< + > Navigating New Healthcare Cybersecurity Regulations: What You Need to Know

The following is a guest article by Richard Caralli, Senior Cybersecurity Advisor at Axio

Cybersecurity regulations often emerge in response to major incidents. For instance, Sarbanes-Oxley (SOX) followed the Enron fraud, updates to FISMA came after the 2015 Office of Personnel Management (OPM) breach, and the Securities and Exchange Commission’s cybersecurity disclosure provisions were implemented after breaches at Equifax and SolarWinds. However, these reactive measures often struggle to remain effective in the face of rapidly evolving cyber threats.

This reactive approach is again evident as the Department of Health and Human Services (HHS) proposes significant regulatory changes following the 2024 cyberattack on Change Healthcare. This attack disrupted healthcare insurance claims and patient care, underscoring vulnerabilities within the industry. The proposed changes aim to modernize regulations and impose stricter compliance measures to address the growing cybersecurity challenges.

What’s Changing in Healthcare Cybersecurity?

RIN 0945-AA22: A Game-Changer for ePHI Protection

The HHS has introduced RIN 0945-AA22, a Notice of Proposed Rule Making, to enhance the protection of electronic protected health information (ePHI). These changes focus on:

• Modernizing the HIPAA Security Rule
• Strengthening security requirements for healthcare organizations
• Promoting consistency in compliance across the healthcare ecosystem

Key Updates to Regulations

These updates reflect a shift toward more stringent and actionable cybersecurity practices, aiming to address vulnerabilities across the healthcare sector:

• Elimination of “addressable” implementation specifications in favor of mandatory requirements
• Enhanced security measures, including: mandatory encryption of ePHI, multi-factor authentication, network segmentation, vulnerability scanning, anti-malware protection, and disabling unnecessary network ports
• Documentation requirements for security policies, risk analyses, and incident response plans
• New contingency planning mandates, requiring system restoration within 72 hours

Who Will Feel the Impact?

Covered Entities and Business Associates

The proposed changes affect a broad spectrum of organizations, emphasizing the need to secure the entire healthcare ecosystem:

• Covered Entities: These include healthcare providers, health plans, and clearinghouses that directly handle ePHI; they are the frontline in ensuring patient data security and are often primary targets for cyberattacks
• Business Associates: Third-party vendors, consultants, and service providers that process or interact with ePHI; these entities represent an extension of the healthcare ecosystem and are increasingly exploited by threat actors as entry points for attacks

Why Protecting the Full Ecosystem Matters

The interconnected nature of the healthcare industry means that vulnerabilities in one area can have cascading effects across the entire sector. For example:

• Supply Chain Vulnerabilities: A breach at a third-party vendor can expose sensitive patient data or disrupt critical healthcare operations
• Data Integrity Risks: Compromised ePHI not only impacts patient privacy but also jeopardizes the accuracy of medical records, which can lead to incorrect treatments and adverse health outcomes
• Systemic Disruption: Attacks on business associates can lead to widespread outages, affecting multiple organizations reliant on their services

By extending regulations to include business associates and ensuring uniform compliance standards, HHS aims to create a more resilient and secure healthcare environment. Protecting the full ecosystem is not just about individual compliance; it’s about safeguarding the continuity and trustworthiness of healthcare services for everyone.

How to Prepare: A 5-Step Compliance Plan

To meet the proposed regulations, organizations must adopt a structured approach. Here’s how to get started:

Assess Your Current Security Measures

Begin by evaluating your organization’s existing cybersecurity infrastructure. Identify what protections are in place and assess their effectiveness. Determine whether your current budget is sufficient to support necessary enhancements. With mandatory security requirements looming, aligning funding with these regulations is critical.

Conduct Thorough Risk Assessments

Perform an annual baseline assessment to identify vulnerabilities in your systems and processes. Use these insights to develop compliance audit reports and address any gaps. Ensure you maintain detailed documentation to support audits by the Department of Health and Human Services (HHS) and demonstrate proactive compliance efforts.

Plan for Real-World Scenarios

Scenario planning is essential to understanding risks specific to securing ePHI. Start by identifying and quantifying potential incidents, such as data breaches or ransomware attacks. Building a library of quantified scenarios will help your organization gauge potential impacts and allocate resources effectively.

Implement Mandatory Security Controls

Adopt the enhanced security measures outlined in the regulations, such as encryption and multi-factor authentication. Regularly conduct vulnerability scans and penetration tests to identify and mitigate system weaknesses. Document an incident response plan and establish contingency measures to restore operations within 72 hours, minimizing disruptions.

Update and Refine Policies

Align your security policies with the new regulatory requirements and review them regularly to address emerging threats. Consistently updating these policies will help mitigate risks and ensure your organization remains compliant.

Act Now: The Compliance Timeline

The proposed rules were published on January 6, 2025, with a comment period ending March 7, 2025. Given the urgency highlighted by the Change Healthcare incident, this expedited review process suggests minimal delays or opposition.

Organizations must act swiftly to align their security programs with these proposed regulations. Proactive preparation will not only safeguard ePHI but also contribute to the resilience of the healthcare sector.

Securing the Future of Healthcare

The new HHS regulations represent a pivotal step in addressing the escalating cybersecurity threats in the healthcare industry. By modernizing the HIPAA Security Rule and enforcing stricter compliance measures, these changes aim to enhance the protection of sensitive patient data and the broader healthcare ecosystem.

Now is the time to act. By following a structured compliance plan, organizations can not only meet regulatory demands but also strengthen their defenses against future threats. Preparing today will ensure a safer, more resilient healthcare industry for tomorrow.

About Richard Caralli

Richard Caralli is a senior cybersecurity advisor at Axio with over 40 years of experience in developing and leading cybersecurity, internal audit, and information technology organizations in industry, government, and academia. Of note, Caralli spent 15 years using his broad experience to develop and transition cybersecurity frameworks and educational programs at Carnegie Mellon’s Software Engineering Institute CERT Program where he was the lead researcher and author of the CERT Resilience Management Model (CERT-RMM), providing a foundation for the Department of Energy’s Cybersecurity Capability Maturity Model (C2M2). While at CERT, Caralli was also involved in creating educational and internship programs at Carnegie Mellon’s Heinz College where he was instrumental in establishing the Chief Information Security Officer certificate program. Caralli retired in 2020 as the Senior Director – Cybersecurity at EQT/Equitrans and joined Axio to use his experience helping organizations adopt a risk-based approach to cybersecurity.