0945-AA22 202504 Unified Agenda of Federal Regulatory and Deregulatory Actions 0945 Office for Civil Rights OCR 0900 Department of Health and Human Services HHS HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information

This rule will modify the Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). These modifications will improve cybersecurity in the health care sector by strengthening requirements for HIPAA regulated entities to safeguard electronic protected health information to prevent, detect, contain, mitigate, and recover from cybersecurity threats.

]]> Economically Significant Previously Published in The Unified Agenda Final Rule Stage Yes Undetermined Regulatory 45 CFR 160 45 CFR 164 Health Insurance Portability and Accountability Act of 1996 (HIPAA), sec. 262 (42 U.S.C. 1320d-2) Health Information Technology for Economic and Clinical Health (HITECH) Act, sec. 13401 (42 U.S.C. 17931) Yes NPRM 01/06/2025 90 FR 898 Final Action 05/00/2026 Undetermined Businesses Governmental Jurisdictions Organizations Undetermined Undetermined Undetermined No Yes Conner O'Brien Senior Advisor 0945 Office for Civil Rights OCR 800 537-7697 ocrprivacy@hhs.gov 200 Independence Ave, SW, Washington DC 20201