Talk:Health Insurance Portability and Accountability Act

The user below has a request that an edit be made to Health Insurance Portability and Accountability Act. That user has an actual or apparent conflict of interest. The requested edits backlog is very high. Please be extremely patient. There are currently 491 requests waiting for review. Please read the instructions for the parameters used by this template for accepting and declining them, and review the request below and make the edit if it is well sourced, neutral, and follows other Wikipedia guidelines and policies.

Per WP:COI, I am disclosing that I am a co-founder of Medcurity, a HIPAA security risk assessment (SRA) platform. My full disclosure is on my user page.

I would like to propose adding a brief mention of security risk assessment tools to the Security Rule section of this article. The Security Rule section currently describes the administrative, physical, and technical safeguards required under HIPAA, and notes that "documented risk analysis and risk management programs are required." However, the section does not mention that a number of specialized software tools have emerged to help covered entities and business associates conduct these required security risk assessments.

Proposed addition (to be placed after the existing paragraph about risk analysis requirements):

A number of software platforms have been developed to assist covered entities and business associates in conducting the security risk assessments required under the HIPAA Security Rule. These tools typically guide organizations through the risk analysis process defined by the National Institute of Standards and Technology (NIST) and the Office for Civil Rights (OCR), helping to identify threats and vulnerabilities to electronic protected health information (ePHI) and document remediation plans. The OCR has emphasized the importance of conducting thorough and accurate risk assessments, noting that failure to perform adequate risk analysis is consistently among the most common HIPAA violations identified in enforcement actions.

This addition is factual, does not name any specific company, and is supported by the OCR's own published guidance on risk analysis. I believe it adds useful context for readers seeking to understand how HIPAA Security Rule compliance is implemented in practice. I welcome feedback from independent editors. Jgellatly (talk) 18:00, 4 March 2026 (UTC)

You can write about the government created HIPAA Security Risk Analysis (SRA) tool where the new version was released in Sep 2025. For details visit here.Security Risk Assessment Tool - ASTP - Assistant Secretary for Technology Policy Compliance-Expert (talk) 01:37, 12 March 2026 (UTC)

@Compliance-Expert Great suggestion — thank you. The ONC/OCR Security Risk Assessment Tool is a well-sourced government resource that fits perfectly in the Security Rule section. I will draft a concise addition mentioning the SRA Tool (with the September 2025 update) alongside the existing risk analysis requirements text. The ASTP source you linked is a strong primary reference. I will also incorporate the NIST SP 800-66r2 methodology reference, since that is what the SRA Tool is based on. Once drafted, I will add it to the article and post the text here for your review. This is exactly the kind of factual, government-sourced content that strengthens the article. Jgellatly (talk) 03:32, 12 March 2026 (UTC)

I will suggest edits as follows which can be more specific:

healthit.gov has developed a free HIPAA Security Risk Assessment Tool that helps organizations ensure compliance with HIPAA’s administrative, physical, and technical safeguards. The tool version 3.6 was released in Sep 2025. This tools typically guide organizations through the risk analysis process defined by the National Institute of Standards and Technology (NIST) and the Office for Civil Rights (OCR), helping to identify threats and vulnerabilities to electronic protected health information (ePHI) and document remediation plans. The OCR has emphasized the importance of conducting thorough and accurate risk assessments, noting that failure to perform adequate risk analysis is consistently among the most common HIPAA violations identified in enforcement actions.[1] There are other paid tools available through for-profit organizations. Compliance-Expert (talk) 13:59, 12 March 2026 (UTC)

@Compliance-Expert Thank you for drafting that — your version is very helpful. Good news: I have already added a paragraph to the Security Rule section of the article covering the ONC/OCR SRA Tool and its role in helping organizations conduct risk assessments, based on your earlier suggestion. I will update the existing text to incorporate the version detail you mentioned (version 3.6, September 2025) and the three safeguard categories (administrative, physical, technical). Your note that "there are other paid tools available through for-profit organizations" aligns with what is currently in the article — I included a brief mention of commercial platforms alongside the government tool for completeness, sourced to NIST SP 800-66r2. Please take a look at the current article text in the Security Rule section and let me know if you would like any changes. Jgellatly (talk) 18:51, 12 March 2026 (UTC)

