HHS Pause on Communications, HIPAA Updates, and Performance Goals for 2025

Welcome to this week's update on the Department of Health and Human Services (HHS). The most significant headline this week is the Trump administration's directive to pause all external communications from federal health agencies until February 1, 2025. This pause includes issuing documents, guidance, notices, public speaking, and social media communications, with exceptions for critical health, safety, environmental, financial, or national security functions[3]. This pause could delay policy information and guidance from HHS agencies, impacting healthcare providers who may need critical advice. Healthcare providers are encouraged to contact regulatory agencies for necessary guidance, even if the agency cannot provide immediate advice during the pause. In other news, HHS has proposed significant updates to the HIPAA Security Rule, aiming to enhance cybersecurity measures within the healthcare sector. The proposed changes include eliminating the distinction between "required" and "addressable" provisions, requiring encryption of electronic protected health information (ePHI) at rest and in transit, and implementing multifactor authentication for systems handling ePHI[5]. Public comments on the proposed rule are due by March 7, 2025. Additionally, HHS is expected to finalize HIPAA changes in 2025, including updates to patients' right to access and obtain copies of their protected health information, easing restrictions on disclosures of PHI without authorization, and promoting information sharing for treatment and care coordination[2]. Looking at broader initiatives, HHS has outlined its FY 2025 performance plan, which includes goals to improve behavioral health outcomes, enhance customer experience, and advance equity in health and human services. Key objectives include reducing emergency department visits for acute alcohol use, mental health conditions, suicide attempts, and drug overdose by 10 percent compared to the FY 2023 baseline, and increasing the number of individuals referred for behavioral health services by 20 percent[1]. These developments have significant impacts on American citizens, businesses, and state and local governments. For citizens, these changes can improve access to healthcare information and enhance the security of their personal health data. For businesses, the updated HIPAA Security Rule could require significant investments in cybersecurity measures. State and local governments will need to adapt to these changes to ensure compliance and effective public health strategies. To stay informed, citizens can visit the HHS website for updates on these initiatives and proposed rules. Public input is crucial, especially for the proposed HIPAA Security Rule changes. We encourage listeners to review the proposed rule and submit comments by March 7, 2025. In closing, the next steps to watch include the resumption of external communications from federal health agencies after February 1, 2025, and the finalization of HIPAA This content was created in partnership and with the help of Artificial Intelligence AI.