2025 Proposed HIPAA Security Rule Changes

Much Needed Update to HIPAA coming in 2025.

A long overdue update the HIPAA Security Rule, last updated in 2013, is currently being drafted. Many things have changed in digital healthcare since the rules’ last update and today, the healthcare industry is near wholly reliant upon technology for the delivery of services to patients. This includes a rapid expansion of medical devices and other IoT systems, the widespread use of AI and in particular Machine Learning (ML) to mine vast data lakes of medical information now being generated by the industry. The updated rules also take account of widespread use of cloud and virtual technologies and includes provision for even newer technologies including virtual reality, and quantum computing.

The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996, at a time when few hospitals or health insurance groups had made the transition to digital records and most users considered a 28.8kbps internet connection to be fast. WiFi, mobile devices, and 5G cellular were still distant dreams as was the meaningful exchange of information in digital format between all those involved in treating patients. The HIPAA Security Rule in particular, was considered out of date the moment it was published, although the act’s Privacy Rule has faired better. In 2009 the HITECH act updated the security requirements of HIPAA Covered Entities (CEs) and Business Associates (BAs) to take account of changes in technology and some major ambiguities in the language of the original rule. A further Omnibus update took place in 2013 for similar reasons.

What is Happening?

On December 27th, HHS OCR announced a Notice of Proposed Rulemaking (NPRM) to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule to strengthen cybersecurity protections for electronic protected health information (ePHI). The rule “seeks to strengthen cybersecurity by updating the Security Rule’s standards to better address ever-increasing cybersecurity threats to the health care sector.

What is Changing?

The NPRM proposes to strengthen the Security Rule’s standards and implementation specifications with new proposals and clarifications, including:

• Remove the distinction between “required” and “addressable” implementation specifications and make all implementation specifications required with specific, limited exceptions.
  
  
• Require written documentation of all Security Rule policies, procedures, plans, and analyses.
  
  
• Update definitions and revise implementation specifications to reflect changes in technology and terminology.
  
  
• Add specific compliance time periods for many existing requirements.
  
  
• Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, but at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.
  
  
• Require greater specificity for conducting a risk analysis. New express requirements would include a written assessment that contains, among other things: A review of the technology asset inventory and network map.
  
  
• Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI.
  
  
• Identification of potential vulnerabilities and predisposing conditions to the regulated entity’s relevant electronic information systems.
  
  
• An assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each identified threat will exploit the identified vulnerabilities.
  
  
• Require notification of certain regulated entities within 24 hours when a workforce member’s access to ePHI or certain electronic information systems is changed or terminated.
  
  
• Strengthen requirements for planning for contingencies and responding to security incidents. Specifically, regulated entities would be required to, for example: Establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours.
  
  
• Perform an analysis of the relative criticality of their relevant electronic information systems and technology assets to determine the priority for restoration.
  
  
• Establish written security incident response plans and procedures documenting how workforce members are to report suspected or known security incidents and how the regulated entity will respond to suspected or known security incidents.
  
  
• Implement written procedures for testing and revising written security incident response plans.
  
  
• Require regulated entities to conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements.
  
  
• Require that business associates verify at least once every 12 months for covered entities (and that business associate contractors verify at least once every 12 months for business associates) that they have deployed technical safeguards required by the Security Rule to protect ePHI through a written analysis of the business associate’s relevant electronic information systems by a subject matter expert and a written certification that the analysis has been performed and is accurate.
  
  
• Require encryption of ePHI at rest and in transit, with limited exceptions.
  
  
• Require regulated entities to establish and deploy technical controls for configuring relevant electronic information systems, including workstations, in a consistent manner. New express requirements would include: Deploying anti-malware protection.
  
  
• Removing extraneous software from relevant electronic information systems.
  
  
• Disabling network ports in accordance with the regulated entity’s risk analysis.
  
  
• Require the use of multi-factor authentication, with limited exceptions.
  
  
• Require vulnerability scanning at least every six months and penetration testing at least once every 12 months.
  
  
• Require network segmentation.
  
  
• Require separate technical controls for backup and recovery of ePHI and relevant electronic information systems.
  
  
• Require regulated entities to review and test the effectiveness of certain security measures at least once every 12 months, in place of the current general requirement to maintain security measures.
  
  
• Require business associates to notify covered entities (and subcontractors to notify business associates) upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.
  
  
• Require group health plans to include in their plan documents requirements for their group health plan sponsors to: comply with the administrative, physical, and technical safeguards of the Security Rule; ensure that any agent to whom they provide ePHI agrees to implement the administrative, physical, and technical safeguards of the Security Rule; and notify their group health plans upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.

