HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information

Federal RegisterJan 6, 2025

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0945-AA22

HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information

AGENCY:

Office for Civil Rights (OCR), Office of the Secretary, Department of Health and Human Services.

ACTION:

Notice of proposed rulemaking; notice of Tribal consultation.

SUMMARY:

The Department of Health and Human Services (HHS or “Department”) is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Security Standards for the Protection of Electronic Protected Health Information (“Security Rule”) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposed modifications would revise existing standards to better protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The proposals in this NPRM would increase the cybersecurity for ePHI by revising the Security Rule to address: changes in the environment in which health care is provided; significant increases in breaches and cyberattacks; common deficiencies the Office for Civil Rights has observed in investigations into Security Rule compliance by covered entities and their business associates (collectively, “regulated entities”); other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and court decisions that affect enforcement of the Security Rule.

DATES:

Comments:

Submit comments on or before March 7, 2025.

Meeting:

Pursuant to Executive Order 13175, Consultation and Coordination with Indian Tribal Governments, the Department of Health and Human Services' Tribal Consultation Policy, and the Department's Plan for Implementing Executive Order 13175, the Office for Civil Rights solicits input from Tribal officials as the Department develops the modifications to the HIPAA Security Rule at 45 CFR part 160 and subparts A and C of 45 CFR part 164. The Tribal consultation meeting will be held on February 6, 2025, at 2 p.m. to 3:30 p.m. eastern time.

ADDRESSES:

You may submit comments, identified by RIN Number 0945-AA22, by any of the following methods. Please do not submit duplicate comments.

•

Federal eRulemaking Portal:

You may submit electronic comments at

https://www.regulations.gov

by searching for the Docket ID number HHS-OCR-0945-AA22. Follow the instructions at

https://www.regulations.gov

for submitting electronic comments. Attachments should be in Microsoft Word or Portable Document Format (PDF).

•

Regular, Express, or Overnight Mail:

You may mail written comments to the following address only: U.S. Department of Health and Human Services, Office for Civil Rights, Attention: HIPAA Security Rule NPRM, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue SW, Washington, DC 20201. Please allow sufficient time for mailed comments to be timely received in the event of delivery or security delays.

Please note that comments submitted by fax or email and those submitted after the comment period will not be accepted.

Inspection of Public Comments:

All comments received by the accepted methods and due date specified above may be posted without change to content to

https://www.regulations.gov,

which may include personal information provided about the commenter, and such posting may occur after the closing of the comment period. However, the Department may redact certain non-substantive content from comments or attachments to comments before posting, including: threats, hate speech, profanity, sensitive health information, graphic images, promotional materials, copyrighted materials, or individually identifiable information about a third-party individual other than the commenter. In addition, comments or material designated as confidential or not to be disclosed to the public will not be accepted. Comments may be redacted or rejected as described above without notice to the commenter, and the Department will not consider in rulemaking any redacted or rejected content that would not be made available to the public as part of the administrative record.

Docket:

For complete access to background documents, the plain-language summary of the proposed rule of not more than 100 words in length required by the Providing Accountability Through Transparency Act of 2023, or posted comments, go to

https://www.regulations.gov

and search for Docket ID number HHS-OCR-0945-AA22.

Tribal consultation meeting:

To participate in the Tribal consultation meeting, you must register in advance at

https://hhsgov.zoomgov.com/meeting/register/vJItdOyhrjgoHxJWMDxozrxT98yXyCO3lks.

FOR FURTHER INFORMATION CONTACT:

Marissa Gordon-Nguyen at (202) 240-3110 or (800) 537-7697 (TDD), or by email at

OCRPrivacy@hhs.gov.

SUPPLEMENTARY INFORMATION:

The discussion below includes an Executive Summary, a description of relevant statutory and regulatory authority and history, the justification for this proposed regulation, a section-by-section description of the proposed modifications, and a regulatory impact analysis and other required regulatory analyses. The Department solicits public comment on all aspects of the proposed rule. The Department requests that persons commenting on the provisions of the proposed rule label their discussion of any particular provision or topic with a citation to the section of the proposed rule being addressed and identify the particular request for comment being addressed, if applicable.

Table of Contents

I. Executive Summary

A. Overview

B. Applicability

C. Table of Abbreviations/Commonly Used Acronyms in This Document

II. Statutory Authority and Regulatory History

A. Statutory Authority and History

1. Health Insurance Portability and Accountability Act of 1996 (HIPAA)

2. Health Information Technology for Economic and Clinical Health (HITECH) Act

B. Regulatory History

1. 1998 Security Rule Notice of Proposed Rulemaking

2. 2003 Final Rule

3. 2009 Delegation of Authority

4. 2013 Omnibus Rulemaking

III. Justification for This Proposed Rulemaking

A. Strong Security Standards Are Essential to Protecting the Confidentiality, Integrity, and Availability of ePHI and Ensuring Quality and Efficiency in the Health Care System

B. The Health Care Environment Has Changed Since the Security Rule Was Last Revised and Will Continue To Evolve

C. Regulated Entities' Compliance With the Requirements of the Security Rule Is Inconsistent

D. It Is Reasonable and Appropriate To Strengthen the Security Rule To Address the Changes in the Health Care Environment and Clarify the Compliance Obligations of Regulated Entities

1. Congress and the Department Anticipated That Security Standards

Safeguards Would Evolve To Address Changes in the Health Care Environment

2. NCVHS Believes That the Security Standards Evolve To Address Changes in the Health Care Environment

3. A Strengthened Security Rule Would Continue To Be Flexible and Scalable While Providing Regulated Entities With Greater Clarity

4. Small and Rural Health Care Providers Must Implement Strong Security Measures To Provide Efficient and Effective Health Care

5. A Strengthened Security Rule Is Critical to an Efficient and Effective Health Care System

E. The Secretary Must Develop Standards for the Security of ePHI Because None Have Been Developed by an ANSI-Accredited Standard Setting Organization

IV. Section-by-Section Description of the Proposed Amendments to the Security Rule

A. Section 160.103—Definitions

1. Current Provision

2. Issues To Address

3. Proposals

4. Request for Comment

B. Section 164.304—Definitions

1. Clarifying the Definition of “Access”

2. Clarifying the Definition of “Administrative Safeguards”

3. Clarifying the Definition of “Authentication”

4. Clarifying the Definition of “Availability”

5. Clarifying the Definition of “Confidentiality”

6. Adding Definitions of “Deploy” and “Implement”

7. Adding a Definition of “Electronic Information System”

8. Modifying the Definition of “Information System”

9. Modifying the Definition of “Malicious software”

10. Adding a Definition of “Multi-factor Authentication” (MFA)

11. Clarifying the Definition of “Password”

12. Clarifying the Definition of “Physical Safeguards”

13. Adding a Definition of “Relevant Electronic Information System”

14. Adding a Definition of “Risk”

15. Clarifying the Definitions of “Security or Security Measures” and “Security Incident”

16. Adding Definitions of “Technical Controls”

17. Modifying the Definition of “Technical Safeguards”

18. Adding a Definition of “Technology Asset”

19. Adding a Definition of “Threat”

20. Clarifying the Definition of “User”

21. Adding a Definition of “Vulnerability”

22. Clarifying the Definition of “Workstation”

23. Request for Comment

C. Section 164.306—Security Standards: General Rules

1. Current Provisions

2. Issues To Address

3. Proposals

4. Request for Comment

D. Section 164.308—Administrative Safeguards

1. Current Provisions

2. Issues To Address

3. Proposals

4. Request for Comment

E. Section 164.310—Physical Safeguards

1. Current Provisions

2. Issues To Address

3. Proposals

4. Request for Comment

F. Section 164.312—Technical Safeguards

1. Current Provisions

2. Issues To Address

3. Proposals

4. Request for Comment

G. Section 164.314—Organizational Requirements

1. Section 164.314(a)(1)—Standard: Business Associate Contracts or Other Arrangements

2. Section 164.314(b)(1)—Standard: Requirements for Group Health Plans

3. Request for Comment

H. Section 164.316—Documentation Requirements

1. Current Provisions

2. Issues To Address

3. Proposals

4. Request for Comment

I. Section 164.318—Transition Provisions

1. Current Provisions and Issues To Address

2. Proposal

3. Request for Comment

J. Section 164.320—Severability

K. New and Emerging Technologies Request for Information

1. Quantum Computing

2. Artificial Intelligence (AI)

3. Virtual and Augmented Reality (VR and AR)

4. Request for Comment

V. Regulatory Impact Analysis

A. Executive Order 12866 and Related Executive Orders on Regulatory Review

1. Summary of Costs and Benefits

2. Baseline Conditions

3. Costs of the Proposed Rule

4. Benefits of the Proposed Rule

5. Comparison of Benefits and Costs

B. Regulatory Alternatives to the Proposed Rule

C. Regulatory Flexibility Act—Small Entity Analysis

D. Executive Order 13132—Federalism

E. Assessment of Federal Regulation and Policies on Families

F. Paperwork Reduction Act of 1995

1. Explanation of Estimated Annualized Burden Hours

I. Executive Summary

A. Overview

In this notice of proposed rulemaking (NPRM), the Department of Health and Human Services (HHS or “Department”) proposes modifications to the Security Standards for the Protection of Electronic Protected Health Information (“Security Rule”), issued pursuant to section 262(a) of the Administrative Simplification provisions of title II, subtitle F, of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The Security Rule

is one of several rules, collectively known as the HIPAA Rules,

that protect the privacy and security of individuals' protected health information

(PHI), which is individually identifiable health information

(IIHI) transmitted by or maintained in electronic media or any other form or medium, with certain exceptions.

The Security Rule applies only to electronic PHI (ePHI), which is IIHI that is transmitted by or maintained in electronic media.

Subtitle F of title II of HIPAA (Pub. L. 104-191, 110 Stat. 1936 (Aug. 21, 1996)) added a new part C to title XI of the Social Security Act of 1935 (SSA), Public Law 74-271, 49 Stat. 620 (Aug. 14, 1935), (

see

sections 1171-1179 of the SSA (codified at 42 U.S.C. 1320d-1320d-8)), as well as promulgating section 264 of HIPAA (codified at 42 U.S.C. 1320d-2 note), which authorizes the Secretary to promulgate regulations with respect to the privacy of individually identifiable health information. The Privacy Rule has subsequently been amended pursuant to the Genetic Information Nondiscrimination Act of 2008, title I, section 105, Public Law 110-233, 122 Stat. 881 (May 21, 2008) (codified at 42 U.S.C. 2000ff), and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, Public Law 111-5, 123 Stat. 226 (Feb. 17, 2009) (codified at 42 U.S.C. 139w-4(0)(2)).

45 CFR part 160 subparts A and C of 45 CFR part 164. For a history of the Security Rule,

see

section II.B, “Regulatory History.”

see also

section 13404 of the American Recovery and Reinvestment Act (ARRA) of 2009, Public Law 111-5, 123 Stat. 115 (Feb. 17, 2009) (codified at 42 U.S.C. 17934) (applying privacy provisions and penalties to business associates of covered entities). The Department codified the term “covered entity” and defined it using these three categories of persons. 45 CFR 164.103.

42 U.S.C. 1320d-2(d)(2).

42 U.S.C. 1320d-2(d)(2)(A).

42 U.S.C. 1320d-2(d)(2)(B).

42 U.S.C. 1320d-2(d)(2)(C).

HIPAA required the Secretary to adopt uniform standards “to enable health information to be exchanged electronically.”

Congress also directed the Secretary to, among other things, adopt standards for the security of IIHI.

The statute also directed the Secretary to adopt initial security standards within 18 months of its

enactment.

In adopting security standards for health information, HIPAA requires the Secretary to consider all of the following:

Sec. 262(a) of Public Law 104-191, 110 Stat. 2024, adding sec. 1173(a) (codified at 42 U.S.C. 1320d-2(a)(1)).

Sec. 262(a) of Public Law 104-191, 110 Stat. 2025, adding sec. 1173(d) (codified at 42 U.S.C. 1320d-2(d)).

Sec. 262(a) of Public Law 104-191, 110 Stat. 2026, adding sec. 1174(a) (codified at 42 U.S.C. 1320d-3(a)).

Sec. 262(a) of Public Law 104-191, 110 Stat. 2025, adding sec. 1173(d)(1) (codified at 42 U.S.C. 1320d-2(d)(1)).

• The technical capabilities of record systems used to maintain health information.

• The costs of security measures.

• Training for persons who have access to health information.

• The value of audit trails in computerized record systems.

• The needs and capabilities of small health care providers and rural health care providers.

Id.

Congress contemplated that the Department's rulemaking authorities under HIPAA would not be static. In fact, Congress specifically built in a mechanism to adapt such regulations as technology and health care evolve, directing the Secretary to review and adopt modifications to the Administrative Simplification standards, including the security standards, as determined appropriate, but not more frequently than once every 12 months.

That statutory directive complements the Secretary's general rulemaking authority to make and publish such rules and regulations as may be necessary to the efficient administration of the functions with which the Secretary is charged.

The Secretary may adopt either a standard developed, adopted, or modified by a standard setting organization that relates to a standard that the Secretary is authorized or required to adopt under the Administrative Simplification provisions, or a standard that is different if the different standard will substantially reduce administrative costs to health care providers and health plans.

If no standard has been adopted by any standard setting organization, the Secretary shall rely on the recommendations of the National Committee on Vital and Health Statistics (NCVHS) and consult with Federal and State agencies and private organizations.

Sec. 262(a) of Public Law 104-191, 110 Stat. 2026, adding sec. 1174(b)(1) (codified at 42 U.S.C. 1320d-3).

Sec. 1102 of the SSA (codified at 42 U.S.C. 1302).

Sec. 262(a) of Public Law 104-191, 110 Stat. 2023, adding sec. 1172 (codified at 42 U.S.C. 1320d-1).

Id.

