New legal developments herald big changes for HIPAA compliance in 2025
With responsible data use, patient data rights, data security, and privacy top of mind, the HIPAA compliance landscape is positioned for continued evolution and increased scrutiny.
Get a quick look at the days breaking legal news and analysis from The Afternoon Docket newsletter. Sign up here.
Here's what to expect and how to prepare in the coming year.
The health care industry is gearing up for a data security revamp
With a 264% increase in ransomware attacks in 2024, the Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) heavily enforced ransomware incidents last year, settling five ransomware investigations. The OCR also introduced its Risk Analysis Initiative at the end of 2024, focusing OCR enforcement on entities that fail to properly conduct the required periodic security risk analysis (SRA).
While there is no required format or method for an SRA under HIPAA, OCR is specifically cracking down on entities that only conduct cursory SRAs that do not thoroughly evaluate and address potential security risks or fail to conduct an SRA at all.
Security considerations are further compounded by HHS' proposed rulemaking in January to revamp HIPAA's Security Rule. The proposed changes aim to modernize the Security Rule, addressing technical aspects — such as patching, encryption, multifactor authentication, and penetration testing — and enhancing training and awareness regarding social engineering to mitigate common data breach risks.
While these rules reaffirm the OCR's data security efforts, the proposed rule's administrative and technical aspects would be costly and burdensome, particularly for smaller medical practices, self-funded health plans, and health care businesses.
Whether or not the proposed updates to the Security Rule are finalized or are materially modified from the current form, organizations must be proactive in keeping their security policies and procedures up to date. This includes implementing training to educate staff on new and emerging security threats and conducting regular, in-depth SRAs, as perfunctory SRAs are becoming an area of increasing enforcement risk.
Patient access remains a high priority
Patient right to access continues to be an area of significant focus for the OCR. From March to November 2024, the OCR settled five right to access cases, with another enforcement just announced on March 7, 2025.
The OCR continues to stress the importance of providing timely record access to patients and their personal representatives. Considering that most of these enforcement actions were triggered by a single incident or patient request, it is evident that widespread patient access issues can be exposed by just one individual, potentially subjecting a covered entity to significant financial and legal risk.
This OCR enforcement focus also aligns with one of the core goals of HHS' Information Blocking Rule, which aims to improve the flow of essential electronic health information between necessary parties. Most recently, HHS released two final rules aimed at improving interoperability and addressing information blocking issues. These rules, effective December 2024, provide clarity on when health care providers can share electronic health information, introduce new privacy and security requirements, and expand upon some information blocking exceptions to allow providers to comply with patient requests.
Covered entities and business associates should take recent information blocking rule changes as an opportunity to review patient access policies and procedures from both a HIPAA and information blocking perspective and confirm compliance.
Responsible data use considerations extend to protected health information
The OCR has placed a heavy focus on the potential for unauthorized use or disclosure of PHI through the use of emerging technologies. Thus, enforcement under HIPAA is also likely to evolve in response to the increased emphasis on responsible data use — which has become an essential component of AI's integration into business operations across industries.
HHS has not yet released any AI-specific HIPAA requirements, but it has issued other guidance that suggests AI technologies could be scrutinized to the extent they result in an unauthorized use or disclosure.
Additionally, the OCR previously issued a bulletin warning of the legal perils of online-tracking technologies that collect information about individuals using webpages and mobile applications of HIPAA-regulated entities. In American Hospital Association v. Becerra, a federal court in the Northern District of Texas struck down a portion of the guidance related to tracking on unauthenticated web pages on the grounds that it exceeded HHS' authority under HIPAA. The guidance, however, still applies and remains in effect for tracking activities on authenticated web pages (i.e., pages that require user log-in). HHS announced that it is "evaluating its next steps" in light of the court's order.
While the court limited the scope of the tracking technology guidance, regulated entities should still carefully evaluate how PHI is being used and accessed by third-party AI tools and tracking technologies. In addition to incorporating policies that address responsible data use, entities must be aware of technologies that may inconspicuously gain unauthorized access and use of PHI.
Entities should also consider how AI can increase the risk of inadvertent disclosure due to its ability to process and potentially infer PHI from various non-sensitive data points (e.g., reidentification of deidentified data).
