Industry Continues to Push Back on HIPAA Security Rule Overhaul

Executive summary: The article covers industry opposition to the US HHS proposed 2025 updates to the HIPAA Security Rule, highlighting a coalition led by CHIME that calls for the proposal to be withdrawn due to unreasonable implementation deadlines, significant cost and operational burdens, and misalignment with how hospitals operate. It details practical challenges—MFA rollout, network segmentation, patching medical devices, and renegotiating Business Associate Agreements—that could disrupt patient care, and recommends HHS collaborate with providers and consider phased, risk-based, and grant-supported approaches like the Health Care Cybersecurity and Resilience Act to make standards achievable.