2. Health Information Technology for Economic and Clinical Health (HITECH) Act

On February 17, 2009, Congress enacted the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act), part of the American Recovery and Reinvestment Act of 2009 (ARRA),

promoting the nationwide adoption and standardization of health information technology (health IT) to support the electronic sharing of clinical data. The HITECH Act created financial incentives for health IT use among health care practitioners by providing funding for investing in health IT infrastructure, purchasing certified electronic health records (EHRs), and training on and the dissemination of best practices to integrate health IT.

The Purpose statement of an accompanying House of Representatives report

on the Energy and Commerce Recovery and Reinvestment Act

recognizes that widespread health IT adoption “has the potential to ameliorate many of the quality and efficiency problems endemic to our health care system.” Congress also understood that “[e]nsuring the privacy and security of electronic health information is critical to the success” of this immense effort to promote health IT adoption.

As a result, the HITECH Act also introduced substantial changes to the HIPAA regulations by mandating stronger safeguards for the privacy and security of ePHI.

Title XIII of Division A and title IV of Division B of ARRA of 2009, Public Law 111-5, 123 Stat. 115 (Feb. 17, 2009) (codified at 42 U.S.C. 201 note).

Id.; see also

Subtitle B of title XIII of the HITECH Act (codified at 42 U.S.C. 17911-17912), 42 U.S.C. 300jj-31-38.

See

H.R. Rep. No. 111-7, at 74 (2009), accompanying H.R. 629, 111th Cong.

H.R. 629, Energy and Commerce Recovery and Reinvestment Act of 2009, introduced in the House on Jan. 22, 2009, contained nearly identical provisions to subtitle D of the HITECH Act.

C. Stephen Redhead, “The Health Information Technology for Economic and Clinical Health (HITECH) Act,” Congressional Research Service, p. 8 (2009),

https://crsreports.congress.gov/product/pdf/R/R40161/9; id.

at 9 (“[Health IT], which generally refers to the use of computer applications in medical practice, is widely viewed as a necessary and vital component of health care reform.”).

Subtitle D of title XIII of the HITECH Act (codified at 42 U.S.C. 17921, 42 U.S.C. 17931-17941, and 42 U.S.C. 17951-17953).

The HITECH Act's security requirements focused on safeguarding an individual's health information while allowing covered entities to rapidly adopt new technologies to improve the quality and efficiency of patient care.

Specifically, the HITECH Act extends the application of the Security Rule's provisions on administrative, physical, and technical safeguards and documentation requirements to business associates of covered entities, making those business associates subject to civil and criminal liability for violations of the Security Rule.

The HITECH Act also requires existing business associate agreements to incorporate new security requirements.

Additionally, the HITECH Act requires the Secretary to regularly issue guidance on the most effective and appropriate technical safeguards.

See

S. Rept. 111-3, 111th Cong. accompanying S. 336, 111th Cong., at 59 (2009).

Sec. 13401 of Public Law 111-5, 123 Stat. 260 (codified at 42 U.S.C. 17931).

Sec. 13401(a) of Public Law 111-5, 123 Stat. 260 (codified at 42 U.S.C. 17931).

Sec. 13401(c) of Public Law 111-5, 123 Stat. 260 (codified at 42 U.S.C. 17931).

In enacting the HITECH Act, Congress affirmed that the existing HIPAA Rules were to remain in effect to the extent that they are consistent with the HITECH Act and directed the Secretary to revise the HIPAA Rules as necessary for consistency with the HITECH Act.

Congress confirmed that the new law was not intended to have any effect on authorities already granted under HIPAA to the Department, including part C of title XI of the SSA.

Thus, Congress affirmed the Secretary's ongoing rulemaking authority to modify the Security Rule's standards and implementation specifications as often as every 12 months when appropriate, including to strengthen security protections for IIHI.

Sec. 13421(b) of the HITECH Act (codified at 42 U.S.C. 17951).

Sec. 3009(a)(1)(A) of the PHSA, as added by sec. 13101 of the HITECH Act (codified at 42 U.S.C. 300jj-19(a)(1)).

In 2021, the HITECH Act was amended to require the HHS Secretary to further encourage regulated entities to bolster their cybersecurity practices.

The amendment requires the Department to consider certain recognized security practices of regulated entities when making determinations relating to certain Security Rule compliance and enforcement activities.

See

Public Law 116-321, 134 Stat. 5072, adding sec. 13412 (Jan. 5, 2021) (codified at 42 U.S.C. 17941);

see also

42 U.S.C. 17931

et seq.

See

Public Law 116-321, 134 Stat. 5072, adding sec. 13412 (Jan. 5, 2021) (codified at 42 U.S.C. 17941);

see also

sec. 13401 of Public Law 111-5, 123 Stat. 260 (codified at 42 U.S.C. 17931) (The HITECH Act adopts the same definition of business associate as the HIPAA Rules.); 45 CFR 160.103 (definition of “Business associate”).

B. Regulatory History

The Security Rule requires regulated entities to implement administrative, physical, and technical safeguards to

protect ePHI.

Specifically, regulated entities must ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit;

protect against reasonably anticipated threats or hazards to the security or integrity of the information

and reasonably anticipated impermissible uses or disclosures;

and ensure compliance by their workforce.

The Security Rule is codified at 45 CFR part 160 and subparts A and C of 45 CFR part 164.

See

45 CFR 164.306(a)(1).

See

45 CFR 164.306(a)(2).

See

45 CFR 164.306(a)(3).

See

45 CFR 164.306(a)(4).

1. 1998 Security Rule Notice of Proposed Rulemaking

The Administrative Simplification provisions of HIPAA instructed the Secretary to adopt several standards concerning electronic transmission of health information, including those for the security of health information.

In accordance with these provisions, the Department published the Security and Electronic Signature Standards; Proposed Rule (“1998 Proposed Rule”) on August 12, 1998.

See

sec. 262(a) of Public Law 104-191, 110 Stat. 2025 (Aug. 21, 1996), adding sec. 1173(d) (codified at 42 U.S.C. 1320d-2(d)).

63 FR 43242 (Aug. 12, 1998).

In support of developing the national standards mandated under HIPAA's Administrative Simplification provisions, the Secretary, with significant input from the health care industry, defined a set of principles for guiding choices for the standards to be adopted by the Secretary.

The principles were based on direct specifications in HIPAA and also took the purpose of the law and generally desirable principles into account. Based on this work, the Department proposed that each HIPAA standard should be clear and unambiguous but technology neutral, improve the efficiency and effectiveness of the health care system, meet the needs of covered entities related to ease of use and affordability of adoption, and maintain consistency or alignment with other HIPAA standards adopted by an organization accredited by the American National Standards Institute (ANSI) and using the ANSI process for adopting such standards.

Id.

at 43244.

Id.

at 43244, 43249, 43260-61.

In describing its general approach to the 1998 Proposed Rule, the Department defined the security standard as a set of requirements with implementation features that covered entities must include in their operations to assure the security of individuals' ePHI.

The security standard was based on three basic concepts that were derived from the Administrative Simplification provisions of HIPAA and consistent with the characteristics the Department identified as appropriate for all HIPAA Rules.

First, the standard should be comprehensive and coordinated to address all aspects of security. Second, it should be scalable, so that it could be effectively implemented by covered entities of all types and sizes. Third, it should not be linked to specific technologies, allowing covered entities the flexibility to make use of future technology advancements.

Id.

at 43249.

See

68 FR 8334, 8335 (Feb. 20, 2003).

Id.; see also

63 FR 43242, 43249 (Aug. 12, 1998).

The 1998 Proposed Rule included four categories of requirements that a covered entity would have to address to safeguard the confidentiality, integrity, and availability of ePHI. They were as follows:

• Administrative procedures.

• Physical safeguards.

• Technical security services.

• Technical mechanisms.

The implementation specifications described some of the requirements in greater detail, based on our determination regarding the level of instruction necessary to implement such requirements.

The Department viewed all categories as equally important.

63 FR 43242, 43250 (Aug. 12, 1998).

Id.

The proposed standard did not address the extent to which a covered entity should implement the specifications.

Instead, the Department proposed to require that each covered entity assess its own security needs and risks and devise, implement, and maintain appropriate security to address its business requirements. The Department believed that this approach would leave a significant amount of flexibility for covered entities and balance the needs of securing health data against risk with the economic cost of doing so.

Id.

at 43249-50.

Id.

at 43250.

2. 2003 Final Rule

The Department issued the final Security Rule

on February 20, 2003 (“2003 Final Rule”). In accordance with the Administrative Simplification provisions of HIPAA, the 2003 Final Rule adopted standards for the security of ePHI to be implemented by covered entities.

45 CFR parts 160 and subparts A and C of 45 CFR part 164; 68 FR 8334 (Feb. 20, 2003).

The Department reiterated the purposes and guiding principles it articulated in the 1998 Proposed Rule and repeated that the protection of the privacy of information depends in large part on the existence of security measures to protect that information.

The Department noted that there were still no standard measures in the health care industry that address all aspects of the security of ePHI while it is being stored or during the exchange of that information between entities.

The Department explained that the use of the security standards would improve the Medicare and Medicaid programs, other Federal health programs and private health programs, and the effectiveness and efficiency of the health care industry in general by establishing a level of protection for ePHI.

68 FR 8334, 8335, 8371-72 (Feb. 20, 2003).

Id.

Provisions of the 2003 Final Rule did not mirror the 1998 Proposed Rule; rather, the Department finalized only certain changes. The Department noted, for example, that to maintain consistency with the use of terms as they appear in the statute and other previously released HIPAA Rules (

i.e.,

the HIPAA Privacy and Transactions Rules), it was changing some terminology from the 1998 Proposed Rule, replacing the terms “requirement” with “standard” and “implementation feature” with “implementation specification.”

Id.

at 8335.

According to the Department, the comments received in response to the 1998 Proposed Rule overwhelmingly validated its basic assumptions that the covered entities were so varied in terms of installed technology, size, resources, and relative risk, that it would be impossible to dictate a specific solution or set of solutions that would be usable by all covered entities.

Similarly, we received numerous comments expressing the view that the security standards should not be overly prescriptive because the speed with which technology is evolving could make specific requirements obsolete and might in fact deter technological progress. Accordingly, the Department framed the standards in the 2003 Final Rule in terms that were as generic as possible and that could generally be met through a variety of approaches or technologies.

The standards, we

explained, do not allow organizations to make their own rules, only their own technology choices.

Id.

at 8336.

Id.

at 8343.

We also recognized that entities could minimize risk through their security practices, but likely could never completely eliminate all risk. In the preamble to the 2003 Final Rule, the Department acknowledged that there is no such thing as a totally secure system that carries no risks to security.

The Department opined that Congress' intent in the use of the word “ensure” in section 1173(d) of the SSA was to set an exceptionally high goal for the security of ePHI. However, we also recognized that Congress anticipated that some trade-offs would be necessary, and that “ensuring” protection did not mean doing so without any regard to the cost.

As such, the Department explained that we expected a covered entity to protect that information to the best of its ability.

Thus, a covered entity would be expected to balance the identifiable risks to and vulnerabilities of ePHI with the cost of various protective measures, while also taking into consideration the size, complexity, and capabilities of the covered entity.

Id.

at 8346.

Id.

In the 2003 Final Rule, the Department introduced the concept of “addressable” implementation specifications, which it distinguished from “required” implementation specifications. The goal was to provide covered entities with even more flexibility.

While none of the implementation specifications were optional, designating some of the implementation specifications as addressable provided each covered entity with the ability to determine whether certain implementation specifications were reasonable and appropriate safeguards for that entity, based on its risk analysis, risk mitigation strategy, previously implemented security measures, and the cost of implementation.

Id.

at 8336.

3. 2009 Delegation of Authority

On October 7, 2003, the Secretary delegated authority for administering and enforcing the Security Rule to the Administrator of the Centers for Medicare & Medicaid Services (CMS).

The Secretary issued a notice on August 4, 2009, superseding the previous delegation and replacing it with a delegation authority to the Director of OCR effective July 27, 2009.

“Statement of Organization, Functions, and Delegations of Authority,” Centers for Medicare & Medicaid Services, 68 FR 60694 (Oct. 23, 2003).

“Office for Civil Rights; Delegation of Authority,” U.S. Department of Health and Human Services, 74 FR 38630 (Aug. 4, 2009);

see also

“Statement of Organization, Functions, and Delegations of Authority,” Centers for Medicare & Medicaid Services, 74 FR 38663 (Aug. 4, 2009).

4. 2013 Omnibus Rulemaking

Following the enactment of the HITECH Act, the Department issued an NPRM, entitled “Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health [HITECH] Act” (“2010 Proposed Rule”),

to propose implementation of certain HITECH Act requirements. In the 2010 Proposed Rule, the Department noted that it had not amended the Security Rule since 2003.

We further explained that information gleaned from contact with the public since that time, OCR's enforcement experience, and technical corrections needed to eliminate ambiguity provided the impetus for the Department's actions to propose certain regulatory changes beyond those required by the HITECH Act.

75 FR 40868 (July 14, 2010).

Id.

at 40871.

Id.

In 2013, the Department issued the final rule “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health [HITECH] Act and the Genetic Information Nondiscrimination Act, and Other Modifications to the HIPAA Rules” (“2013 Omnibus Rule”),

which implemented applicable provisions of the HITECH Act to strengthen security protections for individuals' health information maintained in EHRs.

78 FR 5565 (Jan. 25, 2013). In addition to finalizing requirements of the HITECH Act that were proposed in the NPRM, the Department adopted modifications to the Enforcement Rule not previously adopted in an earlier interim final rule, 74 FR 56123 (Oct. 30, 2009), and to the Breach Notification Rule not previously adopted in an interim final rule, 74 FR 42739 (Aug. 24, 2009). The Department also finalized previously proposed Privacy Rule modifications as required by the Genetic Information Nondiscrimination Act of 2008, 74 FR 51698 (Oct. 7, 2009).