HHS OCR has requested feedback on the proposed rule changes be received from REs by March 7, 2025, after which the new rule will be drafted, and a final rule enacted approximately 6 months after that.

Most of these proposed requirements are already being followed by larger and better funded HIPAA CEs, though not all BAs it seems. The proposed rules spell out in a more granular format, each of the ‘required’ and ‘addressable’ rules that CEs and BAs should already be following. What was considered ‘addressable’ is now however, a ‘requirement’ under the proposed rule changes.

Of Specific Interest:

• Language of the proposed rule change removes the distinction between ‘Covered Entity’ (CE) and ‘Business Associate’ (BA) and instead employs the term ‘Regulated Entity’ (RE).
  
  
• Removal of distinction between ‘required’ and ‘addressable’. All are now requirements and must be implemented. Time limits are added to meet requirements and to become compliant.
  
  
• Changes various terms in the HIPAA Security Rule such as ‘electronic media’ to take account of the wider use of VOIP technologies, telehealth, digital messaging, cloud, and AI.
  
  
• A complete asset inventory of all network-connected assets is now required along with a network map that illustrates the movement of ePHI throughout the RE network. This needs to be updated at least every 12 months or when new assets are joined to the network.
  
  
• Each RE needs to know where all of its PHI resides on its network and in which systems, whether owned and operated by the RE or some other entity.
  
  
• Makes it a requirement for network segmentation between operational and IT networks.
  
  
• Requires improved regular testing and security risk analysis that includes:
• technology asset inventory and network map.
• improved identification of threats, vulnerabilities, and risks to the CIA of PHI
  
  
• Requires improved audit of access to PHI by users.
  
  
• Requires improved business continuity, contingency planning, and security incident response capabilities.
  
  
• Requires the use of multi-factor authentication.
  
  
• Sets minimum 24-hour notification time. This applies for BAs to notify CEs, and for subcontractors to notify BAs.

What is Impacted?

If a Regulated Entity (RE) is fully compliant with the HIPAA Security Rule (as updated by HITECH and Omnibus) then very little changes. However, this is unlikely. The updated Security Rule proposal itself states that while conducting an audit of regulated entities against the current Security Rule, OCR found that “94 percent failed to implement appropriate risk management activities sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.”

This means that most REs have some work to do in order to catch up with existing Security Rule requirements, let alone the additional effort that will be required to come up to speed with the updated requirements. It also means that more effective risk assessment and analysis is required moving forward.

The intent of this proposed rule change is to remove inconsistent application of the Security Rule across REs. In so doing, it removes the option for ‘reasonableness and appropriateness’ in connection with the costs of security controls, along with often misinterpreted ‘addressable’ implementation specifications to mean they are ‘optional’. These are now ‘required’ and are mandatory.

Furthermore, the rule changes introduce the need to evaluate the ‘effectiveness’ of security controls in supporting the resiliency of the regulated entity. ‘Resiliency’ refers to the entity’s ability to withstand and recover from adverse events. In this regard the changes appear to recognize the vulnerability of REs to denial of service (DOS) and ransomware attacks, and the need to protect against these ‘availability’ attacks through increased resiliency.

This implies the need for much improved business continuity, disaster recovery, and security incident response capabilities so that REs can be back up and running quickly following an incident or attack. It also implies the need for more resiliency in technology architectures using n+2 architectures where a second or third copy of an application can be used in times of need and switched into production quickly. The protracted healthcare downtimes that have impacted the industry recently have been largely caused by single points of failure, an encrypted EMR or other core system with no hot or warm standby, or the ransoming of a critical third party like Change Healthcare as examples.

In Conclusion.

This long-awaited update to healthcare industry security requirements will help to address the chronic imbalance between a growing number of attackers and a largely weak and ill prepared cyber defense across payers and providers. It is intended to lead to massive improvements in security risk assessment and analysis, and the speedy remediation of identified security vulnerabilities. As such, the new rules should reduce the number of successful cyber-attacks, and thus will help to ensure that hospitals and other delivery partners are available in times of medical need by patients and the communities that they serve. Furthermore, these changes will help to reduce growing patient safety concerns, including increased morbidity and mortality when hospitals are under attack.

