💊Delay of HIPAA Modifications
In accordance with the Presidential memorandum of January 20, 2025, titled "Regulatory Freeze Pending Review," the effective date of the final rule titled "Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard" is delayed until April 14, 2025. That final rule adopted updated versions of the retail pharmacy standards for electronic transactions adopted under the Administrative Simplification subtitle of HIPAA, which constitute modifications to the adopted standards for the following retail pharmacy transactions: health care claims or equivalent encounter information; eligibility for a health plan; referral certification and authorization; and coordination of benefits. It also adopted a modification to the standard for the Medicaid pharmacy subrogation transaction.
Learn More🔐Proposed HIPAA Security Rule Enhancements for Cybersecurity Compliance
The Department of Health and Human Services (HHS or "Department") is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Security Standards for the Protection of Electronic Protected Health Information ("Security Rule") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposed modifications would revise existing standards to better protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The proposals in this NPRM would increase the cybersecurity for ePHI by revising the Security Rule to address: changes in the environment in which health care is provided; significant increases in breaches and cyberattacks; common deficiencies the Office for Civil Rights has observed in investigations into Security Rule compliance by covered entities and their business associates (collectively, "regulated entities"); other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and court decisions that affect enforcement of the Security Rule.
Learn More