Massive healthcare breaches prompt US cybersecurity rules overhaul

The U.S. Department of Health and Human Services proposes major updates to the HIPAA Security Rule—mandating encryption, multifactor authentication, and network segmentation—to address rising healthcare breaches and ransomware, with an estimated initial-year cost of $9B and $6B over the following four years. Prompted by escalating attacks, including the Black Basta ransomware incident impacting Ascension and 5.6 million individuals, the updates aim to reduce patient safety risks and data exposure across the healthcare sector.