HIPAA

The U.S. Department of Health and Human Services has pushed back final action on its proposed overhaul of the HIPAA Security Rule from May 2026 to July 2027, giving covered entities and business associates additional time to prepare for what would be the first major update to the Security Rule since 2013. Employers that sponsor self-insured health plans should take note of the delay and consult with ERISA counsel on next steps to ensure their plans are in compliance.

The proposed rule, published in the Federal Register on January 6, 2025, would eliminate the distinction between “required” and “addressable” implementation specifications, mandate multi-factor authentication, expand encryption requirements, require comprehensive technology asset inventories and network mapping, extend documentation requirements, and impose detailed incident response and disaster recovery planning obligations, among other significant changes.…

Recent settlements in two HIPAA investigations involving ransomware attacks emphasize the importance of robust HIPAA compliance practices. In both instances, hackers were able to install ransomware on the covered entities’ systems that allowed them to access individuals’ PHI. Both covered entities had to pay a settlement and enter into a corrective action plan.

Under the…

Employers that sponsor self-insured health plans will need to update their health plan HIPAA Privacy Notices, and take other action in respect of HIPAA privacy compliance, as a result of new guidance issued by the Office for Civil Rights (OCR) at the U.S. Department of Health & Human Services (HHS), addressing reproductive health care privacy rights…

How often should your benefits group have HIPAA training?

Cybersecurity remains a key concern for everyone, but health plans and other entities covered by HIPAA should take particular care to have regular privacy training, especially in light of recent events.

On March 13, the Department of Health and Human Services’ Office for Civil Rights (OCR)…

HIPAA covered entities, including employer sponsored health plans, and their business associates, must train employees who have access to protected health information.

Moreover, recent HIPAA settlement agreements with the Office of Civil Rights (OCR) have emphasized the importance of updating training materials and providing regular training to employees.

See here for a recent settlement along…

Employers sponsoring health plans (particularly self-insured plans), and other covered entities and their Business Associates, should be aware of the March 1, 2023 deadline to report certain breaches that may have occurred in 2022 under the Health Insurance Portability and Accountability Act (“HIPAA”).

Aside from this reporting requirement, it may be a good time during…