Industry Asks for Clarity on Proposed HIPAA Cybersecurity Rules

**Executive Summary:** The article examines proposed changes to the HIPAA Security Rule intended to address increasing cyberattacks on healthcare (including ransomware and large breaches), summarizes stakeholder concerns about overly broad incident definitions, aggressive patching and testing mandates, required network/asset/data inventories, and the disproportionate cost and operational impact on smaller providers, and advises organizations to begin preparing now by engaging leadership and prioritizing scalable security and risk-management measures.