Reproductive health privacy remains contested
Effective Dec. 23, 2024, HHS issued a final rule to protect the privacy of reproductive health care information. Under the final rule, the use or disclosure of an individual's PHI is prohibited for the purpose of conducting criminal, civil, or administrative investigations or for imposing liability on anyone for the act of seeking, obtaining, providing, or facilitating reproductive health care that was lawful at the time it was provided.
The rule also mandates that any requests for reproductive health care PHI for specific purposes must include an attestation confirming that the use or disclosure of PHI is not for a prohibited purpose and covered entities must update their notice of privacy practices (NPPs) to reflect the new requirements.
Last fall, in State of Texas v. U.S. Department of Health and Human Services, the State of Texas challenged the newly finalized 2024 final rule on reproductive health care information and a privacy rule issued in 2000, which prohibits the disclosure of reproductive health PHI unless the request meets a three-part test. Texas argues that both rules inhibit law enforcement's ability to enforce its laws on abortion. This case is currently pending and unresolved in the federal Northern District of Texas.
With the final rule now in effect, providers must comply despite the ongoing legal challenges pending against it. Covered entities should ensure they make appropriate updates to their NPPs by the required Feb. 16, 2026, deadline and update policies and procedures to reflect the rule as it currently stands, while also remaining on top of new legal developments. Not only could the rules be potentially narrowed in scope or struck down by the Texas federal court, but there is also the potential for additional rule changes under the new administration.
Conclusion
As 2025 unfolds, the evolving health care landscape will continue to drive legal shifts in the areas of data security and patient access and privacy. Covered entities and business associates can stay ahead of the curve by taking proactive compliance and risk-mitigation measures, including rigorous SRAs, evaluation of technical controls, staff training, and review of policies and procedures for effectiveness and consistency with ever-changing legal requirements.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
NBC News
a day ago
- NBC News
Kennedy's move to cancel preventive health panel meeting raises alarm
If you've ever been given a free or low-cost test for lung, breast, colon or cervical cancer which caught a tumor, it's likely due to a panel of 16 doctors and public health experts who reviewed the evidence and determined that a screening could save your life. That's why anxiety is growing after Health and Human Services Secretary Robert F. Kennedy Jr. abruptly postponed a meeting this week with the highly influential United States Preventive Services Task Force, a group of 16 independent volunteers that advise the agency about preventative health services and screenings, including mammograms, HIV prevention medications, recommending support for new moms to breastfeed and lifestyle interventions for heart disease. Health insurance plans are required to cover the task force's recommendations under the Affordable Care Act. The meeting, scheduled for July 10, was postponed without explanation. In an emailed statement, Andrew Nixon, an HHS spokesperson, declined to say why the meeting was canceled or whether it would be rescheduled. He did not respond to a follow-up request for comment. An HHS notice sent Monday afternoon to task force members said the agency 'looks forward to engaging with the task force to promote the health and well-being of the American people,' according to two people familiar with the task force meeting. Task force members were not given a reason for the canceled meeting or whether it would be rescheduled, said the two people interviewed, who spoke on the condition of anonymity for fear of retribution. Many task force members, however, fear Kennedy's move could signal that he's gearing up to fire them and install new members, as he did with a separate advisory committee, known as the Advisory Committee on Immunization Practices (ACIP), the sources said. Last month, Kennedy fired all 17 members of ACIP — which makes recommendations to the Centers for Disease Control and Prevention on vaccines, including for children — and replaced them with eight new members. The new panel includes well-known vaccine critics. 'If you look at how things played out with ACIP, this could be a warning signal,' one of the people said. The United States Preventive Services Task Force is a lesser known group that was first convened in 1984 during the Reagan administration. It includes physicians, nurses, pediatricians and public health experts. The task force plays an important role because the ACA , more commonly known as Obamacare, mandates that most private insurers provide the services that the group recommends to patients at no cost. The task force makes its recommendations using a grading scale. Under federal law, services that get an A or B grade but must be covered by insurance plans at no cost to patients. The advisory group has been subject to outrage for its past decisions, including from conservative groups over an 'A' recommendation to cover the HIV prevention pill, known as PrEP. Its controversial decision against routine blood test screening for prostate cancer in 2008 has been linked to rising rates of advanced