OCR Proposes Regulatory Facelift To The HIPAA Security Rule: Addressing The Current Cybersecurity Environment With More Specificity And Additional Requirements

On January 6, 2025, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published a "Notice of Proposed Rulemaking," HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information (the "Proposed Rule").¹

The Proposed Rule aims to strengthen cybersecurity protections for electronic protected health information (ePHI), including pursuant to a March 1, 2023, directive from President Biden.² Specifically, OCR is revising the HIPAA Security Standards for the Protection of Electronic Protected Health Information (the "Security Rule") to address the following:

1. Changes in the health care sector;
2. Significant increases in breaches and cyber-attacks;