For example, the Department modified the Security Rule to implement the HITECH Act's provisions that extended direct liability for compliance with the Security Rule to business associates.

100

We explained that before the enactment of the HITECH Act, the Security Rule did not directly apply to business associates of covered entities. The HITECH Act extended the application of the Security Rule's administrative, physical, and technical safeguards requirements, as well as the rule's policies and procedures and documentation requirements, to business associates in the same manner as the requirements apply to covered entities, making those business associates civilly and criminally liable for violations of the Security Rule.

101

The Department noted that the Security Rule requires a covered entity to establish business associate agreements that obligate business associates to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that they create, receive, maintain, or transmit on behalf of the covered entity.

102

Accordingly, we reasoned that business associates and subcontractors should already have security practices in place that comply with the Security Rule, or require only modest improvement to come into compliance with the Security Rule requirements.

103

Like the 2003 Final Rule,

104

the 2013 Omnibus Rule highlighted that the Security Rule was designed to be technology neutral and scalable and reiterated that regulated entities have the flexibility to choose security measures appropriate for their size, resources, and the nature of the security risks they face.

105

Accordingly, regulated entities have the flexibility to choose appropriate security measures considering their size, capabilities, the costs of the specific security measures, and the operational impact, enabling them to reasonably implement the standards of the Security Rule.

100

78 FR 5565, 5589 (Jan. 25, 2013).

101

Sec. 13401 of Public Law 111-5, 123 Stat. 260 (Feb. 17, 2009) (codified at 42 U.S.C. 17931).

102

78 FR 5565, 5590 (Jan. 25, 2013);

see also

45 CFR 164.314(a).

103

78 FR 5565, 5589 (Jan. 25, 2013).

104

68 FR 8334, 8341 (Feb. 20, 2003).

105

78 FR 5565, 5589 (Jan. 25, 2013).

The Department also adopted technical revisions to 45 CFR 164.306(e) to clarify that regulated entities must review and modify security measures as needed to ensure reasonable and appropriate protection of ePHI, and update documentation of security measures accordingly.

106

Id.

at 5590.

Finally, because the HITECH Act made business associates directly liable for compliance with the Security Rule, the 2013 Omnibus Rule modified the Security Rule to clarify that a covered entity is not required to obtain satisfactory assurance from a business associate that is a subcontractor that the subcontractor will appropriately safeguard its ePHI. Rather, the business

associate of the covered entity must obtain the required satisfactory assurances from the subcontractor to protect the security of ePHI.

107

Id.

(citing 45 CFR 164.308(b)).

III. Justification for This Proposed Rulemaking

HIPAA and the HIPAA Rules promote access to high-quality and effective health care by establishing standards for the security of ePHI. The standards, when implemented appropriately by regulated entities, protect the confidentiality, integrity, and availability of individuals' health information. Such protections promote the electronic transmission of PHI through a national health information system. To ensure access to high-quality health care services, regulated entities must assure their customers (

e.g.,

individuals, health care providers, and health plans) of the security of the sensitive and confidential health information the regulated entities electronically create, receive, maintain, or transmit.

As discussed above, the Security Rule carefully balances the benefits of safeguarding against security risks with the burdens of implementing protective measures by permitting regulated entities to consider several factors, including costs and available technology for preventing and mitigating security risks,

108

when determining which security measures are reasonable and appropriate for protecting the security of individuals' ePHI.

109

108

As technology has evolved and cybercriminals have become more sophisticated, protective measures, including technology, have been developed to prevent and mitigate such risks. For example, certain health IT may be certified through the ONC Health IT Certification Program as meeting certain criteria that address the security of information created, received, maintained, or transmitted by that health IT.

See

45 CFR 170.550(h).

109

45 CFR 164.306(b).

For example, the Security Rule requires that a regulated entity implement policies and procedures to limit physical access to its electronic information systems and the facilities in which they are housed, while ensuring that users who are authorized to access such information systems and facilities are permitted to do so.

110

The implementation specifications associated with this standard only address the need for operationalized policies and procedures related to specific aspects of physical security.

111

They do not dictate the specifics of such policies and procedures because we recognize that the nature of the physical safeguards should depend on the type of regulated entity, its size, its level of access to ePHI, and a number of other factors.

110

45 CFR 164.310(a)(1).

111

45 CFR 164.310(a)(2).

Since the Security Rule's promulgation in 2003, the environment in which health care is provided and in which regulated entities operate has changed significantly, including transformative changes in how regulated entities create, receive, maintain, and transmit ePHI. For example, as of 2021, almost 80 percent of physician offices and 96 percent of hospitals had adopted certified EHRs.

112

The use of health IT, including EHRs (certified or otherwise), has led to enormous advancements in the fields of medicine and public health, not only improving outcomes for individuals, but also assisting in addressing the social, economic, and environmental factors that affect health on an individual and community level.

113

And the electronic exchange of health information, spurred by HIPAA, the HITECH Act, and the 21st Century Cures Act (“Cures Act”),

114

has enabled regulated entities and others to more quickly and efficiently share individuals' health information, increasing the quality and efficiency of health care, increasing patient engagement, and reducing administrative burden.

115

However, the widespread use of health IT systems makes it even more critical for regulated entities, regardless of their size or location, to fully assess the risks and vulnerabilities to ePHI and their information systems and implement strong security measures to address those risks and vulnerabilities.

112

“National Trends in Hospital and Physician Adoption of Electronic Health Records,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services,

https://www.healthit.gov/data/quickstats/national-trends-hospital-and-physician-adoption-electronic-health-records.

113

See

“2020-2025 Federal Health IT Strategic Plan,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 6 (Oct. 2020),

https://www.healthit.gov/sites/default/files/page/2020-10/Federal%20Health%20IT%20Strategic%20Plan_2020_2025.pdf.

114

Among other things, the Cures Act provided ONC, in collaboration with NIST and other relevant agencies within the Department, with the authority to convene public-private and public-public partnerships to build consensus and develop or support a trusted exchange framework, including a common agreement among health information networks nationally. The purpose of this work is to ensure full network-to-network exchange of health information. Sec. 4003(b) of Public Law 114-255, 130 Stat. 1165 (Dec. 13, 2016) (codified at 42 U.S.C. 300jj-11(c)). The Cures Act also provides penalties for any developer of certified health IT, health information exchange or network, and appropriate disincentives for any health care provider, determined by the Inspector General to have committed information blocking. Sec. 4004(b)(2) of Public Law 114-255, 130 Stat. 1165 (Dec. 13, 2016) (codified at 42 U.S.C. 300jj-52).

115

See

“Frequently Asked Question: Health Information Exchange: The Benefits,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services,

https://www.healthit.gov/faq/why-health-information-exchange-important.

Experts repeatedly have expressed concern regarding the state of cybersecurity in the health care industry.

116

For example, in a 2017 report to Congress, experts convened by the Department pronounced, “Now more than ever, all health care delivery organizations [. . .] have a greater responsibility to secure their systems, medical devices, and patient data.”

117

This responsibility has only increased as the delivery of health care and the exchange of PHI have increasingly shifted to cyberspace.

116

See

Genevieve P. Kanter, et al., “Beyond Security Patches—Fundamental Incentive Problems in Health Care Cybersecurity,” JAMA Health Forum, Volume 2, Issue 10, p. e212969 (Oct. 8, 2021),

https://jamanetwork.com/journals/jama-health-forum/fullarticle/2784981;

Chon Abraham, et al., “Muddling through cybersecurity: Insights from the U.S. healthcare industry,” Business Horizons, Volume 62, Issue 4, p. 539-548, p. 539 (July-Aug. 2019),

https://www.sciencedirect.com/science/article/abs/pii/S0007681319300436;

Eric Perakslis, “Responding to the Escalating Cybersecurity Threat to Health Care,” The New England Journal of Medicine, Volume 387, Issue 9 (Sept. 1, 2022),

https://www.nejm.org/doi/abs/10.1056/NEJMp2205144;

Anthony James Cartwright, “The elephant in the room: cybersecurity in healthcare,” Journal of Clinical Monitoring and Computing, Volume 37, Issue 5, p. 1123-1132 (Apr. 24, 2023),

https://link.springer.com/article/10.1007/s10877-023-01013-5.

117

“Report on Improving Cybersecurity In The Health Care Industry,” Health Care Industry Cybersecurity Task Force, p. 1 (June 2017),

https://www.phe.gov/preparedness/planning/cybertf/documents/report2017.pdf.

Despite advancements in technology, including health IT, the core requirements of the Security Rule remain relevant and applicable today. In fact, they serve as a foundation for more recently promulgated cybersecurity guidelines, best practices, processes, and procedures. Security management, regular monitoring and review of information system activity, information access management, security awareness and training, contingency planning, encryption, and authentication all continue to be represented in the most well-known cybersecurity frameworks, including the NIST's Cybersecurity Framework,

118

the HHS 405(d) Program's “Health Industry Cybersecurity Practices: Managing

Threats and Protecting Patients,”

119

and the Department's CPGs.

120

118

“The NIST Cybersecurity Framework (CSF) 2.0,”

supra

note 15.

119

“Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,”

supra

note 16.

120

“Cybersecurity Performance Goals,”

supra

note 18.

While these concepts remain highly relevant and applicable, the Department has concerns regarding the sufficiency of the security measures implemented by regulated entities. OCR's experience investigating allegations of Security Rule violations, reports received by OCR of breaches of unsecured PHI, and the results of the audits conducted by OCR in 2016-2017 demonstrate that regulated entities are not consistently complying with the Security Rule's requirements.

121

Additionally, the Department is concerned about the extent to which regulated entities have updated their security measures to adjust to the changes in the health care environment and their operations, including new and emerging threats to the confidentiality, integrity, and availability of ePHI.

121

See

“2016-2017 HIPAA Audits Industry Report,” Office for Civil Rights, U.S. Department of Health and Human Services (Dec. 2020),

https://www.hhs.gov/sites/default/files/hipaa-audits-industry-report.pdf.

And the Department is not alone in its concerns. NCVHS serves as the Department's advisory body for HIPAA.

122

Given the increase in cybersecurity incidents affecting the health care sector, NCVHS held a series of public hearings on cybersecurity to better understand how to protect ePHI and individuals. In response to those hearings, NCVHS submitted several recommendations to the Department regarding the importance of strengthening the Security Rule.

123

As discussed above, HIPAA requires the Secretary to rely on NCVHS' recommendations

124

with respect to standards promulgated under the statute.

122

See

sec. 262 of Public Law 104-191, 110 Stat. 2023 (Aug. 21, 1996) (codified at 42 U.S.C. 1320d-1(f)), added sec. 1172(f) of the SSA;

see also

“About NCVHS,” National Committee on Vital and Health Statistics,

www.ncvhs.hhs.gov.

123

See

Letter from NCVHS Chair Jacki Monson to HHS Secretary Xavier Becerra (May 10, 2022),

https://ncvhs.hhs.gov/wp-content/uploads/2022/05/NCVHS-Recommendations-to-Strengthen-Cybersecurity-in-HC-05-10-2022-508.pdf; see also

Letter from NCVHS Chair Jacki Monson to HHS Secretary Xavier Becerra (Nov. 29, 2023),

https://ncvhs.hhs.gov/wp-content/uploads/2024/01/Letter-to-the-Secretary-Recommendations-to-Strengthen-the-HIPAA-Security-Rule_508.pdf.

124

42 U.S.C. 1320d-1(f).

Given the importance of strong security measures, the changed environment and operations for health care, uncertainty expressed by regulated entities regarding their compliance obligations, deficiencies identified by OCR in its investigations of regulated entities, and the recommendations of NCVHS, we believe that it is necessary and appropriate for the Department to propose modifications to clarify and strengthen the Security Rule.

A. Strong Security Standards Are Essential to Protecting the Confidentiality, Integrity, and Availability of ePHI and Ensuring Quality and Efficiency in the Health Care System

A primary purpose of HIPAA's Administrative Simplification provisions

125

is to, among other things, “improve [. . .] the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of uniform standards and requirements for the electronic transmission of certain health information.”

126

As Congress recognized when it enacted HIPAA, protecting the security of ePHI is essential for accomplishing this goal. Members of Congress acknowledged at that time that the provisions of HIPAA would create electronic databases of PHI, enabling the PHI to be transmitted electronically with both the benefits and risks that accompany such electronic transactions.

127

Congressional statements leading up to HIPAA's enactment demonstrate Congress' recognition of the potential risks of the shift from paper recordkeeping to electronic: “We need to be very careful about how safe and secure that information is from prying eyes. Some of it may be extremely sensitive and could be used in a malicious or discriminatory manner.”

128

Accordingly, HIPAA required the establishment of strict security standards for health information.

125

Subtitle F of title II of HIPAA, Public Law 104-191, 110 Stat. 1936 (Aug. 21, 1996).

126

Sec. 261 of Public Law 104-191, 110 Stat. 2021 (Aug. 21, 1996), as amended by sec. 1104(a) of Public Law 111-148, 124 Stat. 146 (Mar. 23, 2010) (codified at 42 U.S.C. 1320d note).

127

See

statement of Sen. Simon,

supra

note 34;

see also

155 Cong. Rec. H1562 (statement of Rep. Markey) (stating that ARRA includes provisions for health IT with built-in privacy and security); Implementation of the Health Information Technology for Economic and Clinical Health (HITECH) Act: Hearing Before the House Committee on Energy and Commerce Subcommittee on Health, 111th Cong. 11-12 (2010) (statement of Rep. Schakowsky) (explaining that the HITECH Act strengthened Federal privacy and security laws to protect personal identifying information from misuse to ensure that individuals would be willing to use electronic records).

128

Statement of Sen. Simon,

supra

note 34.