The need to identify and keep track of connected assets, to know where data resides and moves across medical networks, and to segment operational and IT networks under the proposed rules will be a real deal changer for security. This is well known as the weakest link and is often referred to as the ‘open back door to healthcare security.’ Medical networks and IT / IoT have changed greatly over recent years, as has our reliance upon technologies to diagnose, monitor, treat, and manage patients in our largely digital healthcare system. It's therefore vital that our security controls keep pace with these and other changes.

Read More

2025 Healthcare Cybersecurity Predictions

Twenty Twenty-Five

As someone who has been evangelizing the need for improved healthcare cybersecurity for decades, every year I am hopeful that the new year will be better for healthcare security - that there will be fewer breaches, less supply chain attacks, fewer denial-of-service attempts, and less ransomware attacks. However, statistics don’t lie, nor do trends, so it’s unlikely that I will get my wish in 2025.

The Global Cybersecurity Landscape

Each year, more and more healthcare payers, providers, and life sciences organizations are hit with devastating and costly cyber-attacks. Increasingly these cyber-attacks can impact entire communities. We saw this in West Texas in September and October of 2024 when both UMC and Texas Tech University Health Sciences Center were hit with separate ransomware attacks. This essentially denied Level 1 trauma care to multiple communities impacting an area greater than 250 miles in diameter. It’s likely that we could see more of these high impact overlapping attacks in 2025, for various reasons, as I shall explain shortly.

Healthcare is in the cross hairs and is both an easy and soft target for a growing number of opportunistic perpetrators. It has a large and sprawling supply chain, which when attacked can have sweeping implications for industry players themselves. On top of that, as a critical national infrastructure industry, and in times of geopolitical conflict and cyber warfare, the industry is also a strategic political target. It is being hit from all sides - from organized crime syndicates to state actors, with a rising body of evidence to suggest collaboration and coordination between the two groups.

As a critical national infrastructure industry, healthcare will I believe, be the recipient of increasing levels of government direct and indirect cyber assistance in 2025. Expecting small, independent, or even state-run healthcare providers to defend themselves against the might of the highly organized Russian Mafia crime syndicate or the offensive instruments of a pariah state’s military and intelligence organizations, makes absolutely no sense. Thus, government will need to step in. We are seeing this already in the UK, EU, and Australia with much higher levels of direct involvement and intelligence sharing by government agencies. The US is expected to follow suit in 2025. However, very few governments are ready and prepared to directly protect their healthcare systems at present.

2025 will likely see even more ransomware attacks against healthcare providers. This will no doubt continue until such times that ransom payments and other forms of cyber extortion demand are finally and fully made illegal. Ransomware is a very lucrative industry, whose growth is being fueled by larger and larger payments from victims. Lack of resiliency across the healthcare industry combined with the critical need for operational availability, makes healthcare a prime target for such attacks. As such, expect many more.

Supply chain attacks against the thousands of third-party vendors, suppliers, and services providers will continue to be the open back door to a secure healthcare industry. Software supply chain attacks and strikes against critical single points of failure across the array of healthcare infrastructure will likely continue for as long as the war with Russia does. This means that payers, providers, and life sciences organizations need to develop much stronger risk management processes around their multitude of third-party vendors. This should include full inventory and risk analysis of all organizations who have direct or indirect access to medical networks including third party applications and devices. Cyber-attacks against Synnovis, Change Healthcare, Microsoft, SolarWinds, and others have wreaked havoc across hundreds of organizations with the attack of a single third-party. The return on investment for perpetrators is therefore huge. Expect many more in 2025.

2025 will also see the rise of nation-state attacks. The recent Salt Typhoon attack against critical infrastructure telecommunications providers by the Peoples Republic of China, and a dozen other Chinese Typhoon attacks, are an indication of growing geopolitical tensions as China, Russia, Iran, and the DPRK face off against the western world in what is being termed the ‘Axis of Resistance’. With Russia and Iran already engaged in hybrid and proxy wars, cyber is being viewed increasingly as a convenient weapon of choice that inflicts damage and retribution without crossing a line that will result in a kinetic response from the attacked nation. All critical national infrastructure industries could be the target for increased attention by Axis powers and will need to prepare accordingly. Nation-state cyber-attacks will be 2025’s biggest single threat.

Regulatory Changes

2025 will likely see major changes to US healthcare regulation with the passage (sometime during the year) of the Health Infrastructure Security and Accountability Act (HISAA). This is the long-awaited update or replacement of the ailing and out-of-date 1996 HIPAA security rule which has governed the US healthcare industry for over two decades now. HISAA aims to transform healthcare cybersecurity by setting minimum standards and throwing much-needed financial support to healthcare providers. HISSA is still in the drafting stage at present, but will likely impose stricter cybersecurity standards, require audits, and stress tests, implement serious consequences for non-compliance while providing financial support to healthcare organizations that need help to enhance and improve their cybersecurity capabilities.

