The HIPAA Security Rule is a critical part of The Health Insurance Portability and Accountability Act (HIPAA): legislation specifically designed to establish national security standards to protect the electronic protected health information (ePHI) held by healthcare organizations. Compliance with the HIPAA Security Rule is essential for safeguarding sensitive patient data against security breaches, cyber threats and even physical damage.
However, as cyber threats grow in both variety and, more alarmingly, sophistication and technological advancements, the Office for Civil Rights (OCR), which enforces the Security Rule, has proposed updates to further strengthen the data security and risk management postures of healthcare organizations.
In light of these upcoming changes to the HIPAA Security Rule and their importance to healthcare organizations, this post details the existing HIPAA Security Rule and what it entails. From there, we’ll look at the proposed modifications to the HIPAA Security Rule, helping you to understand how it will affect your organization going forward and, subsequently, how to best prepare for potential changes coming later this year to remain compliant.
What is the HIPAA Security Rule?
Added to HIPAA in 2003, the Security Rule introduced a series of mandatory safeguards to protect the increasing amount of digital data, i.e., ePHI, and the increasing prevalence of electronic health record (EHR) systems, customer data platforms (CDPs) and revenue cycle management (RCM) platforms.
The HIPAA Security Rule centers around three fundamental categories of safeguards:
- Administrative Safeguards
- Risk modeling: frequent risk assessments to identify, categorize, and manage security risks.
- Workforce security policies: including role-based access controls.
- Contingency planning for emergency access to ePHI: i.e., disaster recovery and business continuity planning.
- Technical Safeguards
- Access controls: implementing controls to restrict access to ePHI, e.g., Zero Trust, user authentication, and automatic timeouts.
- Audit controls: to track access to sensitive patient data.
- Encryption protocols: to protect ePHI end-to-end, in transit and at rest.
- Physical Safeguards
- Onsite security measures: to prevent unauthorized physical access, e.g., locks, keycards, etc.
- Surveillance equipment: cameras and alarms, for example, to signal unauthorized access.
- Secure disposal of redundant hardware: devices containing ePHI must be properly disposed of by companies that specialize in data destruction.
The HIPAA Security Rule: The Dangers of Non-Compliance
Consequently, should a healthcare company fail to comply with the safeguards outlined in the HIPAA Security Rule, it can result in severe consequences, including:
- Civil penalties: up to $2.1 million per violation; repeat offenses can result in multi-million dollar settlements.
- State-Level HIPAA Fines: in addition to federal HIPAA penalties, states, such as California and New York, can impose fines for compliance violations under the Health Information Technology for Economic and Clinical Health (HITECH) Act
- Criminal charges: for willful neglect, unauthorized collection of ePHI, and, the malicious use of patient data (including its sale). This can result in up to 10 years in prison.
- Reputational damage: demonstrating an inability to secure ePHI results in a loss of patient trust, making them less inclined to purchase your services or products. More alarmingly, cybercriminals will also become aware that your company’s IT infrastructure is vulnerable, which could invite more attempts to infiltrate your network and steal ePHI.
Proposed Updates to the HIPAA Security Rule
Now that we’ve discussed the present HIPAA Security Rule, and the consequences for failing to implement its required threat mitigation measures, let’s turn our attention to the proposed changes to the Security Rule, which were announced by the U.S. Department of Health and Human Services (HHS) in December, 2024, and how they will affect healthcare organizations.
Mandatory Encryption for All ePHI Transmission
The proposed updates require end-to-end encryption for emails, messages, and data transfers involving ePHI, making all implementation specifications required with specific, limited exceptions. This means that patient data must be encrypted in transit, i.e., from one place to another (when collected in a secure form, sent in an email, etc.), and in storage, i.e., where it will reside.
To accommodate these changes, many healthcare organizations will need to upgrade to HIPAA-compliant email solutions, for their outreach requirements, as well as encrypted databases to store the ePHI in their care.
