HHS Proposes Encryption to Strengthen Healthcare Cybersecurity

The U.S. Department of Health and Human Services (HHS) has proposed significant updates to the HIPAA Security Rule, marking its first major overhaul in more than a decade. This initiative aims to address the escalating frequency and sophistication of cyberattacks targeting healthcare systems and patient data. Deputy National Security Advisor for Cyber and Emerging Technology, Anne Neuberger, highlighted the urgent need for these changes during a White House briefing, underscoring their importance in combating cyber threats from nation-state actors like China.

Making encryption mandatory

The proposed modifications, detailed in a newly issued Notice of Proposed Rulemaking (NPRM), include updates aimed at strengthening protections for electronic protected health information (ePHI). Key aspects include:

1. Mandatory encryption of ePHI to prevent data breaches.
2. Enhanced security measures such as multi-factor authentication (MFA) and detailed risk assessments.
3. Obligations for healthcare entities to conduct regular security audits and implement robust incident response mechanisms​.

HHS emphasized the critical nature of these updates, noting that many healthcare organizations lack sufficient defenses against current cyber threats. Neuberger cited breaches involving over 167 million individuals in 2023, with attacks like ransomware growing by over 100% in recent years​.

Response to Chinese hacker threat

During the briefing, Neuberger provided an update on the Salt Typhoon cyber espionage campaign attributed to Chinese actors, which exploited vulnerabilities in U.S. telecom networks. The investigation has revealed that attackers leveraged compromised network configurations to access sensitive data and geolocate individuals, exposing millions to potential espionage. This incident underscores the urgent need for the proposed regulatory changes to prevent such compromises in critical infrastructure​.

The HHS proposal incorporates lessons from the ongoing investigation into Salt Typhoon, with an emphasis on:

• Vulnerability management: Requiring healthcare organizations to identify and patch security weaknesses promptly.
• Segmented network architecture: Ensuring attackers cannot gain unrestricted access even if an initial compromise occurs.
• Collaboration across sectors: Establishing frameworks for faster information sharing on cyber threats and incidents​.

While the proposed rules will impose new costs—estimated at $9 billion for the first year and $6 billion annually for the following four years—HHS argues that the long-term benefits far outweigh these expenses. Cyber breaches in healthcare currently cost an average of $10.1 million per incident. The department asserts that failure to act could result in more significant financial losses and jeopardize patient safety​.

Countries like the UK and Australia have already implemented stricter cybersecurity regulations for their healthcare sectors, leading to quicker incident detection and mitigation. Drawing on these examples, the U.S. seeks to modernize its framework and strengthen its defenses. The proposed changes are open for public comment until early 2025, with a final rule expected to take effect later that year​.