WMBA 6604 Week 7 HIPAA Security Rule Evaluation Example

About $9 Billion in the First Year Against a Ninefold Rise in Patients Affected by Breaches: Evaluating the Proposed HIPAA Security Rule Changes From a Community Hospital's Side, With One Modification for Small and Rural Providers

Student Name

Walden University

WMBA 6604: Law, Ethics, and Policy in Healthcare Administration

Instructor Name

Month Day, Year

About $9 Billion in the First Year Against a Ninefold Rise in Patients Affected by Breaches: Evaluating the Proposed HIPAA Security Rule Changes From a Community Hospital's Side, With One Modification for Small and Rural Providers

The Rule in Operational Terms

In January 2025 federal health regulators proposed a broad revision of the HIPAA Security Rule, which had changed little since it took effect in 2005 (90 Fed. Reg. 898). The department relies on its rulemaking power under the 1996 federal health privacy and portability law and the 2009 HITECH Act. The rule would cover every covered entity and business associate that holds electronic protected health information, which the department counted at about 1.8 million organizations, from multihospital systems to two-physician practices and the vendors that serve them.

The proposal would remove the long-standing distinction between "required" and "addressable" implementation specifications in the current rule (45 C.F.R. § 164.306), so that every specification would become mandatory, with limited exceptions. The main new requirements are these:

Table 1

Main Requirements of the Proposed Rule

Summarized from the notice of proposed rulemaking published January 6, 2025.

The notice proposed an effective date two months after a final rule appears, followed by a 180-day compliance period. Comments closed on March 7, 2025; the docket received about 4,700.

The Problem the Rule Addresses

The department's case rests on numbers. In the notice's own data, large breaches of electronic health information, those affecting 500 or more people, rose from 302 in 2018 to 725 in 2023, and the number of individuals affected rose from about 12.5 million to about 113 million. Ransomware has become the most disruptive form. Neprash et al. (2022) identified 374 ransomware incidents at U.S. care providers between 2016 and 2021. Together they compromised data on nearly 42 million patients, the yearly count more than doubled and almost half of the attacks interrupted care through outages, cancellations or ambulance diversion. The 2024 attack on a large claims clearinghouse, which the notice discusses, showed how one breach can stall payments across the whole industry.

The current rule's flexibility is part of the problem in the department's view. "Addressable" was meant to let an entity adopt a safeguard or record why a comparable substitute would serve, but many entities read it as optional. The department reports that its investigations repeatedly find missing risk analyses, absent encryption and weak access controls.

Evaluation: Does the Evidence Support the Requirements?

For most requirements, yes. Encryption, multifactor authentication, asset inventories and regular vulnerability scanning are basic controls that federal cybersecurity guidance has recommended for years, and the breach data show what happens when they are absent. Stolen credentials without multifactor authentication and unencrypted data on lost devices are among the common causes of large breaches. A mandatory floor is a reasonable response to a voluntary approach that did not hold.

The 72-hour restoration requirement is harder to support as written. It is the requirement most directly tied to patient care, because ransomware harms patients through prolonged downtime. But restoring critical clinical systems within three days after a sophisticated attack requires immutable backups, tested recovery procedures and staff that many hospitals do not have. The evidence shows the need; it does not show that 72 hours is achievable for all entities at the stated cost.

Evaluation: What Would It Cost?

The department estimated first-year costs of about $9 billion and costs of about $6 billion a year in years two through five, or about $6.8 billion a year annualized at a 2 percent discount rate. It concluded that costs would not fall disproportionately on small entities.

That estimate deserves skepticism. It rests on labor hours per entity, such as two hours of an analyst's time for the annual compliance audit, applied uniformly across organizations of very different complexity. A community hospital cannot audit its compliance with every standard in two hours. At Conestoga Ridge Medical Center, the course's invented 240-bed Pennsylvania hospital, information services puts first-year costs near $1.4 million, mainly for multifactor authentication on clinical workstations, network segmentation around legacy medical devices and backup systems able to meet the restoration target, and about $600,000 a year afterward. Those costs would come from an operating margin of about 2 percent.

Positions in the Comment Record

Hospital associations, led by the American Hospital Association, opposed the proposal and asked the department to withdraw it, arguing that its costs were understated, that its timelines were unrealistic and that hospitals are victims of attacks rather than their cause. Their interest is clear: they bear the compliance cost and the enforcement risk. Technology vendors and cybersecurity firms have the opposite commercial interest, since the requirements would expand demand for their products. Patients' interest lies mostly with the rule: they bear the harms of breaches and of disrupted care but none of the direct cost of prevention. A fair evaluation weighs each position with its interest in view.

Implementation Questions

A defensible requirement can still be unenforceable. The Office for Civil Rights investigates a small fraction of reported breaches with limited staff, and annual compliance audits by 1.8 million entities would produce documents that no one reviews. Legacy medical devices that cannot support encryption or multifactor authentication would require exceptions, and the exception process could become the new "addressable." The 180-day compliance period is short for organizations that must buy and install systems.

Position and One Modification

The rule should be finalized, because the evidence supports mandatory baseline controls and the voluntary approach has failed. One modification is worth making: a longer, tiered compliance period for small and rural providers, perhaps two years instead of 180 days, paired with a 72-hour restoration target that applies first to systems needed for emergency care and medication administration. This keeps the floor while matching the timetable to what smaller organizations can buy, install and test, and it focuses the hardest requirement on the systems where downtime harms patients most.

References

HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, 90 Fed. Reg. 898 (proposed January 6, 2025).

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

Security standards: General rules, 45 C.F.R. § 164.306 (2024).