HISSA will no doubt help to move the cybersecurity needle, just as NIS2 in Europe and CAF in the UK are already beginning to do. But ‘compliant’ does not mean ‘secure’ and most regulations are out of date the day they are enacted. Its therefore important for healthcare entities to adopt a risk-based approach to security rather than a compliance-based one in its place. That means understanding what, and who, connect to hospital networks, assessing people, processes, and technologies, and conducting a full risk analysis to identify, track and remediate security vulnerabilities on an ongoing basis. This will become ever more important as new innovative technology is added to medical networks.

New Technology

The healthcare industry creates more data than any other industry. To say that there are now healthcare data lakes would be an understatement. Each patient that is seen, diagnosed, and treated, creates vast amounts of useful medical data. This data can then be mined by healthcare data scientists and used to train artificial intelligence (AI) algorithms for machine-learning-based applications used for clinical decision support, and many other areas of medicine.

2025 will see these data lakes become even larger and combined with improvements in AI training to enhance the tools available to clinicians. But just like all data repositories, this highly valuable data needs to encrypted and protected. The RSNA Conference in November highlighted once again, the need for better encryption while revealing new advancements to radiological and medical imaging, thanks in part, to improvements in AI. This is leading to earlier diagnosis and opportunity to medically intervene in patient care, thus driving outcomes while reducing cost. 2025 will see a continuous growth in the capabilities of medical AI, including advances in precision medicine which one day, will totally change the entire paradigm of medical care and treatment of patients.

But often AI is a new technology that introduces new risks. Its data, its algorithms, and its applications all need to be secured from new types of cyberattack, including data poisoning and adversarial machine learning. AI is also being used to weaponize existing malware strains and employed to attack victims by making that malware stealthy, almost impossible to detect, and deadly when its payloads are deployed on unsuspecting networks. 2025 will likely see the continued development of offensive AI attack tools by hackers. At the same time security software companies will be engaged in an arms race to quickly develop defensive AI capabilities in their NDR, XDR and other security applications. Cylera, as an example, and as a next generation IoT security platform, has invested heavily in AI since the company’s founding. It continues to build and deploy new and enhanced AI capabilities that help to automate the orchestration of improved cybersecurity for customers. We will see a lot more AI in 2025 along with better automated security tools and platforms with much faster-than-human response times and the need for less intervention.

Cybersecurity Resource Shortage

 

The shortage of security professions reached 4.8 million in 2024, a growth of 19% over 2023. There simply aren’t enough soldiers to defend the fort against a rising number of attacks. In fact, according to the World Economic Forum, the global talent shortage, could reach 85 million workers by 2030. While universities and training academies have stepped up their education offerings in cybersecurity, it will take many years before this shortage is addressed – if ever, given rising needs.

Burn-out and retention of cybersecurity professionals is a growing problem as the job of defending an organization, sometimes against truly overwhelming odds, becomes even tougher. The ‘Buck’ really does stop at the CISOs desk, yet CISOs remain relatively unempowered to make decisions around enterprise security risk. Many security leaders still lack direct access to the board to properly relay cyber-risk, despite years of industry groups telling CEOs they need to do so. That is slowly changing, and 2025 will likely see an evolution in the partnership between CISOs and their boards.

While job satisfaction and not feeling ignored remain critical for retention, so too does work-life balance for security teams and their leaders. ‘Return to the Office’ for many, has done little to off-set the practice of working around the clock, something that started during the COVID pandemic, covering for sick collogues and dealing with a huge uptick in security needs. It’s important that security teams and their leaders feel needed and respected yet empowered by senior management not to feel the need to work every weekend. Achieving better work-life balance will be a major objective for many security leaders in 2025.

In Conclusion

2025 will be an evolution of what we saw in 2024 rather than any sort of revolutionary change in January. Domestic and international politics may have a significant role to play in both attack and defense, as both sides re-arrange their players and adjust their cyber strategies. The healthcare security threat surface will continue to expand as more and more devices and applications connect to medical networks and interoperability between healthcare systems continues to advance. Diligence will be critical, as will visibility and understanding of risk. Automation of security tools will become ever more important, as the shortage of people to watch screens becomes critical, and various forms of AI will likely play an increasing role in both healthcare applications and security.

This blog was first posted at the following location.

Read More