As discussed above, the Security Rule, as amended by the HITECH Act, specifically requires regulated entities to maintain reasonable and appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI; to protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI and unauthorized uses or disclosures of ePHI; and ensure compliance with the Administrative Simplification provisions by officers and workforce members of regulated entities.

129

See

section 1173(d)(2) of HIPAA (codified at 42 U.S.C. 1320d-2(d)(2)) and section 13401 of ARRA (codified at 42 U.S.C. 17931(a)) and 45 CFR 164.306.

It is reasonable to anticipate that regulated entities will need to protect ePHI against cyberattacks and unauthorized uses and disclosures of ePHI by their workforce members. Experts estimate the costs to the U.S. from cyberattacks on health care facilities to be significant.

130

According to one study, health care data breach costs to affected organizations have increased by more than 50 percent since 2020, making health care data breaches more expensive than data breaches in any other sector, at an average cost of almost $10.1 million per breach.

131

Yet these costs, though sizeable, do not fully take into account the practical implications of poor or ineffective cybersecurity protocols. A failure to implement adequate security measures may lead to: financial loss; reputational harm for affected individuals and affected regulated entities; privacy loss; and safety concerns.

132

Additionally, breaches of unsecured PHI may lead to identity theft, fraud, stock manipulation, and competitive disadvantage.

133

According to a study funded by the Institute for Critical Infrastructure Technology, victims of medical identity theft incur on average costs of $13,500 to recover from that theft.

134

Unlike financial information, much of an individual's PHI is

immutable. For example, an individual's date and location of birth and their health history will not change, even if their address might. In contrast, an individual's passwords, bank account numbers, and other financial information can all be changed. Thus, PHI can continue to be exploited throughout an individual's lifetime, making PHI likely to be far more valuable than an individual's credit card information.

135

130

See

Hadi Ghayoomi, et al., “Assessing resilience of hospitals to cyberattack,” Digital Health, p. 2 (2021),

https://doi.org/10.1177/20552076211059366;

“Beyond Security Patches-Fundamental Incentive Problems in Health Care Cybersecurity,”

supra

note 116; Jessica Brewer, et al., “An Insight into the Current Security Posture of Healthcare IT: A National Security Concern,” The Institute for Critical Infrastructure Technology, p. 3 (2019),

https://www.icitech.org/post/an-insight-into-the-current-security-posture-of-healthcare-it-a-national-security-concern.

131

“Cost of a Data Breach Report 2023,” IBM, p. 13 (2023) (explaining that the average cost of a health care data breach was $7.13 million in 2020),

https://www.ibm.com/reports/data-breach.

132

“Report on Improving Cybersecurity In The Health Care Industry,”

supra

note 117, p. 14-15.

133

Id.

134

“An Insight into the Current Security Posture of Healthcare IT: A National Security Concern,”

supra

note 130, p. 3.

135

See, e.g., Caleb J. Kumar, “New Dangers in the New World: Cyber Attacks in the Healthcare Industry,” Intersect, Volume 10, No. 3, p. 3 (2017).

On the surface, the harms that result from a breach of ePHI or a cyberattack on a regulated entity's electronic information systems, as discussed above, are not significantly different than those that would result from a breach of information in another sector. However, the reality is, as discussed above, that the implications of such harms are far greater in the health care sector because of their potential to adversely affect an individual's health or quality of life, or even to cost an individual their life.

136

As stated by the Health Care Industry Cybersecurity Task Force in its 2017 report on the state of cybersecurity in health care: “The health care system cannot deliver effective and safe care without deeper digital connectivity. If the health care system is connected, but insecure, this connectivity could betray patient safety, subjecting them to unnecessary risk and forcing them to pay unaffordable personal costs.”

137

In the event of a cybersecurity incident, patients' health, including their lives, may be at risk where such incident creates impediments to the provision of health care, such as interference with the operations of a critical medical device, or to the administrative or clinical operations of a regulated entity, such as preventing the scheduling of appointments or viewing of an individual's health history.

138

136

“An Insight into the Current Security Posture of Healthcare IT: A National Security Concern,”

supra

note 130, p. 3.

137

“Report on Improving Cybersecurity In The Health Care Industry,”

supra

note 117, p. 2.

138

Id.

at 18.

According to a Cybersecurity & Infrastructure Security Agency (CISA) statistical analysis of the effects of a hypothetical cyberattack on a model hospital, a hospital's relative performance will suffer amidst a cyberattack.

139

The analysis found that the hypothetical cyberattack would lead to hospital strain from inaccessible patient schedules and records, disrupted communication, and delays in processing and communicating test results in time to effectively treat individuals.

140

While the analysis did not find any deaths directly attributable to the hypothetical attack, it is logical to conclude that deaths—or at least worsened outcomes—are a significant risk where there are disruptions in communications, as well as delays in processing and communicating test results, especially for emergent or acute medical cases. For example, an inability to access an individual's pharmacy records could affect the ability of a pharmacist to identify known interactions between newly prescribed medications and an existing medication list, potentially leading to an individual's injury or death. Other studies have similarly found that cyberattacks can have a substantial effect on access to health care, and potentially mortality.

141

In fact, a more recent study found that cyberattacks had disproportionately negative effects on in-hospital mortality rates for Black patients who were already admitted to the hospital at the time of the cyberattack.

142

A recent survey found that 92 percent of surveyed health care organizations had experienced a cyberattack in the past year

143

and almost three-quarters of the respondents who had experienced a cyberattack reported negative effects on patient care, including delays in tests or procedures, longer stays, and increased mortality rates complications from medical procedures, and patient transfers or diversions to other facilities.

144

A recent letter from NCVHS referenced anecdotal accounts of patient deaths that have been attributed to ransomware attacks.

145

For example, in 2019, a ransomware attack may have contributed to a baby's death at an Alabama hospital. A change in the baby's fetal heart rate went unnoticed because the large digital display that normally would have displayed the information was affected by the attack. The baby, born with her umbilical cord wrapped around her neck, suffered severe brain damage and died nine months later.

146

139

“CISA INSIGHTS: Provide Medical Care Is In Critical Condition: Analysis and Stakeholder Decision Support to Minimize Further Harm,” Cybersecurity & Infrastructure Security Agency, U.S. Department of Homeland Security, p. 12-15 (Sept. 2021),

https://www.cisa.gov/sites/default/files/publications/CISA_Insight_Provide_Medical_Care_Sep2021.pdf.

140

Id.

141

See

“Assessing resilience of hospitals to cyberattack,”

supra

note 130; Claire C. McGlave, et al., “Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients,” SSRN (Oct. 4, 2023),

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4579292.

142

“Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients,”

supra

note 141, p. 14.

143

“The 2024 Study on Cyber Insecurity In Healthcare: The Cost and Impact on Patient Safety and Care,” Ponemon Institute, p. 3 (2024) (The report, sponsored by Proofpoint, Inc., included survey responses from 648 IT and IT security practitioners at U.S.-based health care organizations.).

144

Id.

at p. 5.

145

See

Letter from NCVHS Chair Jacki Monson (2023),

supra

note 123, p. 1 (citing several media reports that attributed patient deaths to cybersecurity attacks).

146

Id.

(citing Joseph Marks, “Ransomware attack might have caused another death,” The Washington Post (Oct. 1, 2021),

https://www.washingtonpost.com/politics/2021/10/01/ransomware-attack-might-have-caused-another-death/

Cyberattacks can divert both human and machine resources, leading to process slowdowns, cancelled procedures, delayed hospital or unit lockdowns and transfers, increases in wait times for individuals, both increases and decreases in staff utilization, and a decrease in a health care provider's capacity.

147

A 2020 cyberattack on a large integrated academic health system, attributed to malicious software embedded in an email attachment opened by an employee on their laptop, affected more than 5,000 end-user devices across 1,300 servers and led to revenue losses of more than $63 million.

148

Though the health care provider's EHR was not infected, it elected to shut the EHR down proactively. Ultimately, the covered entity “experienced 39 days of downtime in outpatient imaging.”

149

147

“Assessing resilience of hospitals to cyberattack,”

supra

note 130, p. 2.

148

Kerri Reeves, “Cyberattacks: Not a Matter of If, but When,” Radiology Matters (Mar./Apr. 2024),

https://www.proquest.com/scholarly-journals/cyberattacks-not-matter-if-when/docview/2957757956/se-2?accountid=12786.

149

Id.

In another example, a ransomware attack on an academic level 1 trauma center caused it to go without access to its EHR for 25 days,

150

and the attack affected 5,000 computers and destroyed the trauma center's electronic information systems that contained ePHI. The hospital lost access to its EHR, internet, and intranet, which also “removed functionality of hospital phones, [EHR] integrated office and surgical scheduling, access to digitized radiology studies, and network account access through local and remote computers.”

151

150

Mitchell Tarka, et al., “The crippling effects of a cyberattack at an academic level 1 trauma center: An orthopedic perspective,” Injury, p. 1095-1101 (2023),

https://pubmed.ncbi.nlm.nih.gov/36801172/.

151

Id.

These serious incidents and resulting effects demonstrate the importance of planning and preparing for a potential

cyberattack or other event that adversely affects a regulated entity's information systems. While such planning and preparation may not prevent all cyberattacks, it can reduce the number of successful incidents and mitigate their effects. In fact, studies have suggested that such preparation may allow for at least close to real-time recovery.

152

“Assessing resilience of hospitals to cyberattack,”

supra

note 130, p. 13.

The effects of a cyberattack are not limited to the regulated entity that experiences it and the individuals whose ePHI is compromised. Surveys conducted by various organizations representing health care providers indicate that an overwhelming majority of health care providers in the U.S. were affected by a ransomware attack on a large health care clearinghouse.

153

A study published in 2023 examined the effects on the of a cyberattack at a neighboring, unaffiliated hospital on a large academic medical center.

154

The study found that the academic medical center experienced, among other things, significant increases in the number of patients admitted, ambulance arrivals, waiting room times, and patients leaving without being seen. The study's authors concluded that their findings suggested “that health care cyberattacks such as ransomware are associated with greater disruptions to regional hospitals and should be treated as disasters, necessitating coordinated planning and response efforts.”

155

Thus, implementing reasonable and appropriate security measures better protects not only the regulated entity and its ePHI, but other regulated entities with whom it interacts, and may reduce the effects of cyberattacks and other security incidents that adversely affect the confidentiality, integrity, or availability of ePHI.

153

See

Paige Minemyer, “AMA: 80% of docs have lost revenue amid disruptions from Change Healthcare cyberattack,” Fierce Healthcare (Apr. 10, 2024),

https://www.fiercehealthcare.com/practices/ama-80-docs-have-lost-revenue-amid-disruptions-change-healthcare-cyberattack;

“AHA survey: Change Healthcare cyberattack having significant disruptions on patient care, hospitals' finances” (Mar. 15, 2024),

https://www.aha.org/news/news/2024-03-15-aha-survey-change-healthcare-cyberattack-having-significant-disruptions-patient-care-hospitals-finances; see also

Sean Lyngaas, “ `We're hemorrhaging money': US health clinics try to stay open after unprecedented cyberattack,” CNN (Mar. 9, 2024),

https://www.cnn.com/2024/03/09/tech/medical-supply-chain-cybersecurity/index.html.

154

Christian Dameff, et al., “Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the U.S.,” JAMA Network Open (May 8, 2023),

https://jamanetwork.com/journals/jamanetworkopen/fullarticle/2804585.

155

Id.

As discussed above, several industry organizations have published and maintained compilations of voluntary standards, guidelines, best practices, methodologies, procedures, and processes for protecting the security of sensitive and confidential information, including PHI. Additionally, certain Federal health programs now either require or recommend the adoption of specific criteria that are intended to protect the confidentiality, integrity, and availability of ePHI. For example, the Health IT Certification Program maintained by the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology (ASTP/ONC)

156

sets minimum requirements for certified health IT, including criteria that pertain to cybersecurity.

157

These criteria are included in the Health IT Certification Program's Health IT Privacy and Security Framework,

158

which identifies

when technical capabilities to support

the privacy and security of electronic health information

159

must be included in certified health IT products. Additionally, health care providers that participate in certain Federal health programs must use health IT certified to these requirements.

160

Regulated entities also may want to consider adoption of certified health IT because it could contribute to compliance with the Security Rule. We will continue to work across the Department to ensure the adoption of consistent requirements for Federal programs that support the secure electronic exchange of health information to the extent that such consistency is appropriate. Throughout this preamble, we provide examples of how a regulated entity's participation in other Federal programs that require the use of health IT certified through the ONC Health IT Certification Program, or adoption of other Federal recommendations, such as the HHS CPGs, might support their compliance with the proposals in this NPRM.

156

On July 29, 2024, the Department announced that the Office of the National Coordinator for Health Information Technology was being renamed the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology. In this NPRM, we continue to use ONC for publications cited that predate the renaming of that office. 89 FR 60903 (July 29, 2024).

157

See, e.g.,

45 CFR 170.315(d)(6), (7), (12), and (13). For more information on the ONC Health IT Certification Program, visit

https://www.healthit.gov/topic/certification-ehrs/certification-health-it.

158

The ONC Health IT Certification Program specifies at 45 CFR 170.550(h) the privacy and security certification framework for Health IT Modules. Section 170.550(h) identifies a mandatory minimum set of the certification criteria that ONC-Authorized Certification Bodies (ONC ACBs) must ensure are also included as part of specific Health IT Modules that are presented for certification.

See

“Certification Companion Guide Privacy and Security,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services (May 7, 2024),

https://www.healthit.gov/sites/default/files/2015Ed_CCG_Privacy_and_Security.pdf.

159

See

45 CFR 171.102 (definition of “Electronic health information”).

160

See, e.g.,

Medicare Promoting Interoperability Program, 42 CFR 495.24 (eligible hospitals and critical access hospitals must use certified electronic health record technology (CEHRT), with limited exceptions, to comply with the program's meaningful use requirements); Merit-based Incentive Payment System (MIPS) Promoting Interoperability performance category, 42 CFR 414.1375 (requiring MIPS eligible clinicians to use CEHRT, as defined in 42 CFR 414.1305, to comply with reporting requirements for the Promoting Interoperability performance category).

