New HIPAA rule makes the ‘addressable’ required, even before it’s finalized

Why This Topic Matters

Healthcare organizations need to understand how the proposal may affect current cybersecurity programs, vendor oversight, documentation, and security risk assessment processes. The article is relevant to leaders responsible for HIPAA compliance, privacy, IT security, and business associate management.

Article Sections

1. HHS proposed HIPAA Security Rule update

   Introduces the proposed federal update and its focus on cybersecurity expectations for regulated healthcare entities. Discusses the broader context for the rule and why it is being proposed.

2. HHS clarifies what is ‘addressable’

   Explains how the proposal addresses the meaning of addressable implementation specifications under HIPAA. Describes how the agency is framing current expectations for regulated entities.

3. Not just new tools

   Covers expanded security planning and risk assessment expectations beyond individual safeguards. Summarizes the proposal’s emphasis on resilience, testing, inventories, and contingency planning.

4. BAs’ burden — and yours

   Describes how the proposal may affect business associates and the covered entities that work with them. Addresses operational and vendor-management implications raised in the article.

5. Impact of the incoming administration

   Reviews commentary on whether a change in administration may alter the timing or scope of finalization. Notes the article’s discussion of policy direction and industry expectations.

6. Takeaway: Get to work

   Summarizes the article’s overall message for healthcare organizations preparing for possible security rule changes. Highlights the compliance and operational planning implications discussed by experts.