# 2024-30983: Government Finally Notices Healthcare Cybersecurity Is Absolutely Terrible 2024-30983, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, is a Federal Register proposed rule from an unnamed agency published 2025-01-06, effective The effective date of a final rule would be 60 days after publication; regulated entities must comply no later than 180 days from the effective date. The Department proposes to apply the standard compliance date of 180 days after the effective date and to add a transition period for certain business associate contract changes beyond the 180-day compliance period.; PRIA reads it as touching household money (as of 2026-06-11). - Canonical: https://policyrisk.com/federal-register/2024-30983 - As of: 2026-06-11 - Plain-text twin of the page above; the HTML and this file carry the same facts. ## Facts - Document number: 2024-30983 - Title: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information - Type: Proposed Rule - Agencies: unknown - Citation: unknown - Published: 2025-01-06 - Effective: The effective date of a final rule would be 60 days after publication; regulated entities must comply no later than 180 days from the effective date. The Department proposes to apply the standard compliance date of 180 days after the effective date and to add a transition period for certain business associate contract changes beyond the 180-day compliance period. - Comments close: not stated - Significant: no - Touches household money: yes - Regulation identifier numbers: none - Last updated: 2026-06-11 ## In one line Government Finally Notices Healthcare Cybersecurity Is Absolutely Terrible ## Summary The government wants to make sure your electronic health info stays super safe from hackers and mistakes. This update affects doctors, hospitals, and anyone handling electronic health records, asking them to boost their cybersecurity game. They’re asking for feedback by March 7, 2025, so get ready for stronger rules that protect your health data without breaking the bank! ## Abstract The Department of Health and Human Services (HHS or "Department") is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Security Standards for the Protection of Electronic Protected Health Information ("Security Rule") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposed modifications would revise existing standards to better protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The proposals in this NPRM would increase the cybersecurity for ePHI by revising the Security Rule to address: changes in the environment in which health care is provided; significant increases in breaches and cyberattacks; common deficiencies the Office for Civil Rights has observed in investigations into Security Rule compliance by covered entities and their business associates (collectively, "regulated entities"); other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and court decisions that affect enforcement of the Security Rule. ## Effects PRIA read - Encryption of ePHI Becomes Required: mixed, medium. The proposal would expressly require regulated entities to implement a mechanism to encrypt electronic protected health information (ePHI), with only limited exceptions. Encryption is currently an ‘‘addressable’’ implementation option under 45 CFR 164.312(a)(2)(iv); the NPRM would remove the need f… - Inventory and ePHI Mapping Required: mixed, medium. The NPRM would require regulated entities to inventory their technology assets and map how ePHI moves through their information systems so that risk analyses cover the full lifecycle of ePHI. The proposal aims to codify that accurate and thorough risk analysis requires an asset inventory and data-f… - 60/180-Day Deadlines and BAA Transition Period: cost, medium. If finalized, the rule’s effective date would be 60 days after publication; regulated entities must comply with new or modified standards no later than 180 days after that effective date. The Department also proposes a transition provision (45 CFR 164.318) to give regulated entities additional time… ## Related documents - [2026-20735](https://policyrisk.com/federal-register/2026-20735): Extensions of Credit to Insiders, 2026-10-09 - [2026-20790](https://policyrisk.com/federal-register/2026-20790): Application of the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 to the Refunded Portion of Certain Federal Refun…, 2026-10-09 - [2026-20721](https://policyrisk.com/federal-register/2026-20721): Requirements for Additional Traceability Records for Certain Foods: Enforcement Policy for Certain Retail Food Establishments and Restauran…, 2026-10-09 - [2026-20650](https://policyrisk.com/federal-register/2026-20650): Low-Value Shipments, 2026-10-08 - [2026-20660](https://policyrisk.com/federal-register/2026-20660): Optional Practical Training Fees, 2026-10-08 - [2026-20677](https://policyrisk.com/federal-register/2026-20677): Airworthiness Directives; Various Helicopters, 2026-10-08 ## Sources - [2024-30983 on federalregister.gov](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information) - [2024-30983 as published (PDF)](https://www.govinfo.gov/content/pkg/FR-2025-01-06/pdf/2024-30983.pdf) ## Related - [Previous: 2024-31617, Air Quality Designations; KY; Redesignation of the Kentucky Portion of the Loui…](https://policyrisk.com/federal-register/2024-31617) - [Next: 2024-31012, Victims of Crime Act Victim Compensation Grant Program; Withdrawal](https://policyrisk.com/federal-register/2024-31012) - [All Federal Register documents](https://policyrisk.com/federal-register) Source: PRIA, https://policyrisk.com/federal-register/2024-30983 (as of 2026-06-11).