Proposed HIPAA Amendments Will Close Healthcare Security Gaps

HHS has proposed a major revision to the HIPAA Security Rule that would impose stronger baseline cybersecurity requirements on covered entities and business associates — including mandatory multifactor authentication, encryption of PHI at rest and in transit, maintained asset inventories and network maps, documented incident response and recovery plans with 72-hour restoration targets, semiannual vulnerability scans, annual penetration testing, network segmentation, anti-malware defenses, removal of extraneous software, and yearly compliance audits — with an estimated $9 billion first-year cost and a 60-day public comment period before finalization.