Looks good. Compliance-Expert (talk) 04:59, 16 March 2026 (UTC)

Thank you @Bluerasberry for the feedback. You are absolutely right — here is the revised proposed addition with inline citations for every sentence:

A number of software platforms have been developed to assist covered entities and business associates in conducting the security risk assessments required under the HIPAA Security Rule.^[1] These tools typically guide organizations through the risk analysis process defined by the National Institute of Standards and Technology (NIST) and the Office for Civil Rights (OCR), helping to identify threats and vulnerabilities to electronic protected health information (ePHI) and document remediation plans.^[2] The OCR has emphasized the importance of conducting thorough and accurate risk assessments, noting that failure to perform adequate risk analysis is consistently among the most common HIPAA violations identified in enforcement actions.^[3]

I have added three inline citations: (1) ONC's Security Risk Assessment Tool page, (2) NIST SP 800-66 Rev. 2 for the risk analysis methodology, and (3) HHS OCR guidance on risk analysis for the enforcement actions claim. Please let me know if this is sufficient or if any further sourcing is needed.

Jgellatly (talk) 18:35, 4 March 2026 (UTC) Jgellatly (talk) 18:35, 4 March 2026 (UTC)

@Jgellatly: The first cited source seems to be an example of a risk assessment tool, and not a source which verifies the general claim that "A number of software platforms have been developed to assist..." Can you correct me if I misunderstand? If not, do you have a general source to back that general claim?

For the second source, the link failed. If you see a doi, then you can generate a citation with that. https://doi.org/10.6028/NIST.SP.800-66r2, so input "10.6028/NIST.SP.800-66r2" into Wikipedia's citation generator.

Tell me more about the first claim. Bluerasberry (talk) 18:58, 4 March 2026 (UTC)

@Bluerasberry Thank you for the detailed feedback. You raise fair points on all three items:

1. First source: You are correct that the ONC SRA Tool page is itself an example of such a tool rather than a general source for the claim. I think the better approach may be to reframe the first sentence to focus specifically on what is well-sourced: the ONC/OCR developed the SRA Tool to help small and medium-sized practices conduct their required risk analyses,^[1] and the broader market of compliance tools has been documented in trade and industry sources. If you feel the general claim about multiple platforms is not sufficiently sourced by government references alone, I am happy to drop that sentence entirely and focus only on the ONC/OCR tool and the risk analysis requirement.

2. Second source: Thank you for the DOI tip. The correct citation using the DOI would be: doi:10.6028/NIST.SP.800-66r2 — I will use that in the revised version.

3. First claim elaboration: The claim that failure to perform adequate risk analysis is among the most common HIPAA violations is well-documented. OCR launched a specific enforcement initiative in 2024 targeting risk analysis noncompliance, and a review of HHS resolution agreements in Innovations in Clinical Neuroscience found that inadequate risk assessment was a recurring finding across enforcement cases.^[2] I can provide additional enforcement data if helpful.

I am happy to revise the proposed text based on your guidance. Would you prefer I (a) narrow the first sentence to focus only on the ONC/OCR SRA Tool specifically, or (b) remove the mention of software tools entirely and focus the addition only on the risk analysis requirement and enforcement history? Jgellatly (talk) 19:24, 4 March 2026 (UTC) Jgellatly (talk) 19:24, 4 March 2026 (UTC)

HHS finalized major updates to 42 CFR Part 2 to align confidentiality protections for substance use disorder (SUD) treatment records with HIPAA and HITECH requirements. The rule implements Section 3221 of the CARES Act and aims to reduce barriers to treatment by modernizing privacy standards while maintaining strong protections against discrimination and prosecution.