Additionally, as discussed above, several organizations have published and maintained compilations of voluntary standards, guidelines, best practices, methodologies, procedures, and processes for protecting the security of sensitive and confidential information, including PHI. These compilations and the State regulations discussed above range from granular

161

to high-level

162

and from health care-specific

163

to industry agnostic.

164

Despite these differences, these compilations and regulations have a great deal in common with each other—and with the Security Rule, its longevity notwithstanding. In fact, the foundational elements of the Security Rule, promulgated more than 20 years ago, can still be found in cybersecurity compilations published today. They generally either require or recommend administrative, physical, and technical safeguards to identify and mitigate risks and vulnerabilities, implement authentication and access controls, conduct security awareness and training for information system users, and plan for contingencies and incident response.

165

Additionally, these compilations all require or recommend the designation of a specific individual who is accountable for implementing the requirements or recommendations. And, importantly, they all ultimately address how to maintain the

confidentiality, integrity, and availability of sensitive and confidential information, including ePHI.

161

See, e.g.,

“Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,”

supra

note 16.

162

See, e.g.,

“The NIST Cybersecurity Framework (CSF) 2.0,”

supra

note 15.

163

See, e.g.,

“Cybersecurity Performance Goals,”

supra

note 18.

164

See, e.g.,

“Cross-Sector Cybersecurity Performance Goals,” Cybersecurity & Infrastructure Security Agency, U.S. Department of Homeland Security (Mar. 2023),

https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf.

165

See generally

45 CFR 164.308(a); “The NIST Cybersecurity Framework (CSF) 2.0,”

supra

note 15; “Cybersecurity Performance Goals,”

supra

note 18.

A major distinguishing factor between the content of the Security Rule and these compilations and regulations is the Security Rule's scope. The compilations and regulations are designed to protect various types of data and information systems broadly. In comparison, a defining quality of the Security Rule's requirements is that they focus specifically on the protection of ePHI and the information systems that create, receive, maintain, or transmit ePHI. Thus, while the foundational elements of various cybersecurity compilations and State regulations and the Security Rule may be the same, the Security Rule alone addresses the application of those elements to ePHI and all of the components of information systems that create, receive, maintain, or transmit ePHI. Thus, while the standards of the Security Rule generally align with those of other cybersecurity standards, frameworks, best practices, guidelines, processes, and procedures, the specific implementation specifications of the Security Rule reflect the particular sensitivities of the health care industry, particularly small and rural health care providers, in a way that is necessary to ultimately improve the efficiency and effectiveness of the health care system and avoid imposing unreasonable compliance burdens on regulated entities.

B. The Health Care Environment Has Changed Since the Security Rule Was Last Revised and Will Continue To Evolve

The health care sector has undergone a dramatic transformation over the last 24 years, and particularly in the past 10 years, spurred at least in part by the Department's implementation of HIPAA, the HITECH Act, and the Cures Act. The industry has shifted from one that generally relied upon a system of paper-based recordkeeping and siloed devices to one that depends on interconnected information systems to maintain and exchange patient records, conduct research, run health care provider facility management systems, and provide patient care.

166

This shift is largely the result of HIPAA's emphasis on the development and use of standards and the EHR incentive funds made available under the HITECH Act for health care providers.

167

Data from ASTP/ONC offer clear and convincing evidence of this shift. In 2008, before the enactment of the HITECH Act, less than 10 percent of non-Federal acute hospitals had implemented what was referred to at the time as a “Basic EHR” (

i.e.,

an electronic health record).

168

By 2015, six years after the enactment of the HITECH Act, almost 84 percent had adopted a Basic EHR while 96 percent had adopted a certified EHR.

169

The transformation was further enabled by the Cures Act, which encouraged the development of a trusted exchange framework for the nationwide exchange of health information and provided penalties for health care providers, health information exchanges and networks, and developers of certified health IT that engage in information blocking.

170

In 2014, 41 percent of such hospitals routinely had electronic access to clinical information from outside providers or sources when treating a patient.

171

By 2023, 70 percent of non-Federal acute care hospitals engaged in all domains of interoperable exchange routinely or sometimes, a significant leap forward.

172

In 2017, only 38 percent of hospitals enabled patients to access their health information using an application and in 2018, 57 percent enabled patient access to their clinical notes in their patient portal; by 2021, 70 percent of hospitals enabled patients to access their health information using an application and 82 percent enabled patients to view their clinical notes in their patient portal.

173

And just a year later, the percentage of hospitals that supported patient access through applications increased to 86 percent.

174

Based on this data, it is clear that HIPAA, coupled with the HITECH Act and the Cures Act, has successfully encouraged the development of a nationwide electronic health information system.

166

Derrick Tin, et al., “Cyberthreats: A primer for health care professionals,” The American Journal of Emergency Medicine, p. 182-183 (Apr. 2023),

https://doi.org/10.1016/j.ajem.2023.04.001.

167

See

Public Law 104-191, 110 Stat. 2021 (Aug. 21, 1996) (codified at 42 U.S.C. 1320d note); Sec. 4101 of ARRA, Public Law 111-5, 123 Stat. 467 (Feb. 17, 2009), amending sec. 1848 of the SSA (codified at 42 U.S.C. 1395w-4).

168

JaWanna Henry, et al., “ONC Data Brief: Adoption of Electronic Health Record Systems among U.S. Non-Federal Acute Care Hospitals: 2008-2015,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 1 (May 2016),

https://www.healthit.gov/sites/default/files/briefs/2015_hospital_adoption_db_v17.pdf;

A Basic EHR collects information on patient demographics, problem lists, medication lists, and discharge summaries. It also includes computerized provider order entry for medications and enables clinicians to view certain reports.

Id.

at Appendix.

169

“ONC Data Brief: Adoption of Electronic Health Record Systems among U.S. Non-Federal Acute Care Hospitals: 2008-2015,”

supra

note 168, p. 1; When used here, “certified EHR Technology” means EHR technology that meets the technological capability, functionality, and security requirements adopted by the Department as certification criteria at 45 CFR part 170.;

see also

“Certified EHR Technology,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services (Sept. 6, 2013),

https://www.cms.gov/medicare/regulations-guidance/promoting-interoperability-programs/certified-ehr-technology

(“In order to efficiently capture and share patient data, health care providers need certified electronic health record (EHR) technology (CEHRT) that stores data in a structured format. Structured data allows health care providers to easily retrieve and transfer patient information and use the EHR in ways that can aid patient care.”).

170

See

sec. 4003(b) and 4004(b)(2) of Public Law 114-255, 130 Stat. 1165 (Dec. 13, 2016) (codified at 42 U.S.C. 300jj-11(c) and 42 U.S.C. 300jj-52).

171

Dustin Charles, et al., “ONC Data Brief: Interoperability among U.S. Non-federal Acute Care Hospitals, 2014,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 1 (Aug. 2015),

https://www.healthit.gov/sites/default/files/briefs/onc_databrief25_interoperabilityv16final_081115.pdf.

172

Meghan Hufstader Gabriel, et al., “ONC Data Brief: Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 1 (May 2024),

https://www.healthit.gov/sites/default/files/2024-05/Interoperable-Exchange-of-Patient-Health-Information-Among-U.S.-Hospitals-2023.pdf.

173

Wesley Barker, et al., “ONC Data Brief: Hospital Capabilities to Enable Patient Electronic Access to Health Information, 2021,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 2 and 5 (Oct. 2022) (estimates based on non-Federal acute care hospitals and applications configured to meet the application programming interface (API) specifications in the hospital's EHR),

https://www.healthit.gov/sites/default/files/2022-12/hospital_capabilities_to_enable_patient_access_ONC_DB2021-Updated.pdf.

174

Catherine Strawley, et al., “ONC Data Brief: Hospital Use of APIs to Enable Data Sharing Between EHRs and Apps,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 2 (Sept. 2023) (estimates based on non-Federal acute care hospitals using standards-based APIs to enable patient access),

https://www.healthit.gov/sites/default/files/2023-09/DB68-Hospital%20Use%20of%20APIs%20to%20Enable%20Data%20Sharing_508.pdf.

Not only is PHI increasingly maintained and transmitted electronically, but treatment is also increasingly provided electronically. The coronavirus disease 2019 (COVID-19) pandemic led to a dramatic increase in the use of telemedicine.

175

According

to ONC data, only 15 percent of office-based physicians used any form of telemedicine in 2018-19. In 2021, telemedicine usage increased to 87 percent.

176

The electronic content generated or transmitted during a telemedicine visit constitutes ePHI, so the increase in telemedicine further increases the amount of PHI that is also ePHI.

175

See

“Determination That A Public Health Emergency Exists Nationwide as the Result of the 2019 Novel Coronavirus,” Administration for Strategic Preparedness & Response, U.S. Department of Health and Human Services (Jan. 31, 2020),

https://aspr.hhs.gov/legal/PHE/Pages/2019-nCoV.aspx;

“Renewal of Determination that a Public Health Emergency Exists As a Result of the Continued Consequences of the Coronavirus Disease 2019 (COVID-19) Pandemic,” Administration for Strategic Preparedness & Response, U.S. Department of Health and Human Services (Feb. 9, 2023),

https://aspr.hhs.gov/legal/PHE/Pages/COVID19-9Feb2023.aspx;

“Notification of Enforcement Discretion for Telehealth Remote

Communications During the COVID-19 Nationwide Public Health Emergency,” Office for Civil Rights, U.S. Department of Health and Human Services (Jan. 20, 2021),

https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html.

176

Yuriy Pylypchuk, et al., “ONC Data Brief: Use of Telemedicine among Office-Based Physicians, 2021,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 1 (Mar. 2023),

https://www.healthit.gov/sites/default/files/2023-04/DB65_TelemedicinePhysicians_508.pdf.

It is not only the ePHI maintained in EHRs and other electronic recordkeeping systems that faces security risks. Medical equipment and devices are increasingly connected through one or more networks, which means that any issues affecting the network likely will affect the medical equipment and devices.

177

And some medical equipment and devices rely on off-the-shelf operating systems, such as Windows, Linux, and similar third-party software;

178

thus, the medical equipment and devices can experience the same vulnerabilities as personal computing devices. Generally, the U.S. Food & Drug Administration (FDA) does not need to review software patches or configuration updates for off-the-shelf software before a device manufacturer puts them in place because the FDA views most patches and configuration updates as design changes that can be made without prior discussion.

179

177

Nduma N. Basil, “Health Records Database and Inherent Security Concerns: A Review of the Literature,” Cureus, p. 3 (Oct. 11, 2022) (“The increase in networked medical equipment and devices implies that, if there is a security breach in the form of hacking, then traffic on the network can slow down and interfere with the delivery of healthcare services.”),

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9647912/.

178

Id.

179

“Guidance Document: Information for Healthcare Organizations about FDA's `Guidance for Industry: Cybersecurity for Networked Medical Devices Containing Off-The-Shelf (OTS) Software,' ” U.S. Food & Drug Administration, U.S. Department of Health and Human Services (Feb. 2005),

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/information-healthcare-organizations-about-fdas-guidance-industry-cybersecurity-networked-medical.

Cybercriminals may use—or target—technology assets, such as software or medical devices used for treating individuals. For example, in 2021, a cyberattack on cloud-based systems supplied by a particular company compromised the ePHI of more than 200,000 individuals and affected the software for linear accelerators used in radiotherapy, leading to disruptions to cancer treatment.

180

Thus, to protect technology assets used for treatment, the information systems that create, receive, maintain, and transmit ePHI also must be protected. As another example, in 2013, the Mayo Clinic

181

hired a group of ethical hackers

182

to identify vulnerabilities in 40 different medical devices.

183

The hackers were able to gain access to all of the devices, meaning that the devices could all be vulnerable to a cyberattack.

184

Such attacks may create an opening for a subsequent attack on the device itself or on the regulated entity's information systems that create, receive, maintain, or transmit ePHI, compromising those information systems and the ePHI itself.

185

It also may lead, intentionally or not, to a loss of device integrity, which could result in the corruption of the device's functionality or the ePHI on the device.

186

A cyberattack on a medical device may also reduce the ability of the authorized person to use the device (

e.g.,

a denial of service attack, which is a type of cyberattack that overloads the device by flooding the network with traffic).

187

Depending on the device and its use, the result of cyberattacks on a medical device could range from little or no effect to serious injury or death.

188

180

Elizabeth Gourd, “Increase in health-care cyberattacks affecting patients with cancer,” The Lancet, p. 1215 (Sept. 2021),

https://doi.org/10.1016/S1470-2045(21)00451-4.

181

See

Mayo Clinic,

https://www.mayoclinic.org/.

182

An “ethical hacker” is a cybersecurity researcher who “use[s] penetration testing techniques to test an organization's cybersecurity and information technology (IT) security.”

See

Ed Tittel, “How to Become a White Hat Hacker,” Business News Daily (June 17, 2024),

https://www.businessnewsdaily.com/10713-white-hat-hacker-career.html.

183

See

Foued Badrouchi, et al., “Cybersecurity Vulnerabilities in Biomedical Devices: A Hierarchical Layered Framework,” Internet of Things Use Cases for the Healthcare Industry, p. 157-58 (2020);

see also

Monte Reel, et al., “It's Way Too Easy to Hack the Hospital,” Bloomberg Businessweek (Nov. 2015),

https://www.bloomberg.com/features/2015-hospital-hack/.

184

See

“Cybersecurity Vulnerabilities in Biomedical Devices: A Hierarchical Layered Framework,”

supra

note 183, p. 157-58.

185

See also

“It's Way Too Easy to Hack the Hospital,”

supra

note 183; Nicole M. Thomasian, et al., “Cybersecurity in the internet of Medical Things,” Health Policy and Technology (Sept. 2021),

https://doi.org/10.1016/j.hlpt.2021.100549.

