HHS has delayed until next July 2027, it’s stricter HIPAA Security regulations. Most notably, many provisions that were “addressable” will be required. Expect more risk assessments, security penetration testing of servers and other access to protected health information. Here are a few comments accompanying the new regulations.
“We believe that compliance with the implementation specifications currently designated as addressable is not—and should not be—optional, particularly in light of the shift to an interconnected and cloud-based environment and a significant increase in the number of breaches of unsecured PHI from both internal and external actors, regardless of the regulated entity’s specific circumstances.” [HHS Proposed Changes to HIPAA Security Rules at pg. 917]
“We continue to believe that it is just as important for small and rural health care providers to implement strong security measures as it is for larger health care providers and other categories of regulated entities.”
“Often, preparation for security incidents or other occurrences that adversely affect the confidentiality, integrity, or availability of ePHI is neglected in favor of other priorities, putting small and rural health care providers at greater risk for such an occurrence.” HHS proposal at 918]
You will find an updated presentation on these and Washington’s broader protections here and under the “presentation” tab of this website.
