The AHA today urged the Department of Health and Human Services’ Office for Civil Rights to quickly initiate rulemaking for a legislative provision (H.R. 7898) enacted by Congress this year to recognize certain recommended security practices when making determinations related to Health Insurance Portability and Accountability Act audits, fines and resolution agreements.

“The law appropriately recognizes that covered entities and business associates, like all entities including the Federal Government, can never fully eliminate the risk of cyberattacks,” AHA wrote. “When the inevitable attack occurs, entities should not be penalized, but rather treated as the victims of a crime. The law translates this concept by allowing certain measures of regulatory relief if the HIPAA-covered entity or business-associate victim had in place federally recognized security practices, such as those defined under the National Institute of Standards and Technology (NIST) Cybersecurity Framework and developed under Section 405(d) of the Cybersecurity Act of 2015.”
 

Related News Articles

Headline
As urged by the AHA, the Department of Health and Human Services today renewed the COVID-19 public health emergency declaration for another 90 days…
Headline
The Cybersecurity and Infrastructure Security Agency, FBI and National Security Agency yesterday released recommendations to help health care and other…
News
A report by the United Kingdom’s National Health Service is warning of threats leveraging Log4Shell vulnerability in VMware Horizon servers by an unknown cyber…
Headline
Health and Human Services Secretary Xavier Becerra today in a letter to health care and public health leaders urged vigilance against cyber threats posed…
Headline
John Riggi, AHA’s national advisor for cybersecurity and risk, discusses insights and lessons learned from hospital leaders from Dickinson County Healthcare…
News
The Centers for Medicare & Medicaid Services Dec. 28 issued a proposed rule that would implement for 2023 the standards governing health insurance issuers…