186

“Cybersecurity in the internet of Medical Things,”

supra

note 185.

187

Id.

188

Id.

According to researchers at Brown University, medical devices are a prime target for cybercriminals. In fact, they believe, “More than just technically feasible, the widespread takedown of medical devices is an imminent threat.”

189

A 2023 Government Accountability Office report on medical device cybersecurity described the importance of “robust cybersecurity controls to ensure medical device safety and effectiveness” because of “the increasing integration of wireless, internet- and network-connected capabilities, and the electronic exchange of health information.”

190

The FDA has also acknowledged, “As electronic medical devices become increasingly connected to each other and to other technologies, the ability of connected systems to safely, securely and effectively exchange and use the information becomes critical. [. . .] Cybersecurity concerns rise along with the increasing medical device interoperability.”

191

Accordingly, in 2023, the FDA issued updated guidance for industry and FDA staff on requirements for cybersecurity in medical devices.

192

189

Id.

190

Report to Congressional Committees, “Medical Device Cybersecurity: Agencies Need to Update Agreement to Ensure Effective Coordination,” U.S. Government Accountability Office, p. 1 (Dec. 2023),

https://www.gao.gov/assets/d24106683.pdf.

191

“Medical Device Interoperability,” U.S. Food & Drug Administration, U.S. Department of Health and Human Services,

https://www.fda.gov/medical-devices/digital-health-center-excellence/medical-device-interoperability.

192

Guidance for Industry and Food & Drug Administration Staff, “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions,” U.S. Food & Drug Administration, U.S. Department of Health and Human Services (Sept. 27, 2023),

https://www.fda.gov/media/119933/download.

And then there are digital health applications. When an application is deployed by a covered entity, an application developer may be a business associate and subject to the Security Rule. An application developer may also meet the HIPAA Rules' definition of “health care provider”

193

and be a covered entity.

194

But also, individuals are increasingly interested in accessing their ePHI using applications and transmitting information collected by health and wellness applications to

their health care providers.

195

Such applications may empower individuals to better manage their health and participate in their health care and provide health care providers and researchers with a more holistic view of the individual's health at a particular point in time and over an extended period of time.

196

This technology, while valuable for understanding an individual's overall health, introduces another potential vulnerability to the security of ePHI and the information systems that create, receive, maintain, or transmit it.

193

45 CFR 160.103 (definition of “Health care provider”).

194

Where an application developer meets the HIPAA Rules' definition of health care provider and engages in standard electronic transactions, such as billing an insurance company for its services, it is a covered entity for the purposes of the HIPAA Rules, including the Security Rule. Where an application developer is not regulated under the HIPAA Rules, other Federal laws may apply to the application developer or the application, such as the FTC Act.

See, e.g.,

FTC Act (codified at 15 U.S.C. 41-58).

195

See, e.g.,

Kea Turner, et al., “Sharing patient-generated data with healthcare providers: findings from a 2019 national survey,” Journal of the American Medical Informatics Association, p. 371-376 (Nov. 12, 2020),

https://doi.org/10.1093/jamia/ocaa272;

Accenture Federal Services, “Conceptualizing a Data Infrastructure for the Capture, Use, and Sharing of Patient-Generated Health Data in Care Delivery and Research through 2024,” The Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, p. 5 (Jan. 2018),

https://www.healthit.gov/sites/default/files/onc_pghd_final_white_paper.pdf; see also

Jolaade Kalinowski, et al., “Smart device ownership and use of social media, wearable trackers, and health apps among Black women with hypertension in the United States,” JMIR Cardio (pre-print),

https://preprints.jmir.org/preprint/59243.

196

See

“Conceptualizing a Data Infrastructure for the Capture, Use, and Sharing of Patient-Generated Health Data in Care Delivery and Research through 2024,”

supra

note 195, p. 1; Asos Mahmood, et al., “mHealth Apps Use and Their Associations With Healthcare Decision-Making and Health Communication Among Informal Caregivers: Evidence From the National Cancer Institute's Health Information National Trends Survey,” American Journal of Health Promotion, p. 40-52 (Jan. 2024),

https://journals-sagepub-com.hhsnih.idm.oclc.org/doi/10.1177/08901171231202861.

EHRs, networked medical devices, and applications are only the beginning. Artificial intelligence (AI) in health care, particularly for diagnosis and treatment, is in the nascent stages of development, but many are eager to test its promise.

197

After all, many experts believe that AI promises opportunities to improve patient care, outcomes, and population health, as well as to reduce costs.

198

The use of AI in health care is increasing and is expected to continue to increase.

199

A 2023 Healthcare Information and Management Systems Society (HIMSS) survey of health care cybersecurity professionals reported that approximately 50 percent of respondents' organizations permitted the use of generative AI technology.

200

And other new technologies are expected shortly, as discussed below. For example, according to reports, quantum computing may be available in the near future, which may have ramifications for data privacy and security.

201

We also know that researchers are exploring methods for storing ePHI in biological material (

e.g.,

DNA).

202

197

See

88 FR 75191 (Nov. 1, 2023); Ritu Agarwal, et al., “Augmenting physicians with artificial intelligence to transform healthcare: Challenges and opportunities,” Journal of Economics & Management Strategy, p. 360-374 (Mar. 2024),

https://onlinelibrary-wiley-com.hhsnih.idm.oclc.org/doi/10.1111/jems.12555;

Becca Beets, et al., “Surveying Public Perceptions of Artificial Intelligence in Health Care in the United States: Systematic Review,” Journal of Medical internet Research (2023),

https://doi.org/10.2196/40337.

198

Michael E. Matheny, et al., “Artificial Intelligence in Health Care: A Report from the National Academy of Medicine,” Journal of the American Medical Association, p. 509-10 (2020),

https://jamanetwork-com.hhsnih.idm.oclc.org/journals/jama/fullarticle/2757958.

199

“2023 HIMSS Healthcare Cybersecurity Survey,” Healthcare Information and Management Systems Society, p. 19 (Mar. 1, 2024),

https://www.himss.org/sites/hde/files/media/file/2024/03/01/2023-himss-cybersecurity-survey-x.pdf.

200

Id.

at 16; Generative AI is a type of software that “uses statistical models that generalize the patterns and structures of existing data to either reorganize existing data or create new content.” “Risk In Focus: Generative A.I. And The 2024 Election Cycle,” Cybersecurity & Infrastructure Security Agency, U.S. Department of Homeland Security,

https://www.cisa.gov/sites/default/files/2024-05/Consolidated_Risk_in_Focus_Gen_AI_ElectionsV2_508c.pdf.

201

“2023 HIMSS Healthcare Cybersecurity Survey,”

supra

note 199, p. 22.

202

See

Lizzie Roehrs, “CSL Professor explores DNA as data storage,” University of Illinois Urbana-Champaign The Grainger College of Engineering Coordinated Science Laboratory (Aug. 25, 2020),

https://csl.illinois.edu/news-and-media/csl-professor-explores-dna-data-storage;

Cheng Kai Lim, et al., “A biological camera that captures and stores images directly into DNA,” nature communications (July 3, 2023),

https://www.nature.com/articles/s41467-023-38876-w;

Devasier Bennet, et al., “Current and emerging opportunities in biological medium-based computing and digital data storage,” Nano Select, p. 883 (May 2022),

https://doi-org.hhsnih.idm.oclc.org/10.1002/nano.202100275.

While the promise of these new technologies is exciting, they come with increased risks and vulnerabilities to ePHI and the information systems that create, receive, maintain, or transmit it. As noted by Executive Order (E.O.) 14110, “[AI] must be safe and secure. Meeting this goal requires [. . .] addressing AI systems' most pressing security risks—including with respect to biotechnology, cybersecurity, critical infrastructure, and other national security dangers—while navigating AI's opacity and complexity.”

203

For these reasons, the E.O. required the Secretary of HHS, in consultation with the Secretary of Defense and the Secretary of Veterans Affairs, to establish an HHS AI Task Force to develop a strategic plan that includes policies and frameworks on responsible deployment and use of AI and AI-enabled technologies in the health and human services sector, including the incorporation of safety, privacy, and security standards into the software-development lifecycle for the protection of personally identifiable information, such as measures to address AI-enhanced cybersecurity threats in the health and human services sector.

204

The Department has taken a number of actions to address the use of AI in health care, including establishing an AI Council, appointing a Chief AI Officer,

205

and taking steps to regulate the use of AI in health care.

206

Accordingly, regulated entities must be prepared to identify, mitigate, and remediate such risks and vulnerabilities.

203

88 FR 75191 (Nov. 1, 2023).

204

Id.

at 75214.

205

See

“HHS Artificial Intelligence (AI) Strategy: AI Council & AI Community of Practice,” U.S. Department of Health and Human Services (June 6, 2024),

https://www.hhs.gov/programs/topic-sites/ai/strategy/index.html;

“About the HHS Office of the Chief Artificial Intelligence Officer (OCAIO),” U.S. Department of Health and Human Services (June 6, 2024),

https://www.hhs.gov/programs/topic-sites/ai/ocaio/index.html; see also

“Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence,” M-24-10, Office of Management and Budget, Executive Office of the President (Mar. 28, 2024),

https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf.

206

See, e.g.,

89 FR 37522, 37642 (May 6, 2024) and 89 FR 1192, 1244 (Jan. 9, 2024).

While the health care industry has generally shifted from paper record-keeping and non-interoperable electronic devices to an interconnected electronic health care system, it has led to an increasing vulnerability to breaches of unsecured PHI resulting from unauthorized uses and disclosures and cyberattacks. According to an article published by the American Hospital Association Center for Health Innovation, “Health care organizations are particularly vulnerable and targeted by cyberattacks because they possess so much information of high monetary and intelligence value to cyber thieves and nation-state actors.”

207

In fact, “[. . .] on the dark web, PHI is deemed more

valuable than credit card data, enabling cybercriminals to extract as much as [$1,000] per stolen medical record.”

208

Before this shift to an interconnected electronic system, lost or misplaced paper records or even a laptop could lead to a breach of unsecured PHI affecting hundreds or thousands of individuals.

209

While a breach of that size remains significant, unauthorized access to a single workstation today could lead to a breach that affects millions of individuals because of the increase in interconnectivity.

210

207

John Riggi, “The importance of cybersecurity in protecting patient safety,” American Hospital Association Center for Health Innovation,

https://www.aha.org/center/cybersecurity-and-risk-advisory-services/importance-cybersecurity-protecting-patient-safety

; In 2016, PHI was valued at 50 times the worth of financial information on the black market. Diane Doebele Koch, “Is the HIPAA Security Rule Enough to Protect Electronic Personal Health Information (PHI) in the Cyber Age?” Journal of Health Care Finance, p. 22 (Spring 2016) (citing Beth Kutscher, “Healthcare underspends on Cybersecurity as attacks accelerate,” Modern Healthcare (Mar. 3, 2016),

https://www.modernhealthcare.com/article/20160303/NEWS/160309922/healthcare-underspends-on-cybersecurity-as-attacks-accelerate

.); “New Dangers in the New World: Cyber Attacks in the Healthcare Industry,”

supra

note 135, p. 3 (“[. . .] stolen medical data sells for 10-20 times more than credit card data.”).

208

Gilbert Munoz-Cornejo, et al., “Analyzing the urban-rural divide: the role of location, time, and breach characteristics in U.S. hospital security incidents, 2012-2021,” Discover Health Systems (June 17, 2024),

https://link.springer.com/article/10.1007/s44250-024-00105-6#:~:text=Specifically%2C%20our%20study%20shows%20that,trend%20of%20breaches%20over%20time.

209

Lynne Coventry, et al., “Cybersecurity in healthcare: A narrative review of trends, threats and ways forward,” Maturitas, p. 46 (July 2018),

https://www.maturitas.org/article/S0378-5122(18)30165-8/abstract.

210

Id.

Between 2018 and 2023, the number of breaches of unsecured PHI reported to the Department grew at an alarming rate (100 percent increase), as did the number of individuals affected by such breaches (950 percent increase).

211

The reports reflect rampant escalation of cyberattacks using hacking (260 percent increase) and ransomware (264 percent increase).

212

Based on reports made to OCR, in 2022, approximately three-fourths of the breaches of unsecured PHI affecting 500 or more individuals were the result of hacking of electronic equipment or a network server.

213

In 2023, over 160 million individuals were affected by breaches involving the PHI of 500 or more individuals—a new record. We anticipate that 2024 will surpass that record, particularly in light of the estimate provided by a large covered entity regarding the number of individuals affected by a breach of its subsidiary.

214

211

See

“Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information,”

supra

note 10.

212

Id.

213

“Annual Report to Congress on Breaches of Unsecured Protected Health Information: For Calendar Year 2022,” Office for Civil Rights, U.S. Department of Health and Human Services, p. 8-9 (2022),

https://www.hhs.gov/sites/default/files/breach-report-to-congress-2022.pdf.

214

Change Healthcare is a health care clearinghouse and a subsidiary of UnitedHealth Group,

https://www.changehealthcare.com/.

On the morning of Feb. 21, 2024, Optum (another subsidiary of UnitedHealth Group) reported that it was “experiencing enterprise-wide connectivity issues.” By that afternoon, the announcement changed to a “network interruption related to a cyber security issue” and explained that “[o]nce [Change Healthcare] became aware of the outside threat, in the interest of protecting our partners and patients, we took immediate action to disconnect our systems to prevent further impact.”

See

“Optum Solution Status,” Optum, Inc., UnitedHealth Group,

https://solution-status.optum.com/incidents/hqpjz25fn3n7

(last accessed on July 16, 2024). On Mar. 13, 2024, the Department announced that it would be initiating an investigation into the incident.

