HHS Proposes Sweeping HIPAA Security Rule Updates, Dietary Guidelines Shift, and Rulemaking Policy Changes

Welcome to this week's HHS update. The big headline: HHS has proposed major changes to strengthen the HIPAA Security Rule, aiming to boost cybersecurity for electronic protected health information. The proposed rule, published on January 6th, 2025, would revise and clarify definitions, remove the distinction between "required" and "addressable" implementation specifications, and add new compliance requirements. HHS estimates first-year costs of $9 billion, with $6 billion annually for years two through five. HHS Secretary Robert F. Kennedy Jr. stated, "We're ensuring the dietary guidelines reflect public interest and serve public health, rather than special interests." This comes as HHS and the USDA continue work on the 2025-2030 Dietary Guidelines for Americans, with a public comment period that closed on February 10th. In a significant policy shift, HHS reversed a 50-year-old stance on public participation in rulemaking. On March 3rd, 2025, HHS published a policy statement limiting circumstances where agencies must publish proposed rules for public comment before finalization. This move could affect many HHS programs and financial relationships. The Centers for Medicare & Medicaid Services issued the "Marketplace Integrity and Affordability Proposed Rule," introducing new standards for Health Insurance Marketplaces and related entities. Key proposals include strengthening income verification, modifying eligibility redetermination procedures, and adopting pre-enrollment verification for special enrollment periods. These developments will impact American citizens, healthcare providers, and businesses in various ways. The HIPAA changes aim to enhance data protection but may pose implementation challenges, especially for smaller entities. The dietary guidelines will influence nutrition policies and food industry practices. The rulemaking policy shift could reduce public input opportunities, while the Marketplace rule seeks to improve program integrity and affordability. Looking ahead, the comment period for the HIPAA Security Rule update closes on March 7th, 2025. HHS is also set to begin a new HIPAA audit program focusing on risk analysis and risk management requirements. For more information on these developments, visit the HHS website at hhs.gov. If you'd like to provide input on the proposed rules, check the Federal Register for open comment periods. Stay informed and engaged as these changes unfold, shaping the future of health and human services in America. This content was created in partnership and with the help of Artificial Intelligence AI.