HIPAA Security Rule to Experience Major Updates in 2025

This month, the Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking in the Federal Register, which is intended to strengthen cybersecurity requirements for HIPAA-covered entities and business associates (the Proposed Rule). The comment period will close on March 7, 2025, with enactment of the proposed rule expected to take place later this year.
If adopted, this would be the first significant update to the HIPAA Security Rule in over a decade, a time when both technology and cybersecurity have advanced rapidly, and cyberattacks in health care have become more frequent and damaging. According to the preamble, the proposed rule seeks to address common compliance gaps identified by HHS’s Office for Civil Rights (OCR) and to build on guidelines from other agencies like the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA).
Key changes to the Security Rule include:
Elimination of “Addressable” and “Required” Distinctions for Security Controls
Currently, some security controls are categorized as “required” (must be implemented) or “addressable” (can be modified based on the organization’s circumstances). Addressable specifications require the covered entity or business associate to assess the extent to which the control is reasonable and appropriate in the organization’s environment and the extent to which it will further protect electronic protected health information (ePHI). If the organization determines that the control is not reasonable and appropriate, then the addressable control need not be adopted.
The Proposed Rule would eliminate this distinction, requiring all controls to be implemented absent specific and limited exceptions. This change could lead to increased costs and efforts for organizations to update their security programs to comply fully with all controls; even if some might not materially improve existing protections.
Incident Response Plans and Annual Testing
The Proposed Rule would mandate annual testing on incident response plans. Organizations would also need to document investigations, risk assessments, and remediation for all known or suspected security incidents. Contingency plans for restoring critical systems and data within 72 hours of an outage would also need to be documented, with business associates required to notify covered entities within 24 hours of activating such plans.
Technology Asset Inventory and Network Map Requirements
Covered entities and business associates would need to document a comprehensive inventory of their technology assets and a map of their electronic systems that could impact ePHI confidentiality, integrity, and availability. This would include processes involving ePHI transfer between organizations, such as with service providers.
Written Risk Assessment with Specified Risks and Vulnerabilities
Although the current Security Rule requires regularly-scheduled risk assessments, the Proposed Rule adds specific elements to document, including:
- Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI;
- Review of technology asset inventory and network map;
- Identification of both “potential” and existing vulnerabilities to relevant IT systems;
- Assessment and documentation of the security measures used to protect ePHI;
- Reasonable determination of the likelihood that each identified threat would exploit the identified vulnerabilities; and
- Assessment of risks to ePHI posed by current or prospective business associates.
Annual Verification of Business Associate Technical Controls
At least once every 12 months, covered entities (and business associates engaging subcontractor business associates) would be required to obtain written verification from business associates demonstrating that each business associate has deployed technical safeguards required by the Security Rule, including written assessments of relevant electronic information systems.
Patch Management Standardization
Covered entities and business associates would be required to review patch management processes annually and modify the processes as “reasonable and appropriate.” Per the Proposed Rule, a “reasonable and appropriate” time limit to patch critical vulnerabilities is “within 15 calendar days of identification.”
Health Plan Sponsor Compliance
Health plans will be required to include in their plan documents requirements for their group health plan sponsors to comply with the administrative, physical, and technical safeguards of the Security Rule. In addition, health plans will be required to ensure that any agent to whom the health plan provides ePHI agrees to implement the administrative, technical, and physical safeguards of the Security Rule. Finally, agents in receipt of ePHI will be required to notify group health plans upon activation of contingency plans within 24 hours of activation.
Audits
If adopted, HIPAA-regulated entities would be required to perform and document an audit of its implementation of each administrative, technical, and physical safeguard and correlated specification at least once every 12 months.
Specified Technical Controls
The proposed rule identifies additional required technical controls that all covered entities and business associates would be required to adopt, including:
- Encryption of ePHI at rest and in transit;
- Multi-factor authentication;
- Vulnerability scanning every six months;
- Penetration testing every 12 months;
- Anti-malware protection;
- Network segmentation; and
- Backup and recovery of ePHI.
Next Steps
The Proposed Rule represents a drastic evolution in cybersecurity expectations for HIPAA-regulated entities. HHS has released a big-picture fact sheet that summarizes these major proposed changes. Given the range of these proposed changes, organizations in the health care industry will need to prepare accordingly. HIPAA-regulated entities can also submit comments. HHS is requesting comments on benefits, drawbacks, or unintended consequences of the Proposed Rule generally, as well as specific to the removal of the required versus addressable distinction and the proposed timelines, including 12 months as the frequency for review of security protocols and written policies and procedures. Specific to health plans, HHS solicits comments on whether group health plans or third-party administrators address any Security Rule requirements for plan sponsors, to further assess the burden of the Proposed Rule on plan sponsors. HHS is also interested in learning whether the proposed modifications accurately capture current use of electronic media and allow for applicability to future technological innovation.
The Taft Health Care and Life Sciences and Privacy and Data Security groups are available to assist with questions pertaining to the Proposed Rule, as well as development and maintenance of HIPAA governance programs. Please reach out to a Taft attorney or any member of the Taft team.
In This Article
You May Also Like
New Indiana Bill Would Create a Board To Approve Health Care Transactions and Impose New Reporting Requirements for Health Care Entities H-1B Lottery Registration Approaching: Employers Face Increased Requests for Sponsorship