2024 HIPAA Accomplishments and Wrap-Up

2024 was a historic year filled with tremendous activities and accomplishments for OCR on Health Insurance Portability and Accountability Act of 1996 (HIPAA) rulemakings, enforcement actions, conferences, webinars, videos, and newsletters for the health care sector on HIPAA privacy and cybersecurity.

Rulemakings

For the first time in OCR’s history, OCR issued three HIPAA rulemakings in one year. In February, OCR published a final rule on the Confidentiality of Substance Use Disorder Patient Records, to increase coordination among providers treating patients with substance use disorders, strengthen patient confidentiality protections through civil enforcement, and enhance integration of behavioral health information with other medical records to improve patient health outcomes. This rulemaking was completed pursuant to the bipartisan Coronavirus Aid, Relief, and Economic Security Act (CARES Act) that, among other things, required HHS to bring the Part 2 program into closer alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and Enforcement Rules.

In April, OCR published a final rule modifying the HIPAA Privacy Rule to support reproductive health care privacy. The Final Rule strengthens the HIPAA Privacy Rule by prohibiting the use and disclosure of protected health information (PHI) in certain circumstances. The Final Rule includes the following changes:

• Prohibits the use or disclosure of PHI when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate lawful reproductive health care, or to identify persons for such activities.
• Requires covered entities (health plans, health care clearinghouses, and most health care providers) or business associates to obtain a signed attestation that certain requests (health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures about decedents to coroners and medical examiners) for PHI potentially related to reproductive health care are not for these prohibited purposes.
• Requires covered entities to modify their Notice of Privacy Practices to support reproductive health care privacy.

In December, OCR issued a proposed rule to modify the HIPAA Security Rule to strengthen cybersecurity in health care. The proposed rule would require covered entities and their business associates to better protect individuals’ electronic protected health information against both external and internal threats. It would clarify and provide more specific instruction about what covered entities and their business associates must do to protect the security of electronic protected health information. The proposed rule would also require that policies and procedures be in writing, reviewed, tested, and updated on a regular basis. Additionally, it would better align the Security Rule with modern best practices in cybersecurity. These proposals address:

• Changes in the environment in which health care is provided.
• Significant increases in breaches and cyberattacks.
• Common deficiencies OCR has observed in investigations into Security Rule compliance by covered entities and their business associates.
• Other cybersecurity guidelines, best practices, methodologies, procedures, and processes.
• Court decisions that affect enforcement of the Security Rule.

Enforcement

OCR was very active with HIPAA Enforcement. OCR completed 22 HIPAA enforcement actions (2^nd highest in OCR history) and collected over $9.9 million in settlements and civil money penalties. HIPAA issues resolved included ransomware, phishing, health information left unsecured on the internet, impermissible access to electronic PHI, reproductive health information impermissibly disclosed, and untimely patient access to PHI. OCR press releases on announced resolutions of HIPAA enforcement action can be found at https://www.hhs.gov/ocr/newsroom/index.html.

Cybersecurity Resources

OCR focused on information sharing through convenings and the publication of resources to improve the health care sector’s cybersecurity of health information. In October, OCR and the National Institute of Standards and Technology (NIST) held a cybersecurity conference that featured numerous presenters across government including the HHS Deputy Secretary and senior representatives from the Health Sector Cybersecurity Coordination Center, the Food and Drug Administration, Office of the National Coordinator for Health Information Technology, Federal Trade Commission, OCR, NIST, and many more.

Throughout the year, OCR published cybersecurity resources including a video on ransomware and the HIPAA Security Rule that analyzes trends that OCR is seeing in ransomware investigations and how compliance with the HIPAA Security Rule can assist regulated entities to prevent, detect, respond to, and recover from ransomware attacks. OCR also published two cybersecurity newsletters on facility access controls addressing contingency plans to respond to emergencies and other events (such as hacking and ransomware) that damage information systems containing health information, and social engineering attacks such as phishing, smishing (texting-based attacks), baiting, and deepfakes with Artificial Intelligence.

OCR also held two webinars to support the two final rules issued this year on the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, and Part 2 Final Rule Modifying Confidentiality Provisions for SUD Patient Records. Both videos are on OCR’s YouTube Channel at https://www.youtube.com/@USGovHHSOCR.

We are proud of OCR’s hardworking and dedicated teams of public servants who work day in and day out on behalf of the American people to advance HIPAA and keep our health information safe and secure.

As we look ahead, we encourage you to stay informed, use OCR’s free cybersecurity resources readily available online at www.hhs.gov/hipaa, sign up for OCR’s HIPAA listservs to receive updates, and re-up your efforts to keep your organizations compliant with HIPAA. OCR will continue to work toward strengthening health information privacy and security.