The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reported that a total of 11 health data breaches have each affected over one million people this year, bringing the total number of people affected by data breaches in 2024 to about 140 million Americans.
Those 11 health data breaches include one that occurred at the Centers for Medicare & Medicaid Services (CMS) itself, affecting over 3 million people. A significant majority of these breaches were caused by cyberattacks, and a recent study found that these cyberattacks, by shutting down whole hospital systems, have a direct impact on patient health.
It’s not surprising then, that last week, OCR sent a proposed rule on cybersecurity to the White House for final review. OCR says the intent of the rule is to improve “cybersecurity in the health care sector by strengthening requirements for HIPAA (Health Insurance Portability and Accountability Act) regulated entities.”
Although little is known about the specific requirements in the proposed rule, by reading the tea leaves, we can venture some guesses on what it will generally include, based on comments by D.C. lawmakers and HHS itself in numerous forums.
We’ll give you two new terms – each with their own implicitly required government acronym – that we’re probably going to hear a lot more about when this rule is published as early as next month:
Let’s start with CPGs. These were published about a year ago by CMS, with not much fanfare. That’s because they were voluntary best business practices that healthcare entities could implement – or not.
Now, the government has or will publish these CPGs for nearly every industry through the respective federal agencies, but since healthcare has become the number-one target for cybercriminals, the healthcare CPGs will likely be the first that will be required through these upcoming regulations.
The healthcare CPGs are split into two categories: Essential and Enhanced. The Essential category is intended to encompass business practices that are really a baseline for what the industry calls “good cybersecurity hygiene.” These include technological protections like multifactor authentication and strong encryption protections, as well as more behavioral practices like workforce trainings and revoking credentials for employees who leave the workforce.
The Enhanced CPGs are best practices that healthcare entities should employ as their organization’s technology matures. These include network segmentation and conducting attack simulations.
HHS has telegraphed that the Essential CPGs may make up the basis for required cybersecurity standards that could be imposed on healthcare entities in the upcoming rule.
Now, not all healthcare entities may be required to comply with all of the Essential CPGs. HHS has also focused much of its attention on the aforementioned SIEs: entities that are identified based on their potential to affect national critical functions.
In English, SIEs are healthcare entities – let’s call them chokepoints in the industry – of which, should they be attacked or impacted, the consequences would be more widespread than just that that one entity and its customers.
In summary, we expect this rule will likely require at least some HIPAA entities, including plans, providers, and clearinghouses, to implement specific security standards, and these SIEs may be given more requirements because of their reach and impact.
Will this cost healthcare entities money? Certainly.
Healthcare is famously behind other U.S. industries in terms of technology – that is why cybercriminals focus on healthcare instead of other industries – and it will cost both individual organizations and the industry at large to address that.
The proposed healthcare cybersecurity rule is expected to be published in November.
Given the possible costs, let’s hope it also offers some resources and help for the industry in the fortification of its cyber defenses.
Like many of you, I am deathly allergic to clinical documentation integrity (CDI), but do not worry; I premedicated with prednisone and an antihistamine prior
What should you do if you get an email with the subject line “U.S. Office of Inspector General HHS – Special Investigations?” A doctor I’m
Please log in to your account to comment on this article.
Stop revenue leakage and boost hospital performance by mastering risk adjustment and HCCs. This essential webcast with expert Cheryl Ericson, RN, MS, CCDS, CDIP, will reveal how inaccurate patient acuity documentation leads to lost reimbursements through penalties from poor quality scores. Learn the critical differences between HCCs and traditional CCs/MCCs, adapt your CDI workflows, and ensure accurate payments in Medicare Advantage and value-based care models. Perfect for HIM leaders, coders, and CDI professionals. Don’t miss this chance to protect your hospital’s revenue and reputation!
Struggling with ICD-10-CM coding for diabetes and complications? This expert-led webcast clarifies complex combination codes, documentation gaps, and sequencing rules to reduce denials and ensure compliance. Dr. Angela Comfort will provide actionable strategies to accurately link diabetes to complications, improve provider documentation, and optimize reimbursement—helping coders, CDI specialists, and HIM leaders minimize audit risks and strengthen revenue integrity. Don’t miss this chance to master diabetes coding with real-world case studies, key takeaways, and live Q&A!
Uncover critical guidance. HIM coding expert, Kay Piper, RHIA, CDIP, CCS, provides an interactive review on important information in each of the AHA’s 2025 ICD-10-CM/PCS Quarterly Coding Clinics in easy-to-access on-demand webcasts, available shortly after each official publication.
Uncover critical guidance. Kay Piper provides an interactive review on coding guidelines and more in the AHA’s fourth quarter 2025 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Stay ahead of Medicare Advantage’s 2025-2026 regulatory changes in this critical webcast featuring expert Tiffany Ferguson, LMSW, CMAC, ACM. Learn how new CMS rules limit MA plan denials, protect hospitals from retroactive claim reopenings, and modify Two-Midnight Rule enforcement—plus key insights on omitted SDoH mandates and heightened readmission scrutiny. Discover actionable strategies to safeguard revenue, ensure compliance, and adapt to evolving health equity priorities before the June 2025 deadline. Essential for hospitals, revenue cycle teams, and compliance professionals navigating MA’s shifting landscape.
Struggling with CMS’s 3-Day Payment Window? Join compliance expert Michael G. Calahan, PA, MBA, CCO, to master billing restrictions for pre-admission and inter-facility services. Learn how to avoid audit risks, optimize revenue cycle workflows, and ensure compliance across departments. Critical for C-suite leaders, providers, coders, revenue cycle teams, and compliance teams—this webcast delivers actionable strategies to protect reimbursements and meet federal regulations.
Providers face increasing Medicare audits when using skin substitute grafts, leaving many unprepared for claim denials and financial liabilities. Join veteran healthcare attorney Andrew B. Wachler, Esq., in this essential webcast and master the Medicare audit process, learn best practices for compliant billing and documentation, and mitigate fraud and abuse risks. With actionable insights and a live Q&A session, you’ll gain the tools to defend your practice and ensure compliance in this rapidly evolving landscape.
Dr. Ronald Hirsch dives into the basics of Medicare for clinicians to be successful as utilization review professionals. He’ll break down what Medicare does and doesn’t pay for, what services it provides and how hospitals get paid for providing those services – including both inpatient and outpatient. Learn how claims are prepared and how much patients must pay for their care. By attending our webcast, you will gain a new understanding of these issues and be better equipped to talk to patients, to their medical staff, and to their administrative team.
Copyright © 2025 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
