The U.S. Department of Health and Human Services (HHS) has introduced a Notice of Proposed Rulemaking (NPRM) to bolster cybersecurity protections for electronic protected health information (ePHI) under the Health Insurance Portability and Accountability Act (HIPAA). This marks the first significant update since 2013, aiming to address the evolving landscape of cyber threats targeting healthcare data.
Key proposed changes include:
-
Mandatory Annual Technical Inventories: Organizations must maintain up-to-date inventories of all systems handling ePHI to ensure comprehensive oversight and security management.
-
Rigorous Security Risk Assessments: Enhanced assessments are required to identify and mitigate potential vulnerabilities within healthcare information systems.
-
Enhanced Vendor Oversight: Business associates must notify covered entities within 24 hours upon activating a contingency plan, ensuring timely responses to security incidents.
-
Mandatory Multi-Factor Authentication (MFA): Implementation of MFA is required to strengthen access controls to systems containing ePHI.
-
Encryption Standards: Organizations must adopt robust encryption protocols to protect ePHI during storage and transmission.
-
Formalized Incident Response Planning: Entities are required to develop and regularly update incident response plans to effectively address security breaches.
-
Disaster Recovery and Backup Requirements: Establishing comprehensive disaster recovery and data backup strategies is mandated to ensure data integrity and availability.
-
Annual Compliance Audits: Regular audits are to be conducted to verify adherence to HIPAA security standards.
-
Updated Workforce Security Access Management: Policies must be revised to ensure appropriate access controls based on workforce roles and responsibilities.
-
Regular Network Testing and Segmentation: Continuous testing and segmentation of networks are required to prevent unauthorized access and contain potential breaches.
The public comment period for the NPRM concluded on March 7, 2025, with over 4,000 submissions under review. These proposed measures underscore the critical need for healthcare organizations to enhance their cybersecurity posture in safeguarding sensitive health information.
Source: Reuters
