Regulations & Laws
Proposed HIPAA Security Rule Changes: What Practices Should Prepare For
HHS has proposed the most significant HIPAA Security Rule update in years. Here is what practices should prepare for now, from asset inventories to MFA.
What is changing
The proposed rule would make many safeguards that were once 'addressable' into firm expectations, including written technology asset inventories, network maps, multi-factor authentication, encryption, and regular vulnerability testing.
Final requirements and timelines depend on the final rule, but the direction is clear.
Start with the basics
Document every device, application, and vendor that touches patient data.
Turn on MFA for email, EHR, and remote access.
Confirm you have a signed Business Associate Agreement with every vendor that handles PHI.
Our free IT & subscription review
Precision's IT team will inventory your systems and subscriptions and recommend HIPAA-compliant options, often at a lower cost than what you pay today.
Related service
Healthcare IT SupportTechnology support designed around the needs of medical practices.
This article is for general information and is not legal advice. Rules change often — confirm current requirements with CMS, your payers, or counsel.