HIPAA Security Rule Part Three: Risk-Based and Industry-Aligned Approaches Recommended

By the EHR Association Privacy & Security Workgroup

This three-part blog series shares the EHR Association’s stance on OCR’s proposed changes to the HIPAA Security Rule. Part one focused on our overarching concerns and issues with proposed definitions. Part two and this installment highlight our concerns with OCR’s proposed expectations. 

The HIPAA Security Rule is overdue for modernization, given the rapid pace of technological change and increasing cybersecurity threats. While we support OCR’s intent to strengthen protections for electronic protected health information (ePHI), our analysis of the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information raised concerns and questions we hope will be addressed before finalization.

Read the full post »
Leave a comment
by EHR Association on May 9, 2025  •  Permalink
Posted in Health IT Regulation, Privacy and Security
Tagged , , , ,

Posted by EHR Association on May 9, 2025

https://ehrablog.org/2025/05/09/hipaa-security-rule-part-three-risk-based-and-industry-aligned-approaches-recommended/

HIPAA Security Rule Part Two: Proposed Changes Require Clarity, Flexibility

By the EHR Association Privacy & Security Workgroup

This three-part blog series shares the EHR Association’s stance on OCR’s proposed changes to the HIPAA Security Rule. Part one focused on our overarching concerns and issues with proposed definitions. Part two focuses on several of the proposed standards.

Our analysis of proposed changes to the existing HIPAA Security Rule, released as HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, revealed a mixed bag of positive changes and areas of concern. In the first installment of this blog series, we noted the EHR Association’s appreciation for its enhancements to the cybersecurity baseline. However, we expressed concern about the resources and costs required for regulated entities to comply with the overhauled mandates. We also reviewed the feedback we shared with OCR on its proposed changes to key definitions.

In this installment, we highlight our concerns with several of OCR’s proposed expectations, drawing attention to the need for greater clarity and offering recommendations to ease compliance burdens while achieving intended outcomes. 

Read the full post »
Leave a comment
by EHR Association on April 30, 2025  •  Permalink
Posted in Privacy and Security
Tagged , , , ,

Posted by EHR Association on April 30, 2025

https://ehrablog.org/2025/04/30/hipaa-security-rule-part-two-proposed-changes-require-clarity-flexibility/

HIPAA Security Rule Part One: Proposed Overhaul Closes Some Gaps, Opens Others

By the EHR Association Privacy & Security Workgroup

This three-part blog series shares the EHR Association’s stance on OCR’s proposed changes to the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information. Part one is focused on our overarching concerns and issues with proposed definitions.

Proposed changes to the existing HIPAA Security Rule, released as HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, include some long-overdue updates. However, the resources and costs required by healthcare provider organizations, health IT developers, and other regulated entities to comply with the sweeping changes will be too great for many to bear.

That was one of several important messages we shared with the HHS Office of Civil Rights (OCR) in our comment letter on the proposed rule. 

Read the full post »
Leave a comment
by EHR Association on April 28, 2025  •  Permalink
Posted in Privacy and Security
Tagged , , , , , , , ,

Posted by EHR Association on April 28, 2025

https://ehrablog.org/2025/04/28/hipaa-security-rule-part-one-proposed-overhaul-closes-some-gaps-opens-others/

Core Issues for Federal AI Regulations

By Tina Joros, JD (Veradigm), Chair, and Stephen Speicher, MD, MS (Flatiron Health), Vice Chair, EHR Association AI Task Force

The regulatory landscape for AI is on the cusp of dramatic change. As we await the release of the AI Action Plan called for in the January 2025 Removing Barriers to American AI Innovation Executive Order and as federal agencies review their existing AI policies, we have seen an influx of proposed laws at the state level to address concerns about the use of AI in healthcare technology. This increase in state-level activity may lead to regulatory fragmentation that makes it more complex for EHR vendors and health systems to build and support AI tools designed to help advance patient care.

This increased focus on AI is highly relevant to EHR Association members who continue to deploy software capabilities that comply with EHR certification program transparency requirements for the use of Decision Support Interventions (DSI) involving AI and machine learning (ML) capabilities. Most of our member companies are also developing, piloting, or have already deployed generative AI solutions that can be leveraged to resolve many challenges confronting the healthcare industry.

Read the full post »
Leave a comment
by EHR Association on April 7, 2025  •  Permalink
Posted in AI, Uncategorized
Tagged , , ,

Posted by EHR Association on April 7, 2025

https://ehrablog.org/2025/04/07/core-issues-for-federal-ai-regulations/

Finding the Right Balance: Smart Deregulation in Health IT

by Leigh Burchell (Altera Digital Health), Chair, EHR Association Executive Committee

The current administration has made deregulation a central policy priority, aiming to reduce burden and costs in as many sectors of the economy as possible, including health care. This is exemplified by the January 2025 Executive Order 14192: Unleashing Prosperity Through Deregulation, which requires federal agencies to eliminate ten regulations for each new one introduced. 

As the trade association for health IT developers, we believe that smart deregulation should focus on removing outdated, redundant, and low-value requirements with ASTP/ONC and CMS playing a role more focused on driving improvements in standardized interoperability and health data exchange. Health IT regulation should support—not hinder—the industry’s collective ability to deliver safe, effective, and innovative technology solutions, without compromising the progress made or devaluing the investments in health IT over the last fifteen years. As always, we remain committed to working alongside federal agencies within the construct of a regulatory environment that benefits providers, developers, and—most importantly—patients.

Read the full post »
Leave a comment
by EHR Association on March 13, 2025  •  Permalink
Posted in Health IT Regulation, Public Policy and Health IT
Tagged , , , , , , , , , , ,

Posted by EHR Association on March 13, 2025

https://ehrablog.org/2025/03/13/finding-the-right-balance-smart-deregulation-in-health-it/

Patient Safety Awareness Week: Patient Safety is a Public Health Concern

While progress has been made in the realm of patient safety over the past two decades, medical harm remains a leading cause of death worldwide, making it a public health concern. As many as 250,000 to 400,000 US deaths annually are blamed on errors or preventable harm, and an estimated 40% of patients experience mostly preventable harm in ambulatory and primary care settings.

Embracing this year’s Patient Safety Awareness Week (March 9-15) theme, Moving the Needle, allows healthcare-related organizations – including EHR and other health IT developers – to focus on continuous improvement and ensure that patient safety becomes part of standard practice.

Read the full post »
Leave a comment
by EHR Association on March 10, 2025  •  Permalink
Posted in Patient Safety and Health IT, Uncategorized
Tagged ,

Posted by EHR Association on March 10, 2025

https://ehrablog.org/2025/03/10/patient-safety-awareness-week-patient-safety-is-a-public-health-concern/

« Older Posts
Newer Posts »

  • Categories

  • Follow EHRA on Twitter

  • Enter your email address to follow this blog and receive notifications of new posts by email.

    Join 198 other subscribers

  • Contact Us

    Kasey Nicholoff
    staff @ ehra.org

    Amanda Patanow
    Communications and Media
    ehracomms @ npccs.com