The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reported that a total of 11 health data breaches have each affected over one million people this year, bringing the total number of people affected by data breaches in 2024 to about 140 million Americans.
Those 11 health data breaches include one that occurred at the Centers for Medicare & Medicaid Services (CMS) itself, affecting over 3 million people. A significant majority of these breaches were caused by cyberattacks, and a recent study found that these cyberattacks, by shutting down whole hospital systems, have a direct impact on patient health.
It’s not surprising then, that last week, OCR sent a proposed rule on cybersecurity to the White House for final review. OCR says the intent of the rule is to improve “cybersecurity in the health care sector by strengthening requirements for HIPAA (Health Insurance Portability and Accountability Act) regulated entities.”
Although little is known about the specific requirements in the proposed rule, by reading the tea leaves, we can venture some guesses on what it will generally include, based on comments by D.C. lawmakers and HHS itself in numerous forums.
We’ll give you two new terms – each with their own implicitly required government acronym – that we’re probably going to hear a lot more about when this rule is published as early as next month:
Let’s start with CPGs. These were published about a year ago by CMS, with not much fanfare. That’s because they were voluntary best business practices that healthcare entities could implement – or not.
Now, the government has or will publish these CPGs for nearly every industry through the respective federal agencies, but since healthcare has become the number-one target for cybercriminals, the healthcare CPGs will likely be the first that will be required through these upcoming regulations.
The healthcare CPGs are split into two categories: Essential and Enhanced. The Essential category is intended to encompass business practices that are really a baseline for what the industry calls “good cybersecurity hygiene.” These include technological protections like multifactor authentication and strong encryption protections, as well as more behavioral practices like workforce trainings and revoking credentials for employees who leave the workforce.
The Enhanced CPGs are best practices that healthcare entities should employ as their organization’s technology matures. These include network segmentation and conducting attack simulations.
HHS has telegraphed that the Essential CPGs may make up the basis for required cybersecurity standards that could be imposed on healthcare entities in the upcoming rule.
Now, not all healthcare entities may be required to comply with all of the Essential CPGs. HHS has also focused much of its attention on the aforementioned SIEs: entities that are identified based on their potential to affect national critical functions.
In English, SIEs are healthcare entities – let’s call them chokepoints in the industry – of which, should they be attacked or impacted, the consequences would be more widespread than just that that one entity and its customers.
In summary, we expect this rule will likely require at least some HIPAA entities, including plans, providers, and clearinghouses, to implement specific security standards, and these SIEs may be given more requirements because of their reach and impact.
Will this cost healthcare entities money? Certainly.
Healthcare is famously behind other U.S. industries in terms of technology – that is why cybercriminals focus on healthcare instead of other industries – and it will cost both individual organizations and the industry at large to address that.
The proposed healthcare cybersecurity rule is expected to be published in November.
Given the possible costs, let’s hope it also offers some resources and help for the industry in the fortification of its cyber defenses.
While the coverage of telehealth is definitely a good thing, it has caused needless confusion. I would like to address a little of that today.
In the Centers for Medicare & Medicaid Services’ (CMS’s) ongoing attempts to conquer fraud, waste, and abuse, it launched the WISeR (Wasteful and Inappropriate Service
Please log in to your account to comment on this article.
Sepsis sequencing continues to challenge even experienced coding and CDI professionals, with evolving guidelines, documentation gaps, and payer scrutiny driving denials and data inconsistencies. In this webcast, Payal Sinha, MBA, RHIA, CCDS, CDIP, CCS, CCS-P, CCDS-O, CRC, CRCR, provides clear guideline-based strategies to accurately code sepsis, severe sepsis, and septic shock, assign POA indicators, clarify the relationship between infection and organ dysfunction, and align documentation across teams. Attendees will gain practical tools to strengthen audit defensibility, improve first-pass accuracy, support appeal success, reduce denials, and ensure accurate quality reporting, empowering organizations to achieve consistent, compliant sepsis coding outcomes.
Expert presenters Kathy Pride, RHIT, CPC, CCS-P, CPMA, and Brandi Russell, RHIA, CCS, COC, CPMA, break down complex fracture care coding rules, walk through correct modifier application (-25, -57, 54, 55), and clarify sequencing for initial and subsequent encounters. Attendees will gain the practical knowledge needed to submit clean claims, ensure compliance, and stay one step ahead of payer audits in 2026.
Accurately determining the principal diagnosis is critical for compliant billing, appropriate reimbursement, and valid quality reporting — yet it remains one of the most subjective and error-prone areas in inpatient coding. In this expert-led session, Cheryl Ericson, RN, MS, CCDS, CDIP, demystifies the complexities of principal diagnosis assignment, bridging the gap between coding rules and clinical reality. Learn how to strengthen your organization’s coding accuracy, reduce denials, and ensure your documentation supports true medical necessity.
Denials continue to delay reimbursement, increase administrative burden, and threaten financial stability across healthcare organizations. This essential webcast tackles the root causes—rising payer scrutiny, fragmented workflows, inconsistent documentation, and underused analytics—and offers proven, data-driven strategies to prevent and overturn denials. Attendees will gain practical tools to strengthen documentation and coding accuracy, engage clinicians effectively, and leverage predictive analytics and AI to identify risks before they impact revenue. Through real-world case examples and actionable guidance, this session empowers coding, CDI, and revenue cycle professionals to shift from reactive appeals to proactive denial prevention and revenue protection.
In this timely session, Stacey Shillito, CDIP, CPMA, CCS, CCS-P, CPEDC, COPC, breaks down the complexities of Medical Decision Making (MDM) documentation so providers can confidently capture the true complexity of their care. Attendees will learn practical, efficient strategies to ensure documentation aligns with current E/M guidelines, supports accurate coding, and reduces audit risk, all without adding to charting time.
Join Ronald Hirsch, MD, FACP, CHCQM for The PEPPER Returns – Risk and Opportunity at Your Fingertips, a practical webcast that demystifies the PEPPER and shows you how to turn complex claims data into actionable insights. Dr. Hirsch will explain how to interpret key measures, identify compliance risks, uncover missed revenue opportunities, and understand new updates in the PEPPER, all to help your organization stay ahead of audits and use this powerful data proactively.
Stay ahead of the 2026-2027 audit surge with “Top 10 Audit Targets for 2026-2027 for Hospitals & Physicians: Protect Your Revenue,” a high-impact webcast led by Michael Calahan, PA, MBA. This concise session gives hospitals and physicians clear insight into the most likely federal audit targets, such as E/M services, split/shared and critical care, observation and admissions, device credits, and Two-Midnight Rule changes, and shows how to tighten documentation, coding, and internal processes to reduce denials, recoupments, and penalties. Attendees walk away with practical best practices to protect revenue, strengthen compliance, and better prepare their teams for inevitable audits.
As AI reshapes healthcare compliance, the risk of biased outputs and opaque decision-making grows. This webcast, led by Frank Cohen, delivers a practical Four-Pillar Governance Framework—Transparency, Accountability, Fairness, and Explainability—to help you govern AI-driven claim auditing with confidence. Learn how to identify and mitigate bias, implement robust human oversight, and document defensible AI review processes that regulators and auditors will accept. Discover concrete remedies, from rotation protocols to uncertainty scoring, and actionable steps to evaluate vendors before contracts are signed. In a regulatory landscape that moves faster than ever, gain the tools to stay compliant, defend your processes, and reduce liability while maintaining operational effectiveness.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
