Feb. 24, 2025
Feb. 24, 2025

In a previous article, we discussed a pair of U.S. Senate bills that are quickly moving through Congress and that will have profound impacts on healthcare providers’ cyber regulatory requirements. Since then, we’ve seen numerous announcements from agencies that clarify the direction in which Washington is taking the industry but that, at the same time, blur some of the lines.
Here, we introduce you to the most significant of those announcements—the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information. We’ll also share our thoughts about what it means for healthcare providers and how you can prepare and even engage with us to try to influence the final regulations.
Regarding the implementation of cybersecurity best practices at the organizations they regulate, the U.S. Department of Health and Human Services has come to the same conclusion that the Department of Defense came to several years ago: that optional or recommended best practices will, at best, be haphazardly implemented or, at worst, not at all. So, it is no surprise that, like DoD, HHS is following suit and requiring that its cyber control practices be mandatory for participation in the programs it regulates.
On Dec. 27, 2024, HHS announced the intention to move in the direction of mandatory participation with the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, and it opened public comments on Jan. 6. (For the full fact sheet from HHS click here.
(For the complete text of the proposed rule click here.)
The number of details included in the new rule precludes listing them all here. The following are those that are the most significant, with many guaranteed to add costs to your IT budget:
Despite all the details, there is one thing the rule doesn’t do: call out enforcement mechanisms. This needs to be done by Congress and is currently underway via the two Senate bills discussed above and here.
Overall, we consider this a positive move by HHS, primarily because it will bring clarity to what had been a relatively vague set of requirements. Once the details of this rule are finalized, there should be very few questions as to what an organization will need to do in the face of a breach to steer clear of the double jeopardy nature of a government fine along with the cost of the breach itself.
On the other hand, compliance will be expensive. Given the complexity of healthcare IT systems and the relative lack of complexity of network environments, the cost to properly implement many of the practices will be significant. Network segmentation, for example, may require the re-architecting and implementation of large sections of corporate clinical networks. There are also new processes with major documentation and maintenance activities that will add to compliance costs.
Given the unlikeliness that IT budgets will rise to fully cover the costs of implementing the requirements, organizations will find that much stronger IT governance practices are needed. For the first time since the Meaningful Use program, clinical applications may need to start taking an expenditure back seat to shoring up cyber defenses. This is not good news, and we hardly advocate for it. However, the downsides of noncompliance, including a continually rising risk of breach, means it is a step that must be taken.
So far, between the legislation and rule declaration, there has been no discussion about how the mandatory assessments will work, including how they are to be performed, how they will be scored, and what the thresholds are for passing and failing. HHS has a couple of models that work well with the other agencies, so we hope that a solution is forthcoming to help us all prepare.
One of the issues facing organizations in evaluating their cyber defenses for HIPAA specifically, but with the National Institute of Standards and Technology controls more generally, is that each of the government agencies defines their own practices outside of the NIST framework. Even though the controls are very similar to their NIST 800-53 counterparts, they aren’t the same, which leads to confusion and cost. We will continue to advocate that the agencies move their practice control definitions to the NIST standards.
Given that so many of the details required to put an effective compliance program in place are still up in the air with this rule and the Senate bills, a definitive plan for what to do will not be available for some time. That said, we offer these suggestions for CEOs, CFOs, and boards of directors:
The Kodiak team are not only your healthcare experts, but we have decades of experience with these controls and with implementing cyber defenses. We can help answer any of your questions on the above analysis and the new rule and what its likely landing point will be.
Get access to our communications, including our Healthcare Connection newsletter, to tap into industry trends, CPE webinars, and more.