HHS proposes changes to the HIPAA Security Rule
HHS proposes to modify the HIPAA Security Rule to strengthen cybersecurity protections for electronic protected health information (ePHI). The proposed changes address changes in technology, increased breaches, and common compliance deficiencies.
- Framework
- HIPAA
- Comments due
- 7 March 2025
- Who it concerns
- Covered entities and business associates under HIPAA.
What changed?
Each point with the sentence from the source that says it.
The proposed rule would require regulated entities to inventory their technology assets and map the movement of ePHI through their information systems.
The proposals to require a regulated entity to inventory its technology assets and map the movement of ePHI through its information systems would illuminate considerations to be included in the regulated entity's risk analysis.
The proposed rule would expressly require regulated entities to encrypt ePHI, with limited exceptions.
By expressly requiring regulated entities to encrypt ePHI, with limited exceptions, the Department's proposal would reflect our expectations in the current cybersecurity environment and eliminate the need for regulated entities to perform an analysis of whether encryption is reasonable and appropriate.
The proposed rule would apply the standard compliance date of 180 days after the effective date of a final rule.
Thus, the Department proposes to apply the standard compliance date of 180 days after the effective date of a final rule.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Security Risk Analysis (SRA) Report
Review the risk analysis policy to include requirements for technology asset inventory and mapping of ePHI movement.
- Transmission Security Policy
Update the transmission security policy to require encryption of ePHI, with limited exceptions.
- Business Associate Agreement Policy
Review business associate agreement policy to account for the proposed transition period for modifying agreements.