By The EHR Association Privacy & Security Workgroup
In our last blog, The Security Snooze Button: HIPAA Security Rule delayed to (at least) July 2027, we outlined the industry response and EHRA’s own positioning on the HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information Notice of Proposed Rulemaking (NPRM) following the removal of the final rule from the current HHS regulatory agenda.
One of our concerns was a set of proposed technical requirements that point to “authoritative sources” for the standards or recommendations that regulated entities must meet, without expressly defining or naming any. Two of the most notable are the encryption and decryption standards (proposed 45 CFR 164.312(b)), which would require encryption consistent with “prevailing cryptographic standards,” and the authentication standard (proposed 45 CFR 164.312(f)), which would require unique passwords consistent with “current authoritative source recommendations”.
We understand why the Office of Civil Rights (OCR) wrote it this way. The Security Rule was designed to be technology-neutral so it stays relevant and enforceable as technology evolves. Topics like these can also be highly complex and context-specific, making it challenging to specify acceptable standards in the first place. But technology neutrality has never stopped HHS from naming sources. HHS’s breach notification guidance has long pointed to specific National Institute for Standards and Technology (NIST) publications to define when PHI is “unusable, unreadable, or indecipherable.” Leaving “authoritative sources” undefined forces regulated entities to guess what compliance means; it creates uneven enforcement and weakens the requirement.
Topics like these can also be highly complex and context-specific, making it challenging to specify acceptable standards in the first place. But technology neutrality has never stopped HHS from naming sources.
The good news is that OCR should not have difficulty solving this problem. There’s no shortage of potential candidates for an authoritative source that could be explicitly cited for these purposes. For example, the NIST Computer Security Resource Center maintains a wide array of publications on cryptographic standards and guidelines, and the Office of the National Coordinator for Health IT (ONC) maintains a library of security standards and patterns, while also enforcing privacy and security standards through certification criteria under its Health IT Certification Program.
However, the ideal approach would be to lean on processes already established for the same essential purpose in statute – the Section 405(d) Program and Healthcare Industry Cybersecurity Practices (HCIP) stemming from directives in Section 405(d) of the Cybersecurity Act of 2015.
Section 405(d) effectively directed HHS to develop and regularly update voluntary cybersecurity guidelines and best practices for health care organizations of all sizes, in collaboration and consistent with NIST, HIPAA, and HITECH. To meet this mandate, HHS convened the Section 405(d) Program and Task Group, supported by a public-private partnership with the Health Sector Coordinating Council’s (HSCC) Cybersecurity Working Group. The result was a set of Healthcare Industry Cybersecurity Practices (HCIP) publications that provide guidance and best practices for healthcare cybersecurity, as envisioned by Section 405(d).
However, the 405(d) Program has produced no new publications since 2024, and the Cornerstone HCIP publications were last updated in 2023.
In our view, the Section 405(d) Program and HCIP are not only tailor-made to serve as an “authoritative source” for these encryption/decryption and information access management policies for passwords, but they’re also statutorily required to do so given the mandates laid out in the Cybersecurity Act of 2015.
In our view, the Section 405(d) Program and HCIP are not only tailor-made to serve as an “authoritative source” for these encryption/decryption and information access management policies for passwords, but they’re also statutorily required to do so given the mandates laid out in the Cybersecurity Act of 2015. This should also be an easy alignment to establish for OCR, considering that guidance on existing recognized security practices explicitly defines 405(d) and HCIP as approved sources for recognized security practices.
Accordingly, as OCR continues to assess the HIPAA Security Rule revisions and craft the next regulatory action – whether it be a final rule or another NPRM as we advocated for in our previous blog – we call on them to incorporate explicit references to the 405(d) Program and HCIP as the authoritative source for these and any other relevant requirements involving reference to external entities for acceptable technical standards or best practices.
Furthermore, we call on HHS to continue investing in and prioritizing the program to serve this purpose, and to provide a reliable, overarching source of summative, holistic guidance on industry security best practices.
