0945-AA22 202404 Unified Agenda of Federal Regulatory and Deregulatory Actions 0945 Office for Civil Rights OCR 0900 Department of Health and Human Services HHS Proposed Modifications to the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information

This rule will propose modifications to the Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). These modifications will improve cybersecurity in the health care sector by strengthening requirements for HIPAA regulated entities to safeguard electronic protected health information to prevent, detect, contain, mitigate, and recover from cybersecurity threats.

]]> Section 3(f)(1) Significant Previously Published in The Unified Agenda Proposed Rule Stage Yes Undetermined 45 CFR 160 45 CFR 164 Health Insurance Portability and Accountability Act of 1996 (HIPAA), sec. 262 (42 U.S.C. 1320d-2) Health Information Technology for Economic and Clinical Health (HITECH) Act, sec. 13401 (42 U.S.C. 17931) Yes NPRM 12/00/2024 Undetermined Businesses Governmental Jurisdictions Organizations Undetermined Undetermined Undetermined No Yes Marissa Gordon-Nguyen Senior Advisor for Health Information Privacy, Data, and Cybersecurity Policy 0945 Office for Civil Rights OCR 800 368-1019 800 537-7697 ocrprivacy@hhs.gov 200 Independence Avenue SW, Washington DC 20201