The final action on the proposed rule to strengthen the Cybersecurity of Electronic Protected Health Information (PHI) has been delayed to July 2027 by the U.S. Department of Health and Human Services (HHS). This delay was posted on the Office of Management and Budget website.

Why is this important to benefit consultants and their clients?

Self-funded and level funded plans are considered covered entities under the rules and need to be aware of these proposed regulations that could possibly be implemented this time next year. The Plan Sponsors would be responsible for working with their plan carrier, TPA, or other service providers to ensure compliance.

If the benefit consultant has access to Electronic PHI, as a Business Associate to the Plan Sponsor, they too may need to comply with the changes.

The proposed rules were released back in December 2024 and formally issued in January 2025. These proposed rules represent the most significant update to the Security Rule in more than a decade.

If finalized, as proposed, the rule could impose many more security requirements on covered entities and business associates to include the following:

• mandatory encryption;
• multifactor authentication;
• network segmentation;
• annual penetration testing;
• enhanced risk analysis procedures;
• documented and regularly tested incident response plans;
• and greater oversight of vendor security controls

The proposal generated thousands of public comments and significant opposition from healthcare industry groups, which cited concerns about implementation costs and compliance timelines.

While the Security Rule update has been delayed, HHS is continuing work on separate HIPAA Privacy Rule changes, currently expected in August, that would expand patient access to health information, improve care coordination, and reduce certain administrative burdens for covered entities.

Resources

• Amwins Compliance Library: HIPAA Security
• The Security Rule | HHS.gov

^{While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.}