Cybersecurity · Industry brief

""

The Department of Health and Human Services has delayed final action on the HIPAA Security Rule overhaul to at least July 2027, moving the Privacy Rule changes separately to August. The proposal, published in January 2025 with a 125-page Notice of Proposed Rulemaking, would eliminate distinctions between "required" and "addressable" implementation specifications and mandate written documentation for all security policies. Paula Stannard, HHS Office for Civil Rights director, signaled the proposal is not headed for rescission despite industry concerns over its estimated $9 billion first-year cost, noting that doing nothing carries its own high costs through cyberattacks and breaches. More than 4,700 public comments have been submitted; the Trump administration has not yet decided its position. CHIME submitted public comments and stakeholder letters requesting rescission, arguing cost estimates understate real burden for under-resourced providers. The Office for Civil Rights has expanded its enforcement initiative beyond risk analysis to include active risk management implementation. OCR Senior Advisor for Cybersecurity Nick Heesters released guidance making clear that organizations must take action on identified risks, not merely document them. In 2024, large HIPAA breaches affected over 286 million individuals; 76 percent of large breaches in 2025 were caused by hacking and IT incidents. OCR has found recurring patterns of vulnerabilities identified in security reviews year after year but left unmitigated until exploited. Willful neglect findings carry penalties of $73,011 per day per violation. OCR is actively enforcing existing rules by requiring organizations demonstrate functioning, continuous risk management programs using federally recognized frameworks including NIST CSF 2.0, NIST SP 800-66, and HHS 405(d) Health Industry Cybersecurity Practices.