Source: www.databreachtoday.com – Author:
HIPAA/HITECH , Standards, Regulations & Compliance
How Might Election Outcome Affect HHS’ Healthcare Cyber Work? Marianne Kolbasuk McGee (HealthInfoSec) • October 25, 2024
As the final months of the Biden administration wrap up, regulators at the agency charged with enforcing HIPAA are racing to complete unfinished work they deem critically important to healthcare sector cybersecurity.
See Also: Critical Condition: How Qilin Ransomware Endangers Healthcare
Number one on the to-do list is an update to the 20-year-old HIPAA Security Rule. The Department of Health and Human Services last Friday submitted to the White House’s Office of Management and Budget planned modifications to the rule with the aim of publishing a notice of proposed rulemaking sometime in December, with 60 days of public comment (see: White House Reviewing Updates to HIPAA Security Rule).
Driving the HIPAA Security Rule modifications are the disturbing and dangerous cyber trends in the healthcare ecosystem that have been playing out over the last few years, and getting worse.
The healthcare sector has become one of the most targeted industries by ransomware criminals, with attacks tripling since 2015, according to a report this week from Microsoft.
The number of individuals affected by hacking health data breaches – and especially ransomware – is expected to soar to new historic highs this year, said Melanie Fontes Rainer, director of the HHS Office for Civil Rights during a keynote presentation at the HIPAA Summit this week in Washington, D.C., hosted by HHS and the National Institute of Standards and Technology.
A snapshot of the department’s HIPAA Breach Reporting Tool website shows 562 major breaches reported so far this year affecting nearly 167 million individuals. That’s already surpassed the nearly 163 million people affected by the 745 breaches reported for the entire 2023.
Fontes Rainer predicted the breach figures this year will climb still higher, including once hospital chain Ascension updates its breach notice stemming from a May ransomware attack, which like the Change Healthcare breach, was initially reported to the agency with a placeholder figure of 500 individuals affected. The Change Healthcare breach alone affected 100 million people.
It’s not just the compromised protected health information of hundreds of millions that federal officials say they’re worried about. It’s the dangerous disruption of ransomware and similar attacks on the delivery of healthcare to patients.
“It serves no one if the healthcare system can’t service patients,” Fontes Rainer said.
While the HIPAA Security Rule was written in the mid-1990s to be flexible and scalable, and not overly prescriptive, the cyberthreat landscape has transformed dramatically.
Fontes Rainer and other officials declined to discuss the details of what’s contained in the proposed modifications to the HIPAA Security Rule now under OMB review. One possibility heavily foreshadowed by HHS is what the agency considers a thorough and timely enterprise-wide HIPAA security risk analysis.
HHS OCR has emphasized risk analysis for years, and in the last year, the agency has publicly made risk analysis a top HIPAA enforcement priority. Of the hundreds of HIPAA enforcement actions, security risk analyses that officials said were faulty, incomplete, or absent have been at the center.
“It’s fair game to say the Office for Civil Rights has over a decade of enforcement experience and that we can learn from that enforcement experience in a way that the authors of the original HIPAA rule could not,” Fontes Rainer told reporters during a press briefing at the summit.
“We have a better sense of what’s needed in the healthcare system, and so obviously risk analysis is something that continues to come up. So I would expect it would be an area that would be somewhat covered because it is an area we continue to see issues in how it’s implemented.”
Another HHS agency – the Centers for Medicare and Medicaid Services – is widely held to be working on possible regulations related to what are currently 20 voluntary “cybersecurity performance goals” that could become financial sticks and carrots for certain healthcare sector entities such as hospitals. CMS would require congressional approval before tying cybersecurity performance to reimbursement.
A handful of bipartisan bills have been introduced in recent months proposing ways to improve healthcare sector cybersecurity (see: Healthcare Cyber Bill Calls for ‘Corporate Accountability’).
Fontes Rainer told summit attendees in her keynote comments that HHS is working with both the White House and Congress on its various cyber-related initiatives.
All Eyes on November
Whether the next presidential administration sees itself as a natural continuation of the current or one that’s in total opposition to it will affect the outcome of pending regulation.
Even should Democratic nominee Vice President Kamala Harris win, a new secretary sitting atop HHS would most likely bring in his or her own agency directors, including potentially HHS OCR. And that could mean a shift in policy, enforcement and rulemaking priorities.
A win by Republican nominee and former President Donald Trump would likely mean an even more radical shift. A proposal from Project 2025, an agenda for a second Trump administration published by conservative think tank The Heritage Foundation and written and funded largely by individuals in Trump’s orbit, contains a call for the repeal of HHS OCR’s HIPAA privacy guidance involving reproductive health information.
“OCR should withdraw its June 2022 HIPAA guidance on abortion that purports to address patient privacy concerns following the Dobbs decision but is actually a politicized statement in favor of abortion and against Dobbs,” wrote Roger Severino, who headed up HHS OCR for four years as director under Trump. “HIPAA covers patients in the womb, but this guidance treats them as nonpersons contrary to law. The guidance is unnecessary and contributes to ideologically motivated fearmongering about abortion after Dobbs,” he wrote in the policy manifesto.
Neither the Heritage Foundation nor the Trump-Vance campaign immediately responded to an Information Security Media Group request for comment on Severino’s Project 2025 writing.
Fontes Rainer said she is confident that the work HHS OCR has done with its proposed update to the HIPAA Security Rule will stick, regardless of who wins the White House come November.
“I don’t think an administration change would affect this,” Rainer told reporters.
“Cybersecurity is a national security issue. It does not change when there’s a new president in the building. These are issues that are affecting our healthcare community, they are a prioritization across the Department of Health and Human Services and our federal partners,” she said.
“The rule hasn’t been updated for over two decades. Obviously, I wouldn’t be here if there’s a change in administration, but I feel strongly that the work would continue because it is critically important to the infrastructure and patients,” she said.
Original Post url: https://www.databreachtoday.com/whats-in-store-for-hipaa-regulations-a-26636
Category & Tags: –
Views: 0
