Big changes are on the horizon for the Health Insurance Portability and Accountability Act (HIPAA) as a major overhaul of its Security Rule is set to take effect in 2025. These updates are expected to present significant challenges for healthcare organizations and their business associates, marking the most transformative change to HIPAA since the HITECH Act of 2008.

HIPAA’s Evolution and the Need for Change

HIPAA, first enacted in 1996, established national standards to protect electronic protected health information (ePHI). However, the last major update to HIPAA’s Security Rule occurred in 2013, leaving a gap in the regulations amidst a rapidly evolving cybersecurity threat landscape.  As cyberattacks have grown more sophisticated over the years, healthcare has consistently been one of the most targeted industries, making an update to the standards that “protect” the industry long overdue. As such, this proposed overhaul of HIPAA’s Security Rule comes with some massive changes.

HIPAA’s Security Rules have not seen a change this big since the HITECH Act was introduced in 2008 which drove the widespread adoption of electronic health records (EHRs) and strengthened HITECH also introduced mandatory data breach reporting, empowering the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) to enforce violations more effectively. The proposed changes in 2025, however, are poised to have an even broader and more rigid impact on regulated entities.

The End of Flexibility in HIPAA Compliance

Historically, HIPAA has allowed organizations flexibility through Provision 164.306, which allowed organizations to interpret and implement standards based on their specific circumstances. Provision 164.306 permitted organizations to evaluate whether security measures were “reasonable and appropriate” given their infrastructure, resources, and risks. While this adaptability was intended to encourage compliance for smaller organizations, some entities exploited it as a loophole, treating HIPAA as a “checkbox” rather than a roadmap for robust security.

The new Security Rule proposes eliminating the “required vs. addressable” distinction in Provision 164.306 and mandating uniform compliance across all covered entities and business associates with few, limited exceptions. This shift will cause an urgent need for organizations to treat HIPAA standards as minimum-security baselines rather than flexible guidelines.

New Security Rule Requirements: A Closer Look

The proposed updates to HIPAA include a comprehensive list of new requirements aimed at addressing current cybersecurity risks. Key areas of focus include:

• • Patch Management: Organizations must maintain up-to-date software to mitigate vulnerabilities.

• • Access Controls: Strict measures to ensure only authorized personnel can access ePHI.

• • Multifactor Authentication (MFA): A critical layer of defense against unauthorized access.

• • Encryption: Enhanced protocols for securing data in transit and at rest.

• • Backup and Recovery: Implement distinct technical controls for backup and recovery of ePHI and related systems.

• • Incident Reporting: Streamlined processes for detecting, documenting, and responding to breaches.

• • Risk Assessments: Comprehensive evaluations to identify and mitigate potential security threats.

• • Compliance Audits: Regular reviews to validate compliance with the updated standards.

The Cost of Compliance

Implementing these sweeping regulatory changes will require considerable time and financial resources. Experts estimate that even a small doctor’s office could face costs as high as $100,000 to meet the new requirements. While larger organizations with complex infrastructures may encounter even higher expenses.

To mitigate these financial challenges, many organizations should consider seeking external assistance through options like virtual Chief Information Security Officers (vCISOs) or compliance consultants. These experts can help navigate the regulatory landscape and develop cost-effective strategies to help your organization achieve compliance.

What Comes Next?

Stakeholders have until March 7, 2025, to review the proposed changes and submit comments. After the public comment period closes, there will be a standard compliance date of 180 days, but organizations may not see changes implemented until 6-12 months after publication.

Now is the time to start preparing for the roll out of the new HIPPA Security Rule by:

Now is the time to start preparing for the roll out of the new HIPPA Security Rule by:

1. Reviewing your Current Practices: Conduct a thorough risk assessment to identify areas needing improvement.
2. Engage Experts: Educate yourself about the proposed changes through verified resources and webinars  and consider partnering with compliance professionals to develop a clear roadmap for implementation.
3. Submit Feedback: Provide input on the proposed changes through the Federal Register. 

Final Thoughts

The 2025 revamp of HIPAA’s Security Rule is a wake-up call for the healthcare industry to prioritize cybersecurity. While the changes may present a heavy lift for many organizations, they are a big step towards protecting sensitive patient information in today’s ruthless threat environment. By taking proactive steps now, your organization can position itself for success and compliance in the years to come.

---