Expanded MFA Requirements
Healthcare providers must implement Multi-Factor Authentication (MFA) for all personnel with access to ePHI. MFA moves beyond usernames and passwords, requiring users to prove their identity in more than one way.
This could include:
- One-time passwords (OTPs) via email, an app, or a physical security dongle (e.g., an RSA token)
- Access cards or Fobbs
- Biometric identification, such as retina scans, fingerprints, or voice recognition.
This proposed rule change addresses increasing risks from phishing and other credential-based attacks, in which malicious actors acquire employee login details to access ePHI.
Stronger Risk Management and Third-Party Security Controls
Healthcare organizations must conduct more frequent risk assessments to identify, categorize, and mitigate threats to ePHI. A considerable part of this is implementing stricter security controls for business associates who have access to the healthcare company’s ePHI.
A business associate could be a software vendor with which an organization processes patient data, or it could be a supplier or partner that requires access to ePHI to fulfill its operational duties. In light of this, one of the proposed changes to the HIPAA security rule is that vendor security audits will become more mandatory rather than optional.
New Incident Response (IR) and Breach Reporting Rules
The new rule changes emphasize stricter breach notification timelines for healthcare entities and the business associates that handle ePHI on their behalf. This means that healthcare companies are obligated to inform affected parties of a data breach as soon as possible.
For healthcare companies, this means devising, or strengthening, continuous monitoring protocols, so their security teams become aware of suspicious activity as as soon as possible and can accurately communicate their containment efforts and take the neccessary actions to mitigate damages.
Preparing For The Changes to the HIPAA Security Rule: Next Steps for Healthcare Organizations
As the proposed changes to the HIPAA Security Rule move forward, and are likely to go into effect by the end of this year, healthcare organizations can prepare by:
✔ Conducting frequent risk assessments to pinpoint vulnerabilities to the ePHI in IT ecosystems. This should be done annually, at least – or when changes are made to IT infrastructure that may affect ePHI.
✔ Evaluating existing email and communication platforms to ensure compliance with encryption and authentication requirements, especially under the newly proposed security rule and its requirements.
✔ Hardening your organization’s cybersecurity posture by considering the implementation of network segmentation, zero-trust security principles, and data loss protection (DLP) protocols.
✔ Strengthening vendor risk management to ensure third-party service providers meet HIPAA compliance standards and that you have a Business Associate Agreement in place.
How the Proposed Changes to the HIPAA Security Rule Affect Healthcare Communications and Email Security
One of the most significant implications of the proposed changes to the Security Rule is the heightened focus on secure email communications involving ePHI. Key takeaways for secure healthcare email include:
- Encryption is now essential: healthcare organizations relying on unencrypted email delivery platforms to communicate with patients will need to switch to secure, HIPAA-compliant email solutions with the appropriate encryption capabilities.
- Email providers must meet stronger compliance standards: if your current email service provider doesn’t support automatic encryption, for instance, it may be non-compliant under the new rule.
- Stronger authentication for email access: healthcare professionals sending or receiving ePHI via email must implement MFA and similar, robust access control protocols.
With email communication being a key part of patient outreach and engagement, it’s vital for healthcare companies to identify and address security gaps in their IT infrastructure, and prepare for the coming changes to the HIPAA security rule.
Changes to the HIPAA Security Rule: Final Thoughts
The HIPAA Security Rule remains the foundation for protecting ePHI within healthcare organizations. The proposed updates to the Security Rule reflect the growing need for stronger cybersecurity controls in healthcare. The stark reality is that patient data is, and always will be, sensitive and, as such, will always be a valuable target for cybercriminals.
In light of the persistent and growing threat to ePHI, healthcare organizations that fail to proactively address the requirements brought forth by the proposed changes to the HIPAA Security Rule risk data breaches, financial penalties and other punitive action.
If you have questions about HIPAA compliant secure email, encryption, or how the coming changes to the Security Rule will impact your healthcare communications, contact LuxSci today for expert guidance.
