All posts tagged Privacy and Security

HIPAA Security Rule Part Three: Risk-Based and Industry-Aligned Approaches Recommended

By the EHR Association Privacy & Security Workgroup

This three-part blog series shares the EHR Association’s stance on OCR’s proposed changes to the HIPAA Security Rule. Part one focused on our overarching concerns and issues with proposed definitions. Part two and this installment highlight our concerns with OCR’s proposed expectations. 

The HIPAA Security Rule is overdue for modernization, given the rapid pace of technological change and increasing cybersecurity threats. While we support OCR’s intent to strengthen protections for electronic protected health information (ePHI), our analysis of the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information raised concerns and questions we hope will be addressed before finalization.

(more…)
Leave a comment
by EHR Association on May 9, 2025  •  Permalink
Posted in Health IT Regulation, Privacy and Security
Tagged , , , ,

Posted by EHR Association on May 9, 2025

https://ehrablog.org/2025/05/09/hipaa-security-rule-part-three-risk-based-and-industry-aligned-approaches-recommended/

HIPAA Security Rule Part Two: Proposed Changes Require Clarity, Flexibility

By the EHR Association Privacy & Security Workgroup

This three-part blog series shares the EHR Association’s stance on OCR’s proposed changes to the HIPAA Security Rule. Part one focused on our overarching concerns and issues with proposed definitions. Part two focuses on several of the proposed standards.

Our analysis of proposed changes to the existing HIPAA Security Rule, released as HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, revealed a mixed bag of positive changes and areas of concern. In the first installment of this blog series, we noted the EHR Association’s appreciation for its enhancements to the cybersecurity baseline. However, we expressed concern about the resources and costs required for regulated entities to comply with the overhauled mandates. We also reviewed the feedback we shared with OCR on its proposed changes to key definitions.

In this installment, we highlight our concerns with several of OCR’s proposed expectations, drawing attention to the need for greater clarity and offering recommendations to ease compliance burdens while achieving intended outcomes. 

(more…)
Leave a comment
by EHR Association on April 30, 2025  •  Permalink
Posted in Privacy and Security
Tagged , , , ,

Posted by EHR Association on April 30, 2025

https://ehrablog.org/2025/04/30/hipaa-security-rule-part-two-proposed-changes-require-clarity-flexibility/

HIPAA Security Rule Part One: Proposed Overhaul Closes Some Gaps, Opens Others

By the EHR Association Privacy & Security Workgroup

This three-part blog series shares the EHR Association’s stance on OCR’s proposed changes to the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information. Part one is focused on our overarching concerns and issues with proposed definitions.

Proposed changes to the existing HIPAA Security Rule, released as HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, include some long-overdue updates. However, the resources and costs required by healthcare provider organizations, health IT developers, and other regulated entities to comply with the sweeping changes will be too great for many to bear.

That was one of several important messages we shared with the HHS Office of Civil Rights (OCR) in our comment letter on the proposed rule. 

(more…)
3 Comments
by EHR Association on April 28, 2025  •  Permalink
Posted in Privacy and Security
Tagged , , , , , , , ,

Posted by EHR Association on April 28, 2025

https://ehrablog.org/2025/04/28/hipaa-security-rule-part-one-proposed-overhaul-closes-some-gaps-opens-others/

CISA Proposes Practical Guidelines For Reporting Cyber Incidents

EHR Association Privacy & Security Workgroup

The Cybersecurity and Infrastructure Security Agency (CISA), responsible for coordinating cybersecurity programs within the U.S. and improving the government’s cybersecurity protections, proposed new reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act, or CIRCIA. The proposed rule lays out what incidents must be reported, by whom, and what the reports must contain. While the EHR Association provided comments of support for most areas, suggestions for potential refinement were also offered. 

(more…)
Leave a comment
by EHR Association on August 21, 2024  •  Permalink
Posted in Health IT Regulation, Privacy and Security
Tagged ,

Posted by EHR Association on August 21, 2024

https://ehrablog.org/2024/08/21/cisa-proposes-practical-guidelines-for-reporting-cyber-incidents/

Success of ONC’s Health IT Strategic Plan Rests on Realistic Expectations, Regulatory Timelines

By Stephanie Jamison (Greenway Health), Chair, and William Hayes, M.D. (Trubridge), Vice Chair, EHR Association

With its Draft 2024-2030 Federal Health IT Strategic Plan, ONC seeks to enhance individual and community health through improved healthcare experiences, advanced research and innovation, and integrated health data systems – important goals the EHR Association finds commendable provided the path taken to achieve them is paved with realistic expectations and timelines for regulations targeting them.

In many ways, the mission and vision laid out by ONC in its strategic plan echoes the objectives of our member companies; namely, advancing the quality and efficiency of care through innovative, interoperable health IT adoption and use. However, our enthusiastic support is tempered by concerns over the potential for too-aggressive compliance timelines and expectations that are beyond the reach of EHR and other health IT developers and the provider organizations utilizing these tools – concerns we shared in our response to ONC’s call for feedback on the Draft Federal Health IT Strategic Plan. 

(more…)
Leave a comment
by EHR Association on May 30, 2024  •  Permalink
Posted in Health IT Regulation, Health IT Standards
Tagged , , ,

Posted by EHR Association on May 30, 2024

https://ehrablog.org/2024/05/30/success-of-oncs-health-it-strategic-plan-rests-on-realistic-expectations-regulatory-timelines/

Genomic Data Sharing Policies Must Protect Patient Privacy, Minimize Risk

By Michael Saito (Epic), Chair & Nam Nguyen, (Allscripts) Vice Chair, EHRA Privacy & Security Workgroup

The National Institutes of Health’s (NIH) ongoing objective of sharing research data sets to facilitate additional study is something EHRA member companies wholly support – as long as it protects patient privacy, ensures patients can provide informed and meaningful consent for use of their data, and minimizes the risk that patients’ genomic and other health data can be re-identified or misused. 

To that end, we took advantage of the NIH’s recent Request for Information (RFI) on the proposed updates to and long-term considerations for its Genomic Data Sharing (GDS) Policy to provide feedback in the key areas of de-identification, potentially identifiable information, and data linkages.

(more…)
Leave a comment
by EHR Association on May 24, 2022  •  Permalink
Posted in Health IT Standards, Interoperability
Tagged , , ,

Posted by EHR Association on May 24, 2022

https://ehrablog.org/2022/05/24/genomic-data-sharing-policies-must-protect-patient-privacy-minimize-risk/

« Older Posts
Newer Posts »

  • Categories

  • Follow EHRA on Twitter

  • Enter your email address to follow this blog and receive notifications of new posts by email.

    Join 213 other subscribers

  • Contact Us

    Kasey Nicholoff
    staff @ ehra.org

    Amanda Patanow
    Communications and Media
    ehracomms @ npccs.com