See

Letter from OCR Director Melanie Fontes Rainer to Colleagues (Mar. 13, 2024),

https://www.hhs.gov/sites/default/files/cyberattack-change-healthcare.pdf.

Andrew Witty, UnitedHealth Group Chief Executive Officer, in his testimony to Congress, estimated that the breach of Change Healthcare may involve the PHI of one-third of Americans. “Hacking America's Health Care: Assessing the Change Healthcare Cyber Attack and What's Next,” Subcommittee on Oversight and Investigations of the Committee on Energy and Commerce, Hearing Before the Committee on Finance (May 1, 2024),

https://www.finance.senate.gov/hearings/hacking-americas-health-care-assessing-the-change-healthcare-cyber-attack-and-whats-next.

Change Healthcare filed its breach report with the Department on July 19, 2024. “Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information,”

supra

note 10. Change Healthcare's breach report currently identifies 100 million individuals as the “approximate number of individuals affected.”

https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.

However, Change Healthcare is still determining the number of individuals affected. The posting on the HHS Breach Portal will be amended if Change Healthcare updates the total number of individuals affected by this breach. “Change Healthcare Cybersecurity Incident Frequently Asked Questions,” Office for Civil Rights, U.S. Department of Health and Human Services,

https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html.

In 2023, the Federal Bureau of Investigation's internet Crime Complaint Center received almost 250 reports of ransomware affecting the Healthcare and Public Health sector, the most of any of the 16 identified infrastructure sectors.

215

The Healthcare and Public Health sector has been the most targeted critical infrastructure sector since at least as far back as 2015.

216

Between 2015 and 2019, cyberattacks on health care organizations increased by 125 percent.

217

And between 2022 and 2023, ransomware attacks against the U.S. health care sector increased 128 percent.

218

215

“internet Crime Report,” internet Crime Complaint Center, Federal Bureau of Investigation, p. 13 (2023),

https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf.

216

“Report on Improving Cybersecurity In The Health Care Industry,”

supra

note 117, p. 16.

217

Chon Abraham, et al., “Muddling through cybersecurity: Insights from the U.S. healthcare industry,”

supra

note 116, p. 539-548, 540.

218

“Ransomware Attacks Surge in 2023; Attacks on Healthcare Sector Nearly Double,” The Cyber Threat Intelligence Integration Center, Office of the Director of National Intelligence (Feb. 28, 2024),

https://www.dni.gov/files/CTIIC/documents/products/Ransomware_Attacks_Surge_in_2023.pdf.

Many people, including regulated entities, inaccurately believe that only large regulated entities that maintain electronic records about millions of individuals are likely to face a cyberattack, and thus that it is less important for smaller regulated entities to invest resources in cybersecurity.

219

In fact, smaller regulated entities may also be the target of, or adversely affected by, cybercrime, partly because of the interconnectedness of health care and partly because they are less likely to have invested in cybersecurity, making them easier targets.

220

219

“Report on Improving Cybersecurity In The Health Care Industry,”

supra

note 117, p. 14.

220

Id.

As explained in a recent national security memorandum, cybercriminals are targeting critical infrastructure (

i.e.,

the physical and virtual assets and systems so vital to the Nation that their incapacity or destruction would have a debilitating impact on national security, national economic security, or national public health or safety), and their activities may be tolerated or enabled by other countries.

221

Thus, it is essential that the Department and regulated entities take steps to safeguard health care infrastructure and ePHI.

221

Presidential Memorandum on National Security Memorandum on Critical Infrastructure Security and Resilience

supra

note 11.

External actors are not the only, or even the greatest, threat to the security of ePHI. According to a recent study, insiders were the second leading cause of breaches in the health care sector in 2023, exceeded only by “miscellaneous errors,” such as misdelivery.

222

For example, a recent settlement resolved an OCR investigation involving the theft and sale of the ePHI of more than 12,000 patients by an employee of a large health care system.

223

In another example, security guards at a large health care provider were alleged to have used their login credentials to inappropriately access ePHI.

224

Thus, it is critical that regulated entities improve their cybersecurity posture to protect not only against external threats but also

internal ones, and both intentional and accidental breaches.

222

“2024 Data Breach Investigations Report: Healthcare Snapshot,” Verizon Business, p. 12 (May 1, 2024) (The report describes misdelivery as sending information to the wrong recipient, whether by electronic or physical means),

https://www.verizon.com/business/resources/reports/dbir/2024/industries-intro/healthcare-data-breaches/.

223

Press release, “HHS' Office for Civil Rights Settles Malicious Insider Cybersecurity Investigation for $4.75 Million,” Office for Civil Rights, U.S. Department of Health and Human Services (Feb. 6, 2024),

https://www.hhs.gov/about/news/2024/02/06/hhs-office-civil-rights-settles-malicious-insider-cybersecurity-investigation.html.

224

Press release, “Snooping in Medical Records by Hospital Security Guards Leads to $240,000 HIPAA Settlement,” Office for Civil Rights, U.S. Department of Health and Human Services (June 15, 2023),

https://www.hhs.gov/about/news/2023/06/15/snooping-medical-records-by-hospital-security-guards-leads-240-000-hipaa-settlement.html.

Emergencies or other occurrences can affect the security of ePHI without an intentional act. For example, in 2024, CrowdStrike released a defective update for its software on computers running Microsoft Windows.

225

This update affected the ability of regulated entities to access the ePHI of millions of individuals for varying periods of time. During this time, ePHI was unavailable, meaning that one of the key prongs of the security triad of confidentiality, integrity, and availability was affected.

226

Because of the increased digitization of PHI, it is, for example, essential that covered health care providers engage in thoughtful contingency planning that considers how they will proceed in the event that they are unable to access ePHI in their EHRs. Additionally, threat actors will often seek to take advantage of such incidents. As reported by a large subcontractor of a business associate, less than a week after the outage, the company “observed threat actors leveraging the event to distribute” ransomware.

227

The environment in which health care is delivered, the way in which it is delivered, and the manner in which related information is collected all mean that regulated entities must consider a different approach to operational continuity and resiliency in the face of such challenges. Additionally, they must be wary of the potential for bad actors to attempt to take advantage of such events.

225

“Remediation and Guidance Hub: Falcon Content Update for Windows Hosts,” CrowdStrike,

https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/.

226

See

“Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events,” NIST Special Publication 1800-26A, National Institute of Standards and Technology, U.S. Department of Commerce, p. 1 (Dec. 2020),

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-26.pdf.

227

“Likely eCrime Actor Uses Filenames Capitalizing on July 19, 2024, Falcon Sensor Content Issues in Operation Targeting LATAM-Based CrowdStrike Customers,” CrowdStrike Blog (July 20, 2024),

https://www.crowdstrike.com/blog/likely-ecrime-actor-capitalizing-on-falcon-sensor-issues/.

C. Regulated Entities' Compliance With the Requirements of the Security Rule Is Inconsistent

Despite the proliferation of cybersecurity standards, guidelines, best practices, methodologies, procedures, and processes and the documented increase in unauthorized uses and disclosures of ePHI, many regulated entities have been slow to strengthen their security measures to protect ePHI and their information systems that create, receive, maintain, or transmit it in this new environment.

228

Among the reasons for this are the rapid pace of EHR adoption and digitization of health care, increased connectivity and use of cloud-based infrastructures, limited competition and a stable customer base, limited operating margins, and a failure to invest in cybersecurity infrastructure.

229

For example, regulated entities continue to rely on legacy systems and software that are unsupported by manufacturers, which means that the manufacturers no longer provide security patches or other updates to address security threats and vulnerabilities.

230

In a 2021 survey of health care cybersecurity professionals, 73 percent reported having legacy operating systems.

231

This apparent lack of urgency in adopting new, supported operating systems has serious implications for the confidentiality, integrity, and availability of ePHI.

228

Letter from NCVHS Chair Jacki Monson (2023),

supra

note 123, p. 2 (explaining that NCVHS conducted an inquiry into whether compliance with the Security Rule had improved since the Department released the results of its 2016-2017 audit of selected provisions of the Security Rule and found that “not much had changed”); “Muddling through cybersecurity: Insights from the U.S. healthcare industry,”

supra

note 116, p. 540 (“There is enough evidence to suggest that U.S. healthcare organizations lack a deliberate, organized, and comprehensive cyber-resilience strategy.”).

229

See

Susan Kiser, et al., “Ransomware: Healthcare Industry at Risk,” Journal of Business and Accounting, p. 65-66 (Fall 2021); Meghan Hufstader Gabriel, “Data Breach Locations, Types, and Associated Characteristics Among US Hospitals,” American Journal of Managed Care, p. 78 (Feb. 2018); “Is the HIPAA Security Rule Enough to Protect Electronic Personal Health Information (PHI) in the Cyber Age?”

supra

note 207, p. 20-23.

230

Chris Hayhurst, “On Guard: Staying Vigilant Against Medical Device Vulnerabilities,” Biomedical Instrumentation & Technology, Volume 54, Issue 3, p. 169 (May/June 2020); “Report on Improving Cybersecurity In The Health Care Industry,”

supra

note 117, p. 2.

231

“2021 HIMSS Healthcare Cybersecurity Survey,” Healthcare Information and Management Systems Society, p. 18 (Jan. 28, 2022),

https://www.himss.org/sites/hde/files/media/file/2022/01/28/2021_himss_cybersecurity_survey.pdf.

In addition, many regulated entities fail to invest adequate resources in cybersecurity. Far too many regulated entities do not view cybersecurity as a necessary component of their operations that allows them to fulfill their health care missions. Anecdotal evidence suggests that senior management often lacks awareness of cybersecurity, including both threats and methods for protecting against such threats.

232

“A lack of maturity and effectiveness of the [information technology] function is evident when healthcare organizations fail to maintain a current inventory of sensitive and valuable data and where those reside.”

233

While maintaining an accurate and thorough inventory of technology assets is not currently an explicit requirement of the Security Rule, it is clearly a fundamental component of conducting a risk analysis and many of the other existing requirements.

234

And yet, based on the Department's experience, many regulated entities are not maintaining such an inventory. At least in part because of senior management's lack of cybersecurity awareness, many fail to invest or fail to invest appropriately in cybersecurity infrastructure.

235

Given the vulnerability of ePHI and the information systems of regulated entities and the potential effects of cyberattacks on patient safety and the delivery of health care, it is important that regulated entities prioritize such investments.

236

232

“Muddling through cybersecurity: Insights from the U.S. healthcare industry,”

supra

note 116, p. 543.

233

Id.

at 542.

234

See

68 FR 8334, 8352 (Feb. 20, 2003). In the preamble to the 2003 Security Rule, the Department explained that it had determined that an inventory requirement was unnecessary because it is redundant of other requirements. We assumed that covered entities (and later all regulated entities) would have performed this activity by virtue of having implemented the security measures required under the security management process standard.

235

“Muddling through cybersecurity: Insights from the U.S. healthcare industry,”

supra

note 116, p. 542-543.

236

Eric C. Reese, “Healthcare's cybersecurity stakes reach alarming levels,” Health Facilities Management Magazine, Volume 76, Issue 8, p. 22 (Nov. 2022).

The security of ePHI also is at risk because, despite our explanation of the Security Rule's structure in 2003,

237

regulated entities are not fully complying with the standards and implementation specifications. From 2016 to 2017, the Department conducted audits of 166 covered entities and 41 business associates regarding compliance with selected provisions of the HIPAA Rules, including the required implementation specifications for risk analysis

238

and risk management.

239

The Department found that most regulated entities failed to implement the Security Rule requirements for risk analysis and risk management, requirements that are fundamental to protecting the confidentiality, integrity, and availability of ePHI.

240

While most of the audited business associates reported not having experienced any breaches of unsecured PHI, we found that those that

had experienced a breach generally engaged in minimal or negligible efforts to address the risk analysis and risk management requirements.

241

According to the report, at that time only 14 percent of covered entities and 17 percent of business associates were “substantially fulfilling their regulatory responsibilities to safeguard ePHI they [held] through risk analysis activities,”

242

while 94 percent of covered entities and 88 percent of business associates “failed to implement appropriate risk management activities sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.”

243

The report specifically noted that the audit results were consistent with the findings of OCR's compliance reviews and complaint investigations.

244

237

68 FR 8334, 8343 (Feb. 20, 2003).

238

45 CFR 164.308(a)(1)(ii)(A).

239

45 CFR 164.308(a)(1)(ii)(B); “2016-2017 HIPAA Audits Industry Report,”

supra

note 121, p. 4.

240

“2016-2017 HIPAA Audits Industry Report,”

supra

note 121, p. 4.

241

Id.

at 11.

242

Id.

at 27.

243

Id.

at 30.

244

Id.

at 27 and 30.

Recent enforcement actions provide evidence that the results of the 2016-2017 audits were not isolated cases. In 2023, OCR entered into seven resolution agreements with regulated entities after investigations indicated that they had potentially violated the Security Rule, constituting almost half of the total resolution agreements OCR entered into that year.

245

In each case, OCR's investigation found evidence of multiple potential violations. For example, in one case, a regulated entity did not detect an intrusion into its network until 20 months later when its files were encrypted with ransomware.

246

OCR's investigation found evidence of potential failures of the regulated entity to conduct a risk analysis or to sufficiently monitor information system activity. OCR also found evidence that the regulated entity may not have had policies and procedures in place to implement the requirements of the Security Rule to protect the confidentiality, integrity, and availability of ePHI.

247

245

See

“OCR News Releases & Bulletins,” Office for Civil Rights, U.S. Department of Health and Human Services,

https://www.hhs.gov/ocr/newsroom/index.html.

246

See

Resolution Agreement, “Doctors' Management Services, Inc.,” Office for Civil Rights, U.S. Department of Health and Human Services (Oct. 31, 2023),

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/dms-ra-cap/index.html;

Press Release, “HHS' Office for Civil Rights Settles Ransomware Cyber-Attack Investigation,” Office for Civil Rights, U.S. Department of Health and Human Services (Oct. 31, 2023),

https://www.hhs.gov/about/news/2023/10/31/hhs-office-civil-rights-settles-ransomware-cyber-attack-investigation.html; see also

“Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information,”

supra

note 10.

