A bipartisan bill presented in the Senate requires the Department of Health and Services (HHS) to revise the HIPAA rules to boost cybersecurity throughout the healthcare industry and offer funds to support healthcare organizations with low resources to follow cybersecurity guidelines.
The HHS is planning to recommend a change to the HIPAA Security Rule and include new cybersecurity conditions. The White House is reviewing the proposed rule and the HHS Office for Civil Rights (OCR) plans to publicize it before 2025. OCR hasn’t shared what new conditions are being recommended. It only stated that the proposed rule contains significant changes to the HIPAA Security Rule. What will happen to the proposed rule will depend on the new government. President Trump mentioned that one of his administration’s goals is to remove some rules, however, enhancing healthcare cybersecurity gets bipartisan support.
Sen Bill Cassidy (R-LA), ranking member of the Senate HELP (Health, Education, Labor, and Pensions) Committee, John Cornyn (R-TX), Mark Warner (D-VA), and Maggie Hassan (D-NH) introduced the Health Care Cybersecurity Resiliency Act of 2024. This Act is the product of a bipartisan effort through an established cybersecurity working group in 2023. Because of the growing cyberattacks on the healthcare industry, forming a working group was deemed necessary. These attacks cause substantial disruption to healthcare services, resulting in canceled consultations and delays to life-saving treatment, and endanger patients’ sensitive health information.
Today, it is important to protect Americans’ health care information. Senator Cornyn said that the legislation would improve the cybersecurity practices of healthcare institutions, improve agency coordination, and offer tools to help rural providers avoid and react to cyberattacks. The Health Care Cybersecurity Resiliency Act attempts to set up funds to assist healthcare organizations with cyberattack reduction and response and assure HIPAA training on cybersecurity best practices is given to healthcare organizations.
Best practices will likewise be shared with rural health clinics and other companies on avoiding cyberattacks, increasing toughness, and coordination with government agencies. The bill additionally requires a better relationship between the Cybersecurity and Infrastructure Security Agency (CISA) and the HHS to enhance the reaction to cyberattacks in the HPH sector. The bill calls for the HHS Secretary to create and carry out a cybersecurity incident response plan and publish updated information types on the OCR breach website.
Presently, the breach portal displays the number of individuals impacted, the type of breach, and the storage location of the protected health information (PHI). If the bill is approved, corrective actions must be implemented against the covered entity, the identified security practices considered (if appropriate) at the time of the investigation, and any additional data the HHS secretary finds applicable. The bill furthermore requires present HIPAA rules to be up-to-date, for example, requiring HIPAA-covered entities to follow cybersecurity guidelines like multifactor authentication, and requiring healthcare companies to do penetration tests and reviews to make sure their security measures are efficient.
The legislation comes after The Health Infrastructure Security and Accountability Act (HISAA) bill presented by Sen. Ron Wyden and Sen. Warner, which requires a new minimum cybersecurity criterion for healthcare companies. HISAA was created because of the Change Healthcare ransomware attack that resulted in extensive disruption on healthcare providers and patients throughout the country and the theft of the personal and health data of 100 million Americans.
