By The EHR Association Privacy & Security Workgroup

In our last blog, The Security Snooze Button: HIPAA Security Rule delayed to (at least) July 2027, we outlined the industry response and EHRA’s own positioning on the HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information Notice of Proposed Rulemaking (NPRM) following the removal of the final rule from the current HHS regulatory agenda.

One of our concerns was a set of proposed technical requirements that point to “authoritative sources” for the standards or recommendations that regulated entities must meet, without expressly defining or naming any. Two of the most notable are the encryption and decryption standards (proposed 45 CFR 164.312(b)), which would require encryption consistent with “prevailing cryptographic standards,” and the authentication standard (proposed 45 CFR 164.312(f)), which would require unique passwords consistent with “current authoritative source recommendations”.