Loading story…
HHS is signaling a more assertive posture on healthcare data governance, including active enforcement of information-blocking rules under the 21st Century Cures Act. In Senate HELP Committee testimony, HHS leadership emphasized improving nationwide health data exchange via TEFCA, noting broad connectivity across tens of thousands of locations and support for hundreds of millions of records, while lawmakers raised concerns that providers, health IT developers, and exchanges continue to impede data flow.
Separately, HHS’ Office for Civil Rights has proposed the first major update to the HIPAA Security Rule in over two decades via a January 2025 Notice of Proposed Rulemaking, driven by escalating cyber threats and healthcare breaches. The proposal would move HIPAA from a flexible, risk-based approach toward more prescriptive requirements, including eliminating the “required” vs. “addressable” distinction for implementation specifications, updating/renumbering citations that will force control-mapping changes, mandating defined review and testing frequencies (often at least annually), and requiring detailed asset inventories, network maps, and data-flow documentation showing where ePHI/PHI is created, stored, processed, and transmitted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By March 2026, OCR had not confirmed whether the proposed HIPAA Security Rule update would be finalized on schedule, delayed, narrowed, or issued at all. Reporting noted it could be finalized as early as May 2026, but the timeline remained uncertain.
Following publication of the proposed rule, healthcare providers and industry groups criticized the proposal over cost, implementation burden, and timing. OCR said it received more than 4,700 comments on the Notice of Proposed Rulemaking.
By June 2025, the proposed HIPAA Security Rule modernization was listed in the federal regulatory agenda under RIN 0945-AA22, indicating HHS/OCR was tracking the rulemaking and targeting further action in December 2025. This provided an interim signal on expected timing between the December 2024 proposal and the later March 2026 uncertainty.
On 2025-01-06, the proposed HIPAA Security Rule update was published in the Federal Register along with HHS's regulatory impact analysis. HHS estimated roughly $9.314 billion in combined first-year compliance costs and said the rule would break even if it reduced breach incidence or per-record breach costs by about 7% to 16%.
On 2024-12-27, the HHS Office for Civil Rights issued a Notice of Proposed Rulemaking to strengthen and modernize the HIPAA Security Rule. The proposal would be the first major overhaul of the rule in more than 20 years and would make requirements more prescriptive.
In January 2024, HHS introduced the voluntary Health Care and Public Health Cybersecurity Performance Goals as part of its broader healthcare cybersecurity strategy. These goals were later cited as context for the proposed HIPAA Security Rule modernization.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcehipaajournal.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcereginfo.gov
Open sourcefederalregister.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Senate Health, Education, Labor, and Pensions (**HELP**) Committee advanced the bipartisan **Health Care Cybersecurity and Resiliency Act** by a 22–1 vote, proposing new baseline cybersecurity requirements for HIPAA-regulated entities. Reported measures include **multifactor authentication**, **data encryption**, **penetration testing**, and **regular security audits**, alongside changes to breach reporting such as requiring entities to report the number of individuals affected and directing HHS to publish post-breach corrective actions and recognized security practices used by the impacted organization. In parallel, HHS’ Office of the National Coordinator for Health IT (**ONC**) proposed reducing health IT certification criteria—cutting from 60 to 34 and modifying seven others—including criteria tied to **privacy and security controls**. Healthcare industry groups (including **CHIME** and the **American Hospital Association**) warned that removing longstanding certification requirements would shift privacy and security compliance burden from health IT developers (e.g., EHR and patient engagement tool vendors) to healthcare providers, potentially weakening standardized security expectations across certified health IT products.
Jun 29, 2026
A bipartisan group of U.S. senators has reintroduced the Health Care Cybersecurity and Resiliency Act of 2025, which aims to enhance cybersecurity protections in the healthcare sector. The proposed legislation includes provisions for updating HIPAA privacy and security regulations, increasing cyber grant funding, expanding workforce training, and improving breach notification requirements. The bill directs the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA) to coordinate efforts to bolster the sector's cyber resilience, reflecting growing concern over the frequency and impact of healthcare data breaches. In parallel, healthcare organizations are reviewing their password management practices to ensure compliance with existing HIPAA Security Rule requirements. While HIPAA does not mandate specific password policies, it expects organizations to implement reasonable procedures for password creation, changes, and protection, as outlined in 45 CFR 164.308(a)(5)(ii)(D). Guidance from HHS and NIST, particularly NIST SP 800-66r2, provides technical recommendations for authentication management and credential safeguarding, underscoring the importance of robust password management in protecting protected health information (PHI).
Jun 29, 2026
Reporting on healthcare security trends indicates **breach incidents increased sharply between 2024 and 2025**, even as the total number of compromised patient records declined, suggesting attackers are increasingly prioritizing **operational disruption** over mass data theft. Drivers cited include **ransomware**, **third‑party/vendor exposure**, and expanding “shadow AI” usage; the same reporting highlights low confidence in vendor risk assessments and in rapid detection/containment/recovery capabilities, reinforcing the need for improved visibility across overlapping technology stacks and more resilient security programs. Separately, the U.S. **HHS Office for Civil Rights (OCR)** stated it will continue HIPAA privacy/security enforcement despite federal office closures, and outlined 2026 priorities that include: continuing the **HIPAA Right of Access** initiative, expanding **Security Rule risk analysis** work into risk management, and emphasizing enforcement actions tied to **hacking and ransomware** (described as the leading driver of large breaches reported to OCR). OCR also noted preparation for a new enforcement program related to confidentiality of substance use disorder treatment records under **42 C.F.R. Part 2**, with breach reports and complaints expected to begin in February 2026.
Jun 29, 2026