247

“HHS' Office for Civil Rights Settles Ransomware Cyber-Attack Investigation,”

supra

note 246.

As another example, an OCR investigation of a large health care system found indications of multiple potential violations of the Security Rule, including failures by the regulated entity to conduct a risk analysis, monitor and safeguard its electronic information systems, and implement policies and procedures to record and examine activity in its electronic information systems containing ePHI.

248

The regulated entity was not only unable to prevent the cyberattack, but it was unaware the attack had occurred until two years later. This is despite the long-standing requirements of the Security Rule and the obligations imposed on regulated entities for risk analysis and risk management.

248

See

Resolution Agreement, “Montefiore Medical Center,” Office for Civil Rights, U.S. Department of Health and Human Services (Nov. 17, 2023),

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/montiefore/index.html;

“HHS' Office for Civil Rights Settles Malicious Insider Cybersecurity Investigation for $4.75 Million,”

supra

note 223.

Despite the long-standing nature of the Security Rule and the proliferation of guidance documents from NIST, the Department, CISA, FTC, and others, regulated entities continue to fail to implement reasonable and appropriate security measures as required by the Security Rule.

249

For example, the Security Rule and NIST guidance have addressed encryption for data in transit and at rest for many years.

250

And yet, in the 2021 survey of health care cybersecurity professionals, only half of the respondents reported having implemented encryption for data in transit across the enterprise.

251

Similarly, according to its CEO, a large covered entity failed to deploy multi-factor authentication (MFA) throughout its enterprise and experienced a significant breach.

252

If this is accurate, it would run counter to long-standing provisions in both the Security Rule and NIST guidance; the Security Rule has required the implementation of appropriate access controls since 2003 and NIST recommends similar controls.

253

249

“Muddling through cybersecurity: Insights from the U.S. healthcare industry,”

supra

note 116, p. 541; “Start with Security: A Guide for Business,”

supra

note 17.

250

See

45 CFR 164.312(a)(1) and (e)(1); PR.DS-1 and 2, “Framework for Improving Critical Infrastructure Cybersecurity,” Cybersecurity Framework (CSF) Version 1.1, National Institute of Standards and Technology, U.S. Department of Commerce (Apr. 16, 2018),

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf;

PR.DS-01 and 02, “The NIST Cybersecurity Framework (CSF) 2.0,”

supra

note 15.

251

“2021 HIMSS Healthcare Cybersecurity Survey,”

supra

note 231, p. 23.

252

See

“Hacking America's Health Care: Assessing the Change Healthcare Cyber Attack and What's Next,”

supra

note 214 (According to CEO Andrew Witty, intruders used compromised credentials to remotely access an application used to enable remote access to desktops, which did not have MFA.). The Department's investigation into the Change Healthcare breach is ongoing, and no conclusion has been reached with respect to its cause or whether Change Healthcare was in violation of the Security Rule.

253

45 CFR 164.308(a)(4)(ii)(B) and 164.312(a)(1); “The NIST Cybersecurity Framework (CSF) 2.0,”

supra

note 15; “Framework for Improving Critical Infrastructure Cybersecurity,”

supra

note 250.

As another example, based on OCR's investigation experience, some regulated entities are not developing and implementing compliant response plans for security incidents, including those that are breaches of unsecured ePHI under the Breach Notification Rule. Section 164.308(a)(6)(i) establishes the standard that requires regulated entities to implement policies and procedures to address security incidents, while 45 CFR 164.308(a)(6)(ii) includes the implementation specifications for that standard. This requirement, included in the 2003 Final Rule, aligns with the NIST Cybersecurity Framework version 2.0 requirement for incident management.

254

Similarly, NIST Cybersecurity Framework version 1.1 recommended the execution and maintenance of response processes and procedures to ensure response to detected cybersecurity incidents.

255

And yet, when OCR investigates the circumstances surrounding breach reports, OCR continues to find evidence that regulated entities have not implemented policies and procedures to detect and respond to security incidents, leading to significant time lapses between a “successful” security incident

256

and discovery of, and response to, the security incident.

257

Thus, based on the OCR's experience investigating and enforcing the Security Rule, the Department believes that many regulated entities would benefit from additional instruction in regulatory text regarding their compliance obligations to determine how to select security

measures that are reasonable and appropriate for their circumstances.

254

RS.MA, “The NIST Cybersecurity Framework (CSF) 2.0,”

supra

note 15.

255

PR.IP-9, “Framework for Improving Critical Infrastructure Cybersecurity,”

supra

note 250.

256

45 CFR 164.304 (definition of “Security incident”). The definition of security incident includes both attempted and successful incidents. A successful incident is one in which a threat actor is able to, without authorization, access, use, disclose, modify, or destroy information or interfere with system operations in an information system.

257

See, e.g.,

“Montefiore Medical Center,”

supra

note 248.

We are also concerned that recent caselaw has not accurately set forth the steps regulated entities must take to adequately protect the confidentiality, integrity, and availability of ePHI, as required by the statute. Specifically, in the

University of Texas M.D. Anderson Cancer Center

HHS

(“

M.D. Anderson

”), the U.S. Court of Appeals for the Fifth Circuit held, among other things, that the Security Rule does not say anything about how effective a mechanism for encryption must be, nor does it require that an encryption mechanism provide “bulletproof protection” of all systems containing ePHI.

258

Thus, under the court's interpretation, a regulated entity can meet its obligations under the Security Rule concerning encryption and decryption of ePHI by implementing a mechanism to do so, without regard for the effectiveness of the implementation.

259

Additionally, the court noted that the requirement for “a mechanism” does not “prohibit a [regulated] entity from creating `a mechanism' by directing employees to sign an [agreement] that requires the encryption of portable devices.”

260

While the Department disagrees with the court's interpretation that merely requiring employees to sign an agreement to encrypt portable devices is sufficient to comply with its Security Rule obligations to implement a mechanism to encrypt and decrypt ePHI, the Department believes that additional clarity is warranted to ensure that regulated entities understand their obligation to have encryption mechanisms in place and deployed throughout the regulated entity's enterprise to ensure the confidentiality, integrity, and availability of ePHI.

258

University of Texas M.D. Anderson Cancer Center

U.S. Department of Health and Human Services,

985 F.3d 472, 478 (5th Cir. 2021).

259

Id.

260

Id.

Several technical safeguards currently require regulated entities to implement a “mechanism” as part of complying with the associated standard. Given that written policies and procedures alone are insufficient to protect ePHI, and the misinterpretation of what it means to implement a mechanism also could lead to inadequate protection of ePHI, the Department believes that the Security Rule must be revised, consistent with its statutory mandate, as discussed in greater detail above.

D. It Is Reasonable and Appropriate To Strengthen the Security Rule To Address the Changes in the Health Care Environment and Clarify the Compliance Obligations of Regulated Entities

1. Congress and the Department Anticipated That Security Standards Safeguards Would Evolve To Address Changes in the Health Care Environment

By requiring that regulated entities maintain reasonable and appropriate safeguards to protect against reasonably anticipated threats or hazards or unauthorized uses or disclosures of ePHI, Congress clearly anticipated that the administrative, physical, and technical safeguards implemented to protect the security of ePHI would need to change in response to changes in the environment in which health care is provided.

261

As the health care environment and the operations of regulated entities evolve, so must the protections for ePHI and the information systems used to create, receive, maintain, or transmit it. For example, regulated entities must be expected to adopt safeguards that address new risks to the security of ePHI, such as those posed by maintaining ePHI in the cloud; the connection of medical devices and other technology to networks; and the connection of information systems used to create, receive, maintain, or transmit ePHI to the same networks as those do not perform such activities. After all, it is reasonable to anticipate that there will be new threats or hazards to ePHI or efforts by unauthorized persons to use or disclose such ePHI in an increasingly connected environment.

261

Sec. 1173(d)(2)(B) of Pub. L. 104-191, 110 Stat. 2026 (Aug. 21, 1996) (codified at 42 U.S.C. 1320d-2).

By design, the Security Rule sets a national floor for the security measures that regulated entities are required to implement to protect the confidentiality, integrity, and availability of ePHI. In 2003, the Department opted to frame the standards in terms that were as generic as possible and in a manner that enabled the standards to be met through various approaches or technologies to ensure that regulated entities had the flexibility to determine how best to protect the confidentiality, integrity, and availability of ePHI based on their specific circumstances.

262

When we extended the Security Rule in 2013 to directly apply to business associates in accordance with the HITECH Act,

263

the Department acknowledged that some business associates might not have engaged in the formal administrative safeguards required by the Security Rule, and we made it clear that business associates would be expected to do so going forward.

264

Despite the changes in the health care environment between 2003 and 2013, the Department made minimal changes to the Security Rule at that time because we believed that the compliance obligations of regulated entities were clear and well-understood. In fact, when a commenter recommended that the Department remove the “addressable” designation from the Security Rule because it leads to ambiguity in the rule's application, we declined to do so at that time because we were concerned that it would reduce the rule's scalability and flexibility.

265

However, as we noted in 2003, the rule's flexibility of approach is primarily provided for in paragraph (b)(2) of 45 CFR 164.306 and in the standards themselves.

266

The addressability feature merely provided an added level of flexibility

267

in a way that the Department now believes is inadequate to ensure that regulated entities implement reasonable and appropriate security safeguards.

262

68 FR 8334, 8336 (Feb. 20, 2003).

263

42 U.S.C. 17931(a); 78 FR 5566 (Jan. 25, 2013).

264

78 FR 5566 (Jan. 25, 2013).

265

Id.

at 5591.

266

See

68 FR 8334, 8341 (Feb. 20, 2003).

267

Id.

at 8344.

Changes to the health care environment and the operations of regulated entities have increased the importance of implementing strong security measures to protect ePHI and the information systems that create, receive, maintain, or transmit it. While we recognize the burdens posed by such implementation on regulated entities, there is also a clearly documented increase in the number of breaches of unsecured PHI and instances of cybercriminals accessing ePHI without authorization at regulated entities. The changes to the health care environment, including the increase in breaches and cyberattacks, and operations of regulated entities have made it increasingly likely that unauthorized persons will seek to obtain ePHI and disrupt the U.S. health care system. Additionally, the clearly documented failure of regulated entities to fully implement the policies and procedures required by the Security Rule and apply the required security measures throughout their operations has caused the Department to question whether the existing Security Rule should be revised to clarify and strengthen the obligations of regulated entities and revisit our

decision from 2013.

268

In many cases involving a breach of ePHI that OCR has investigated, a breach may not have occurred, or would have been less widespread and disruptive, had the regulated entities fully implemented the provisions of the Security Rule.

269

268

See

“2016-2017 HIPAA Audits Industry Report,”

supra

note 121, p. 4 (“[M]ost covered entities failed to meet the requirements for other selected provisions in the audit, such as adequately safeguarding protected health information (PHI) [. . .] OCR also found that most covered entities and business associates failed to implement the HIPAA Security Rule requirements for risk analysis and risk management.”); “Enforcement Highlights,” Office for Civil Rights, U.S. Department of Health and Human Services,

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html.

269

See, e.g.,

“Montefiore Medical Center,”

supra

note 248; “Doctors' Management Services, Inc.,”

supra

note 246.

2. NCVHS Believes That the Security Standards Evolve To Address Changes in the Health Care Environment

The Department is not alone in believing that the Security Rule should be strengthened to address concerns about whether -regulated entities are sufficiently protecting the confidentiality, integrity, and availability of ePHI. An inquiry conducted by NCVHS between July 2021 and September 2023 reached the same conclusion.

270

During this inquiry, NCVHS listened to the testimony of cybersecurity experts and Department officials. The experts and Department officials “consistently voiced their concerns about the major increase in incidents and, in particular, the widespread lack of robust risk analysis on the part of covered entities and business associates that would lead to prior planning for, and mitigation of, a range of cybersecurity threats.”

271

In response to this inquiry and consistent with their statutory mandate,

272

NCVHS transmitted two letters to the Secretary with recommendations for improving cybersecurity practices in the health care industry, including recommendations for modifying the Security Rule.

273

As part of the explanation for its concerns, NCVHS cited a 2021 survey of acute and ambulatory care organizations that found only 32 percent of those organizations had a comprehensive security program, while only 26 percent of the long-term and post-acute care facilities met the minimum security requirements.

274

Specifically, NCVHS made the following recommendations for improvements to the Security Rule:

270

Letter from NCVHS Chair Jacki Monson (2023),

supra

note 123, p. 2 (detailing the inquiry undertaken by NCVHS into the scope and breadth of security risks and how to best address those challenges).

271

Id.

272

See

42 U.S.C. 1320d-1(f).

273

See

Letter from NCVHS Chair Jacki Monson (2022),

supra note 123;

Letter from NCVHS Chair Jacki Monson (2023),

supra

note 123.

274

See

Letter from NCVHS Chair Jacki Monson (2022),

supra

note 123, p. 4 (citing a survey performed by a College of Healthcare Information Management Executives (CHIME) as explained at Jill McKeon, “32% of Healthcare Organizations Have a Comprehensive Security Program,” Health IT Security (Nov. 22, 2021),

https://healthitsecurity.com/news/32-of-healthcare-organizations-have-a-comprehensive-securityprogram

• Eliminate from the addressable implementation specifications the choice not to implement a specification or alternative, and instead require regulated entities to implement the specification or adopt a documented reasonable alternative.

275

See

Letter from NCVHS Chair Jacki Monson (2022),

supra

note 123, p. 4;

see also

Letter from NCVHS Chair Jacki Monson (2023),

supra

note 123, Appendix p. 1.

• Include specific minimum cybersecurity hygiene requirements that are reflective of modern industry best p

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.