cases of the disease. The task force currently advises against PSA-screening for older men, saying that men ages 55 to 69 should talk with their doctors about the benefits and harms. The group usually updates its recommendations every five years after reviewing the latest science on preventive care. For example, in 2021, the task force updated its guidance on heart attack prevention, saying most adults shouldn't take aspirin to prevent a first heart attack or stroke. Other recommendations from the task force include that all women begin breast cancer screening every other year starting at the age of 40, down from age 50. It also recommended that children and teens age 8 and up get screened for anxiety. Both have 'B' recommendations. The canceled meeting was set to discuss cardiovascular disease and prevention in adults and children, the people said. 'This institution proves vital,' said Arthur Caplan, the head of the Division of Medical Ethics at NYU Langone Medical Center in New York City. 'The task force provides one of the few independent evidence-based assessments of what ought to be covered, especially in the area of prevention, which Kennedy has made a priority.' 'Postponing the meeting makes me very nervous,' Caplan added. As health secretary, Kennedy does have the authority to remove and appoint new members of the committee, said Jen Kates, senior vice president and director of the Global Health & HIV Policy Program at KFF, a health policy research group. That authority was actually a factor in the Supreme Court's decision last month to uphold the Affordable Care Act provision that requires insurers to cover certain preventive services for free. The court agreed with the Trump administration that the task force members were 'inferior officers,' Kates said, because their work was directed and supervised by Kennedy. 'The Supreme Court basically ruled that the [health] secretary has the power to appoint members and remove them at will,' Kates said. 'So it basically affirms the argument that the secretary has the ultimate authority over the panel.' It's unclear which areas of health care Kennedy might target by shaking up the panel. PrEP, the HIV prevention pill, is 'one to watch,' Kates said, because the Trump administration has already moved to restrict access to the medication in other countries. Caplan said Kennedy could direct the task force to look into topics he's interested in, such as nutrition or processed foods. Health groups immediately pushed back when news broke that Kennedy postponed the meeting. On Wednesday, a letter signed by more than 100 public health groups — including the American Medical Association and the American Academy of Pediatrics — urged U.S. lawmakers to 'defend the task force's integrity.'
The Herald Scotland
2 days ago
- The Herald Scotland
Trump targets health care access for undocumented families
The federal Department of Labor on July 10 also announced new rules limiting who can access its programs, as did the Justice, Education and Agriculture departments. White House officials said the aggregate changes would save $40 billion in benefits that would have otherwise gone to undocumented immigrants. "For too long, the government has diverted hardworking Americans' tax dollars to incentivize illegal immigration," Kennedy said in a statement. "Today's action changes that - it restores integrity to federal social programs, enforces the rule of law, and protects vital resources for the American people." Federal law still requires hospitals to treat any patient who is suffering a medical emergency, regardless of their immigration status or ability to pay. Many federal programs, including the one formerly known as food stamps, are already limited to citizens and legal residents only. HHS officials said this change brings Head Start and the community Health Center Program into compliance with that existing policy, which is designed to limit public services to legal citizens. It was not immediately clear how many people would lose services under the new rules, or whether American- born citizen children of undocumented immigrants would lose access to Head Start and other programs. "As President Trump has ordered, 'the American people deserve a federal government that puts their interests first and a government that understands its sacred obligation to prioritize the safety, security, and financial and economic wellbeing of Americans,'" HHS wrote in issuing the new rules. Reaction to the changes The change stunned health care workers across the country as they scrambled to understand the implications of the decision. In a statement, the National Association of Community Health Centers said it's working with its legal team to understand the impact of the new rules, given that federal law requires the centers to accept "all residents of the area served by the center." The association said its members serve approximately 10% of the overall U.S. population, and as much as 20% in some rural areas. The access change also applies to some mental health treatment, homelessness transition and drug-treatment programs. The White House argues that federal spending and taxes could be lower if Americans didn't have to pay for health care and other services provided to people living illegally in the United States. Both Florida and Texas already require hospitals to ask the immigration status of people seeking help. Migrant-rights groups point out that anyone living in the United States already pays some level of tax, from sales tax on groceries