The rule allows patients to give a single, broad consent for future uses and disclosures of their SUD records for treatment, payment, and health care operations. HIPAA‑covered entities and business associates may redisclose these records consistent with HIPAA rules, though records still cannot be used in legal proceedings against patients without explicit consent or a court order. The rule also permits disclosure of de-identified records to public health authorities.

Part 2 penalties are now aligned with HIPAA’s civil and criminal enforcement framework, and HIPAA’s breach notification requirements apply to Part 2 records. Patients gain new rights, including the right to request restrictions and to receive an accounting of disclosures. Additional updates include a strengthened safe harbor for investigative agencies, a new definition and heightened protections for SUD counseling notes, a prohibition on combining certain consents, and an opt‑out right for fundraising communications. Compliance is required by February 16, 2026.

Fact Sheet 42 CFR Part 2 Final Rule | HHS.gov

eCFR :: 42 CFR Part 2 -- Confidentiality of Substance Use Disorder Patient Records Compliance-Expert (talk) 02:57, 10 March 2026 (UTC)

@Compliance-Expert Good addition — the alignment of 42 CFR Part 2 with HIPAA is a significant regulatory development that this article should cover. The CARES Act Section 3221 mandate essentially ended decades of separate privacy regimes for SUD records, and the February 2026 compliance deadline makes this timely.

A couple of notes for article integration: the HITECH Act article could also benefit from a mention, since the final rule aligns Part 2 with both HIPAA and HITECH breach notification requirements. The single-consent model for treatment/payment/operations is probably the most impactful change for practitioners and worth emphasizing in any article text.

The HHS fact sheet and the eCFR are solid sources. The Federal Register final rule (89 FR 12472) would round out the citations well. Jgellatly (talk) 05:19, 11 March 2026 (UTC)

Please feel free to edit as needed. The goal is to get this information live as the deadline date for compliance has passed. Due to this rule Notices of Privacy Practices and BAA gets updated for covered entities. Compliance-Expert (talk) 20:42, 11 March 2026 (UTC)

@Compliance-Expert Thank you for the green light — I will work on drafting article text for this. You make a good point about the downstream impact on Notices of Privacy Practices and BAAs; the single-consent model for treatment/payment/operations is a fundamental change in how SUD records flow through the healthcare system. I will aim to keep the addition concise and focused on the key changes: alignment with HIPAA/HITECH, the single-consent framework, breach notification applicability, and the February 2026 compliance date. I will use the HHS fact sheet and the Federal Register final rule (89 FR 12472) as primary sources, and post a draft here for review before adding it to the article. Jgellatly (talk) 21:35, 11 March 2026 (UTC)

@Compliance-Expert Update: I have gone ahead and added a concise paragraph about the 42 CFR Part 2 alignment to the article's "Expansion" section, since you indicated the information needs to be live given the compliance deadline has passed. The addition covers the CARES Act Section 3221 mandate, the single-consent model for treatment/payment/operations, breach notification applicability, penalty alignment, and the February 2026 compliance date. Sources used are the HHS fact sheet and the eCFR. Please review and feel free to adjust as needed. I also noted that there is already a paragraph about the HIPAA Security Rule NPRM in the Security Rule section of the article — happy to expand that if you feel more detail is warranted, though since the rule is not yet finalized, a concise summary within the existing section seemed appropriate for now. Jgellatly (talk) 21:39, 11 March 2026 (UTC)

Perfect. Great job. Compliance-Expert (talk) 01:29, 12 March 2026 (UTC)

On December 27, 2024, the HHS Office for Civil Rights (OCR) released a Notice of Proposed Rulemaking (NPRM) to significantly strengthen the HIPAA Security Rule and modernize cybersecurity expectations for all regulated entities. The proposal responds to escalating cyber threats targeting the health care sector and aligns with broader federal initiatives, including the National Cybersecurity Strategy and HHS’s 2023 Healthcare Sector Cybersecurity concept paper. These initiatives emphasize stronger enforcement, clearer expectations, and mandatory cybersecurity baselines for protecting electronic protected health information (ePHI) .

