On January 6, 2025, the U.S. Department of Health and Human Services proposed new regulations to enhance cybersecurity protections for electronic protected health information (ePHI) under HIPAA. The proposed changes include mandatory annual technical inventories, rigorous security risk assessments, enhanced vendor oversight, mandatory multi-factor authentication, and encryption standards. These updates aim to strengthen security controls and compliance, reducing breach risks and ensuring greater protection of ePHI.
🔗 Reuters – Top 10 Takeaways from the New HIPAA Security Rule NPRM