The U.S. Department of Health and Human Services (HHS) is introducing significant updates to HIPAA regulations in response to escalating healthcare data breaches. The new cybersecurity measures, set to be finalized within 60 days, aim to strengthen the protection of patients’ health information.

Key Requirements Under the Proposed Rules:
– Mandatory encryption of protected health information (PHI)
– Implementation of multifactor authentication
– Network segmentation to prevent lateral movement by attackers

The initiative comes amid alarming statistics showing a surge in large-scale healthcare data breaches affecting 500 or more individuals. White House Deputy National Security Adviser Anne Neuberger estimates implementation costs at $9 billion for the first year and $6 billion over the subsequent four years.

This marks the first major update to HIPAA’s security rules since 2013. The urgency for these changes was highlighted by recent incidents, including the Ascension healthcare breach, where 5.6 million individuals’ data was compromised in a Black Basta ransomware attack. The incident forced the healthcare provider to revert to paper records and redirect emergency services.

The HHS emphasizes that while implementation costs are substantial, the price of inaction could be devastating to critical infrastructure, patient safety, and healthcare operations. These updates reflect a crucial modernization of healthcare cybersecurity standards that haven’t been revised in over a decade.