individuals’ ePHI by covered entities, such as health plans, health care clearinghouses, and most health care providers, as well as their business associates. The proposed updates are part of a broader effort by the Biden-Harris Administration to improve the cybersecurity of critical infrastructure.
Key Proposals
The NPRM includes several significant changes to strengthen the Security Rule:
- Uniform Implementation Specifications: All implementation specifications will be required, with specific, limited exceptions.
- Documentation Requirements: Written documentation of all Security Rule policies, procedures, plans, and analyses will be mandatory.
- Updated Definitions: Definitions and implementation specifications will be revised to reflect changes in technology and terminology.
- Compliance Time Periods: Specific compliance time periods will be added for many existing requirements.
- Technology Asset Inventory and Network Map: Regulated entities must develop and maintain a technology asset inventory and network map, updated at least annually.
- Risk Analysis Specificity: A more detailed risk analysis will be required, including assessments of threats, vulnerabilities, and risk levels.
- Access Notification: Regulated entities must notify certain entities within 24 hours when a workforce member’s access to ePHI is changed or terminated.
- Contingency Planning: Enhanced requirements for contingency planning and incident response, including written procedures and regular testing.
- Compliance Audits: Annual compliance audits will be required to ensure adherence to the Security Rule.
- Encryption and Technical Controls: Encryption of ePHI at rest and in transit will be required, along with other technical controls such as anti-malware protection and multi-factor authentication.
- Vulnerability Scanning and Penetration Testing: Regular vulnerability scanning and penetration testing will be mandated.
- Network Segmentation: Network segmentation will be required to enhance security.
- Backup and Recovery: Separate technical controls for backup and recovery of ePHI will be necessary
- Business Associate Verification: Business associates must verify their compliance with technical safeguards annually.
Public Participation
HHS encourages all stakeholders, including patients, health plans, health care providers, and consumer advocates, to submit comments on the NPRM through regulations.gov. Public comments are due 60 days after the NPRM’s publication in the Federal Register. Additionally, HHS will conduct a consultation meeting soon, with details forthcoming.
For more information, you can view the NPRM here.
To read our cybersecurity blog visit.
http://www.topgallant-partners.com
0
