Government Finally Notices Healthcare Cybersecurity Is Absolutely Terrible
Published Date: 1/6/2025
Proposed Rule
Summary
The government wants to make sure your electronic health info stays super safe from hackers and mistakes. This update affects doctors, hospitals, and anyone handling electronic health records, asking them to boost their cybersecurity game. They’re asking for feedback by March 7, 2025, so get ready for stronger rules that protect your health data without breaking the bank!
Analyzed Economic Effects
3 provisions identified: 0 benefits, 1 costs, 2 mixed.
Encryption of ePHI Becomes Required
The proposal would expressly require regulated entities to implement a mechanism to encrypt electronic protected health information (ePHI), with only limited exceptions. Encryption is currently an ‘‘addressable’’ implementation option under 45 CFR 164.312(a)(2)(iv); the NPRM would remove the need for an entity-specific reasoned analysis in most cases by making encryption a requirement.
Inventory and ePHI Mapping Required
The NPRM would require regulated entities to inventory their technology assets and map how ePHI moves through their information systems so that risk analyses cover the full lifecycle of ePHI. The proposal aims to codify that accurate and thorough risk analysis requires an asset inventory and data-flow/mapping of ePHI locations and movement.
60/180-Day Deadlines and BAA Transition Period
If finalized, the rule’s effective date would be 60 days after publication; regulated entities must comply with new or modified standards no later than 180 days after that effective date. The Department also proposes a transition provision (45 CFR 164.318) to give regulated entities additional time beyond the 180-day compliance period specifically to modify business associate agreements or other written arrangements.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Related Federal Register Documents
2026-17767, Promoting Telehealth in Rural America
In this document, the Federal Communications Commission (Commission) seeks comments on the scope of the similar service and rural area comparability requirements, comments on possible improvements to, or replacements of, our existing cost study method of determining rural telecommunications rates, comments on possible methods of promoting the use of lower-cost technologies intended to provide backup services, comments on a proposal to establish an eligible services list for the Rural Health Care (RHC) Program, comments on whether to adopt performance metrics to expedite the processing of RHC Program funding requests, and comments on whether to eliminate the approval requirement of evergreen contracts and an annual report requirement.
2026-17761, Maximizing Efficiencies in Universal Service Administration
In this document, the Federal Communications Commission (Commission) seeks to improve the administration of the Universal Service Fund (USF or Fund) by seeking comment on four areas related to USF administration: current USF administration processes, i.e., the processes used by Universal Service Administrative Company (USAC) to administer the USF and the Commission's oversight of those processes; the structure of USF administration, that is, USAC's role and responsibilities related to USF administration; operating costs associated with USF administration; and the impact of USAC's Board of Directors on USF administration.
2026-17764, Section 898(c) Transition Rule for Allocating Foreign Taxes and Section 960(d)(4) Foreign Tax Credit Disallowance; Correction
The IRS fixed some details in their new rules about how foreign taxes are handled for certain companies, especially after a tax deferral option was removed. If you deal with foreign tax credits or earnings from foreign companies, these changes could affect your tax filings. Comments on these updates are open until September 17, 2026, so now’s the time to speak up!
2026-17774, Consumer and Governmental Affairs Bureau Seeks To Dismiss Twenty-Four Mooted or Outdated Petitions
In this document, the Federal Communications Commission (Commission) seeks to assess the continuing interest in certain petitions that were filed between 2003 and 2023. The Commission plans to dismiss the petitions with prejudice unless a petitioner or other interested party files a letter in the relevant docket specifying that it objects to the dismissal of the petition and the reason for such objection.
2026-17655, Passports: Expanding Online Passport Renewal Overseas
The Department proposes to amend 22 CFR 51.21 by consolidating requirements for persons applying by mail and online in the United States and overseas. This proposed change includes expanding online passport application availability to qualified applicants located in foreign countries. In addition, the Department is proposing to remove the requirement that an applicant's most recently issued passport must have a year or less of remaining validity to qualify to submit an online passport application. Finally, the Department is proposing technical corrections to 51.8(b) to change "on-line" to read "online" for consistency.
2026-17609, Airworthiness Directives; Embraer S.A. Airplanes
The FAA proposes to adopt a new airworthiness directive (AD) for certain Embraer S.A. Model EMB-545 and EMB-550 airplanes. This proposed AD was prompted by the possibility of the Ram Air Turbine (RAT) compartment door seal peeling off and becoming entangled with the RAT rotor. This proposed AD would require replacement of the RAT compartment door seal. The FAA is proposing this AD to address the unsafe condition on these products.
Previous / Next Documents
Previous: 2024-31617, Air Quality Designations; KY; Redesignation of the Kentucky Portion of the Louisville, KY-IN 2015 8-Hour Ozone Nonattainment Area to Attainment
The EPA is saying no to Kentucky’s plan to declare the Kentucky part of the Louisville area as meeting clean air standards for ozone because the area still has pollution problems. This means the area stays on the watch list for ozone pollution, and Kentucky’s plan to keep pollution low isn’t approved yet. People have until February 3, 2025, to share their thoughts on this decision.
Next: 2024-31012, Victims of Crime Act Victim Compensation Grant Program; Withdrawal
The Department of Justice is pulling back a proposed rule that would have changed how victim compensation grants work for states and territories. After hearing thousands of comments, they decided to keep the current guidelines for now and take more time to think it over. No money changes or new rules will happen yet, so things stay steady while they plan next steps.