Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

January 2025 Notice of Proposed Rulemaking Brings Notable Changes to HIPAA Security Rule

Client Alert
February 25, 2025

In January 2025, the U. S. Department of Health and Human Services (HHS) filed a Notice of Proposed Rulemaking (NPRM) to amend many portions of the current Health Insurance Portability & Accountability Act (HIPAA) Security Rule. Comments to the proposed rule are due by March 7, 2025.

The broad focus of these proposed changes is on enhancing covered entities’ and business associates’ cybersecurity practices. Because these rule changes were initiated under the Biden Administration, we are unsure whether the current Administration will maintain the rule changes as drafted. However, cybersecurity has historically been a bipartisan issue.

The NPRM proposes the following for HIPAA covered entities (CEs):

1. Requires CEs to conduct a compliance audit at least once every 12 months to ensure compliance with the Security Rule requirements.

2. Requires CEs to annually train workforce members on the following topics:

a. The entity’s written policies and procedures with respect to electronic protected health information (ePHI);

b. Guarding against, detecting, and reporting suspected or known security incidents, including malicious software and social engineering; and

c. The entity’s written policies and procedures for accessing relevant electronic information systems.

3. Requires a CE to terminate a workforce member's access to ePHI within one hour of their employment ending.

4. Requires CEs to perform vulnerability scanning at least every 6 months and penetration testing at least once every 12 months.

5. Requires CEs to conduct and document a Technology Asset Inventory and Network Map of its electronic information systems and all technology assets that may affect the confidentiality, integrity, or availability of ePHI. The inventory must include identification, the person accountable for, and the location of each technology asset.

6. Requires CEs to complete written risk analyses that include a review of the technology asset inventory and network map; identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI; identification of potential vulnerabilities to the CE’s electronic information systems; and an assessment of the risk level for each identified threat and vulnerability to the CE’s ePHI. Currently, the HIPAA Security Rule does not specify a frequency for risk assessments, but the NPRM requires risk assessments to be reviewed and updated annually or when regulatory changes necessitate a risk assessment.

7. Requires CEs to plan for contingencies and how they will respond to security incidents. CEs must:

a. Establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours;

b. Perform an analysis of the relative criticality of their relevant electronic information systems and technology assets to determine the priority for restoration;

c. Establish written security incident response plans and procedures documenting how workforce members are to report suspected or known security incidents and     how  the entity will respond to suspected or known security incidents; and

d. Implement written procedures for testing and revising written security incident response plans.

The proposed rule also sets forth important proposed changes for business associates (BAs). The NPRM requires that BAs verify to CEs at least once every 12 months through a written analysis of the BA’s relevant electronic information systems by a subject matter expert and a written certification that the analysis has been performed and is accurate that they have deployed technical safeguards required by the Security Rule to protect ePHI.

If you have questions about the January 2025 NPRM or HIPAA Security Rule, please contact BMD Member Daphne Kackloudis at dlkackloudis@bmdllc.com or BMD Attorney Jordan Burdick at jaburdick@bmdllc.com.

HIPAAHealthcareHealth LawDaphne KackloudisJordan Burdick
Client Alert

Ohio House Bill 537: Proposed Regulations for Midwives and Birthing Centers

January 28, 2026House Bill 537, introduced in the Ohio House of Representatives, proposes a comprehensive regulatory framework for certified nurse-midwives, certified midwives, licensed midwives, and traditional midwives. The legislation would clarify scope of practice, establish licensure standards, and impose new requirements for freestanding birthing centers and home births. Healthcare providers and facilities should be aware of the proposed changes and their potential operational impact.Client Alert

Proposed Health Information Privacy Reform Act Expands Protections Beyond HIPAA

January 26, 2026The Health Information Privacy Reform Act (HIPRA) seeks to extend privacy protections to health data not covered under HIPAA, including data collected by apps and wearables. HIPRA introduces broader definitions of protected health information, strengthens privacy and security requirements, establishes patient notification rights, and sets national de-identification standards. Companies processing health data should monitor developments to ensure compliance.Client Alert

Medicare Updates on Skin Substitutes: LCDs Withdrawn, Payment Changes Take Effect

January 23, 2026Medicare’s planned Final Local Coverage Determinations (LCDs) for skin substitutes were withdrawn in late December 2025, meaning previous coverage rules remain in effect. The 2026 Medicare Physician Fee Schedule introduces a single payment rate of approximately $127.14 for these products. Providers should review implications for diabetic foot and venous leg ulcer treatments.Client Alert

Understanding the Seven Core Elements of an Effective Healthcare Compliance Program

January 22, 2026The Affordable Care Act requires healthcare providers participating in Medicare, Medicaid, and CHIP to maintain an effective compliance program. Guidance from the Department of Health and Human Services and the Office of Inspector General outlines seven core elements that form the foundation of these programs, from written policies and compliance oversight to auditing, training, and corrective action. This alert highlights each element and explains how practices can tailor compliance programs to their size and risk profile while meeting federal expectations.Client Alert

Preventing a Board Investigation

January 21, 2026Healthcare professionals in Ohio are subject to licensing board investigations that can lead to disciplinary action. Staying compliant with regulations, documenting carefully, and operating within your professional scope can help prevent issues. If contacted by a board, working with an attorney is critical to protect your license and rights.
Older posts
Newer posts