News and Analysis

The Department of Health and Human Services (HHS) has proposed updates to the HIPAA Security Rule for the first time since 2013, to improve cybersecurity in healthcare and protect patient data. The changes include mandatory compliance with all security standards for HIPAA-regulated entities, requiring Multi-Factor Authentication, regular risk assessments, improved encryption of electronic health information and stricter penalties for violations, among other measures. Entities must comply within 180 days of the effective date.