to gas tax on fuel, and that many of those undocumented people also pay federal income taxes and Social Security, even though they will never collect that Social Security upon retirement. Undocumented immigrants contributed $100 million in taxes in 2022, according to an analysis by Americans for Tax Fairness, an advocacy group. Head Start this year served 754,819 students across every state, and provides both educational and health care assistance to children. HHS officials said it would cost about $22 million to change Head Start operations to begin tracking citizenship, and $115 million to $175 million to make those changes agencywide. The community Health Center Program funds about 1,400 clinics nationally, offering basic health care and dental services to anyone regardless of their ability to pay. According to the National Association of Community Health Centers, 90% of their clients earn less than 200% of the federal poverty level. Public health experts have repeatedly noted that routine access to health care improves overall national health while helping keep costs down by paying for preventative care. Health care systems providing high levels of care to uninsured people have to raise the rates they charge to insured customers to cover the shortfall. "Proponents claim this ensures accountability for public resources, but the truth is far more complex and potentially harmful," Dr. Peter Sangeyup Yun of George Washington University's Department of Emergency Medicine wrote in a March essay. "Such policies disproportionately affect our most vulnerable populations, posing challenges to individual lives and the well-being of entire communities."
The Independent
2 days ago
- The Independent
Head Start will be cut off for immigrants without legal status, Trump administration says
The Trump administration will restrict immigrants in the country illegally from enrolling in Head Start, a federally funded preschool program, the Department of Health and Human Services announced Thursday. The move is part of a broad effort to limit access to federal benefits for immigrants who lack legal status. People in the country illegally are largely ineligible for federal public benefits such as food stamps, student loans and financial aid for higher education. But for decades they have been able to access some community-level programs such as Head Start and community health centers. HHS said it will reclassify those programs as federal public benefits, excluding immigrants in the country illegally from accessing them. Health secretary Robert F. Kennedy Jr. said the changes were part of a larger effort to protect American citizens' interests. 'For too long, the government has diverted hardworking Americans' tax dollars to incentivize illegal immigration,' Kennedy said in a statement. 'Today's action changes that — it restores integrity to federal social programs, enforces the rule of law, and protects vital resources for the American people.' A spokesperson for the Administration for Children and Families, which administers Head Start, said that eligibility will be determined based on the child's immigration status. Requiring proof of immigration status would likely create fear and confusion among families seeking to enroll their children, said Yasmina Vinci, executive director of the National Head Start Association. 'This decision undermines the fundamental commitment that the country has made to children and disregards decades of evidence that Head Start is essential to our collective future,' Vinci said. The changes are part of a multi-agency announcement rescinding a Clinton-era interpretation of federal law, which had allowed immigrants in the country illegally to access some programs. The Education Department, the Department of Agriculture and the Department of Labor announced similar changes affecting a range of workforce and adult education programs. The changes will affect community health centers that immigrants rely on for a wide range of services, said Shelby Gonzales, vice president of immigration policy at the Center on Budget and Policy Priorities. 'People depend on those services to get cancer treatment, to get ongoing maintenance for a variety of different health needs," she said. Students in the country illegally will no longer be eligible to participate in post-secondary career and technical education programs or adult education programs, the Education Department announced. The department also issued a notice to grant recipients to ensure that programs receiving federal funding do not provide services to immigrants without legal status. Education advocates said the decision would harm young people who have grown up in this country. EdTrust Vice President Augustus Mays said the intention appears to be creating fear among immigrant communities. 'Policies like this don't exist in a vacuum," Mays said. 'They are rooted in a political agenda that scapegoats immigrants and uses fear to strip rights and resources from the most vulnerable among us.' Head Start was started six decades ago as part of Democratic President Lyndon B. Johnson's War on Poverty. It operates in all 50 states, helping families who are homeless or are in poverty. ___ Associated Press writer Cheyanne Mumphrey in Phoenix contributed to this report. ___ The Associated Press' education coverage receives financial support from multiple private foundations. AP is solely responsible for all content. Find AP's standards for working with philanthropies, a list of supporters and funded coverage areas at
