Government Finally Notices Healthcare Cybersecurity Is Absolutely Terrible
Published Date: 1/6/2025
Proposed Rule
Summary
The government wants to make sure your electronic health info stays super safe from hackers and mistakes. This update affects doctors, hospitals, and anyone handling electronic health records, asking them to boost their cybersecurity game. They’re asking for feedback by March 7, 2025, so get ready for stronger rules that protect your health data without breaking the bank!
Analyzed Economic Effects
3 provisions identified: 0 benefits, 1 costs, 2 mixed.
Encryption of ePHI Becomes Required
The proposal would expressly require regulated entities to implement a mechanism to encrypt electronic protected health information (ePHI), with only limited exceptions. Encryption is currently an ‘‘addressable’’ implementation option under 45 CFR 164.312(a)(2)(iv); the NPRM would remove the need for an entity-specific reasoned analysis in most cases by making encryption a requirement.
Inventory and ePHI Mapping Required
The NPRM would require regulated entities to inventory their technology assets and map how ePHI moves through their information systems so that risk analyses cover the full lifecycle of ePHI. The proposal aims to codify that accurate and thorough risk analysis requires an asset inventory and data-flow/mapping of ePHI locations and movement.
60/180-Day Deadlines and BAA Transition Period
If finalized, the rule’s effective date would be 60 days after publication; regulated entities must comply with new or modified standards no later than 180 days after that effective date. The Department also proposes a transition provision (45 CFR 164.318) to give regulated entities additional time beyond the 180-day compliance period specifically to modify business associate agreements or other written arrangements.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Related Federal Register Documents
2026-20735, Extensions of Credit to Insiders
The FDIC is giving banks and insiders more time to share their thoughts on new rules about loans to insiders by extending the comment deadline to November 4, 2026. These rules aim to keep lending fair and safe, especially when insiders like executives or board members borrow money. If you’re involved with banks or interested in fair lending, now’s your chance to speak up before the final rules are set!
2026-20790, Application of the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 to the Refunded Portion of Certain Federal Refundable Tax Credits; Hearing Cancellation
The IRS canceled a public hearing set for October 14, 2026, about new rules on how certain refunded tax credits count as federal benefits under a 1996 law. This affects individuals who get refundable tax credits, clarifying how those refunds are treated but with no immediate money changes. Since no one signed up to speak, the hearing won’t happen, but the proposed rules are still out for public comment.
2026-20721, Requirements for Additional Traceability Records for Certain Foods: Enforcement Policy for Certain Retail Food Establishments and Restaurants; Draft Guidance for Industry; Availability
The FDA is sharing a draft plan about new food tracking rules that mostly won’t apply to certain stores and restaurants right now. If you run a retail food place or restaurant, you don’t have to worry about extra paperwork just yet, but the FDA wants your feedback by November 23, 2026. This helps them decide the final rules without causing extra costs or hassle for small businesses.
2026-20650, Low-Value Shipments
The U.S. Customs and Border Protection is proposing new rules to make importing low-value goods (under $2,500) easier and more electronic, especially for mail shipments. They want to add new data requirements for carriers and require bonds for some shipments to keep things safe and smooth. If you’re involved in shipping or receiving small packages, get ready to adapt by December 7, 2026, when comments on these changes close.
2026-20660, Optional Practical Training Fees
Starting soon, international students using Optional Practical Training (OPT) will face new fees: $70,000 for their first OPT and $30,000 for any extra OPT periods. This change aims to stop fraud and protect U.S. workers. If you want to share your thoughts, make sure to comment by November 9, 2026!
2026-20677, Airworthiness Directives; Various Helicopters
The FAA wants to update rules for helicopters with radio altimeters because 5G signals in Canada can mess with their readings. Pilots will need to follow new flight manual limits when flying in Canadian airspace to keep things safe. Comments on this change are open until November 23, 2026, and it mainly affects helicopter operators flying near Canada.
Previous / Next Documents
Previous: 2024-31617, Air Quality Designations; KY; Redesignation of the Kentucky Portion of the Louisville, KY-IN 2015 8-Hour Ozone Nonattainment Area to Attainment
The EPA is saying no to Kentucky’s plan to declare the Kentucky part of the Louisville area as meeting clean air standards for ozone because the area still has pollution problems. This means the area stays on the watch list for ozone pollution, and Kentucky’s plan to keep pollution low isn’t approved yet. People have until February 3, 2025, to share their thoughts on this decision.
Next: 2024-31012, Victims of Crime Act Victim Compensation Grant Program; Withdrawal
The Department of Justice is pulling back a proposed rule that would have changed how victim compensation grants work for states and territories. After hearing thousands of comments, they decided to keep the current guidelines for now and take more time to think it over. No money changes or new rules will happen yet, so things stay steady while they plan next steps.