Data / Federal rules / 2024-30983
HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information
The Health and Human Services Department published this proposed rule in the Federal Register on January 6, 2025. Comments closed on March 7, 2025.
SpecStream is the live web data engine for teams and agents. It reads every rule and proposed rule in the Federal Register each morning, and this page is that reading. Name your industry once and new rules, comment deadlines and effective dates arrive in your sheet, CRM, Slack or agent as they are published.
What the agency says
The Department of Health and Human Services (HHS or "Department") is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Security Standards for the Protection of Electronic Protected Health Information ("Security Rule") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposed modifications would revise existing standards to better protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The proposals in this NPRM would increase the cybersecurity for ePHI by revising the Security Rule to address: changes in the environment in which health care is provided; significant increases in breaches and cyberattacks; common deficiencies the Office for Civil Rights has observed in investigations into Security Rule compliance by covered entities and their business associates (collectively, "regulated entities"); other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and court decisions that affect enforcement of the Security Rule.
Key facts
- Document number
- 2024-30983
- Type
- Proposed rule
- Action
- Notice of proposed rulemaking; notice of Tribal consultation
- Agency
- Health and Human Services Department
- Published
- January 6, 2025
- Comments due
- March 7, 2025
- Dates
- Comments: Submit comments on or before March 7, 2025.
- Regulation ID (RIN)
- 0945-AA22
- Code of Federal Regulations
- 45 CFR 160; 45 CFR 164
- Topics
- Administrative practice and procedure; Computer technology; Drug abuse; Employee benefit plans; Health; Health care; Health facilities; Health insurance; Health professions; Health records; Hospitals; Investigations; Medicaid; Medical research; Medicare; Penalties; Privacy; Public health; Reporting and recordkeeping requirements
- Significant
- Yes, under Executive Order 12866
- Pages
- 125
Other documents from the Health and Human Services Department
Everything from the Health and Human Services Department · Rules on administrative practice and procedure · Rules on computer technology · Rules on drug abuse · Published in January 2025
Read from the Federal Register API, last updated 2026-10-23. The document on federalregister.gov is the official record; dates and dockets can change through later corrections. Free to reuse with credit to SpecStream under CC BY 4.0.