Cybersecurity in healthcare and the management of federal grants emerged as one of the major priorities in 2024, as evidenced by the HHS Office for Civil Rights' (OCR) advancement of two regulations. The HHS Grants Rule and proposed modifications to the HIPAA Security Rule demonstrate the federal government's commitment to protecting patient information while ensuring accountability in healthcare funding.
The HHS Grants Rule establishes guidelines for organizations receiving federal healthcare grants. The rule specifically affirms protections for LGBTQI+ individuals by clarifying the prohibition of discrimination based on sex, including sexual orientation and gender identity, consistent with the Supreme Court's Bostock v. Clayton County decision. These protections extend to various essential services, including:
The proposed modifications to the HIPAA Security Rule represent an effort to strengthen cybersecurity measures in healthcare settings. These updates aim to address evolving digital threats while ensuring healthcare organizations protect patient information. The modifications focus on enhancing security requirements, implementing stronger safeguards, and establishing clear protocols for incident reporting and response. Key aspects of the proposed modifications include:
Related: How to perform a risk assessment
What is an incident response plan?
Healthcare organizations must adapt their operations to comply with both the HHS Grants Rule and the enhanced HIPAA Security Rule requirements. For grant recipients, this means ensuring their programs and services are accessible to all individuals without discrimination, while also maintaining cybersecurity measures including multi-factor authentication, data encryption, network monitoring, and staff training to protect patient information.
Organizations receiving HHS grants must:
Organizations may face financial penalties, loss of federal funding, and potential legal action.
Go deeper: What happens when you fail to send a breach notification
It requires providers to implement specific cybersecurity measures to protect patient information, including encryption and security monitoring.
Read more: What is the HIPAA Security Rule?
It's a security measure requiring multiple forms of verification to access systems, helping prevent unauthorized access to sensitive information.