Unpacking HHS' Proposal To Amend HIPAA Security Rule

Just in time to bring in the new year, the U.S. Department of Health and Human Services issued a notice of proposed rulemaking on Dec. 27 to significantly amend the Health Insurance Portability and Accountability Act's security rule.

The security rule, which sets forth the security standards for safeguarding electronic protected health information that govern HIPAA covered entities and business associates, has evolved since its inception in 2003. Upon finalization, it would overhaul the security rule such that HIPAA entities would have a series of material operational changes to implement, as detailed below.

The proposed rule was expected, particularly in light of the incredible increase in data breaches affecting the healthcare industry, including the devastating rise of large scale foreign cyberattacks and ransomware. In particular, some experts have cited data compiled by the Office of Civil Rights in determining that the number of healthcare records affected