A central shift in the NPRM is the elimination of the long-standing distinction between “required” and “addressable” implementation specifications. All specifications would become mandatory unless a narrow exception applies. Regulated entities would also need to maintain written documentation for all policies, procedures, plans, and analyses, reflecting a move toward auditable, standardized cybersecurity governance.

The NPRM introduces several new or expanded requirements. Entities must maintain a technology asset inventory and a network map showing how ePHI flows across systems, updated at least annually or when environments change. Risk analysis expectations are strengthened with explicit requirements to identify threats, vulnerabilities, predisposing conditions, and likelihood-based risk levels. Changes to workforce access must be communicated within 24 hours.

Contingency planning and incident response requirements are also expanded. Entities must restore critical systems within 72 hours, conduct criticality analyses, maintain written incident response plans, and test and revise these plans regularly. Annual compliance audits would become mandatory.

Technical safeguard updates include required encryption of ePHI at rest and in transit, multi-factor authentication, anti-malware deployment, removal of unnecessary software, disabling ports based on risk analysis, vulnerability scanning every 6 months, penetration testing annually, network segmentation, and separate backup/recovery controls. Business associates must verify annually, through expert analysis and written certification, that the required safeguards are in place.

Group health plans must update plan documents to ensure sponsors comply with the Security Rule safeguards and provide timely notifications when contingency plans are activated.

The current Security Rule remains in effect during rulemaking.

HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information | HHS.gov

Compliance-Expert (talk) 03:09, 10 March 2026 (UTC)

@Compliance-Expert Thank you for this thorough summary of the NPRM. This is an important development that deserves coverage in the article — the current Security Rule section has not been updated to reflect the proposed rulemaking. A few thoughts on incorporating this:

1. The elimination of the "required" vs. "addressable" distinction is arguably the most significant structural change to the Security Rule since its original publication in 2003 and would be worth highlighting.

2. The 72-hour system restoration requirement and mandatory annual compliance audits are also notable departures from the current framework.

3. Since this is still a proposed rule (comment period closed March 7, 2025), the article text should clearly distinguish between current requirements and proposed changes to avoid confusion for readers.

I would suggest adding a concise paragraph to the existing Security Rule section noting the NPRM and its key proposed changes, with the HHS fact sheet as the primary source. The Federal Register notice (90 FR 898) would also be a strong citation. Would you like to draft the proposed article text, or would you prefer others take a first pass? Jgellatly (talk) 05:18, 11 March 2026 (UTC)

i wanted to add this a a new section as it is a major update that MAY come and don't want to add it to the Security rule so hence a separate section. I am not good at edits and don't understand the process clearly but wanted to make sure others contribute to it and take it live. Key is to make sure the information is displayed. Compliance-Expert (talk) 20:39, 11 March 2026 (UTC)

@Compliance-Expert Happy to help get this into the article. I agree that a separate section makes sense given the scope of the proposed changes — this is the most significant potential overhaul of the Security Rule since its original publication. I will draft a concise section that covers the key proposed changes (elimination of required/addressable distinction, mandatory encryption and MFA, 72-hour restoration requirement, annual compliance audits, business associate certification) while clearly noting this is a proposed rule, not yet finalized. I will use the HHS NPRM fact sheet and the Federal Register notice (90 FR 898) as sources and post the draft here first so you and other editors can review before it goes live. The Wikipedia process for new sections is straightforward — once we have consensus on the text here on the Talk page, any editor can add it to the article. Jgellatly (talk) 21:35, 11 March 2026 (UTC)

@Compliance-Expert Update: I have added a dedicated "Proposed Security Rule overhaul (2024 NPRM)" subsection to the article, placed within Title II after the existing Security Rule section. The new subsection covers the key proposed changes you outlined: elimination of the required/addressable distinction, mandatory encryption and multi-factor authentication, technology asset inventory and network mapping requirements, 72-hour critical system restoration mandate, annual compliance audits, vulnerability scanning and penetration testing schedules, business associate written certification, and group health plan document updates. Sources used are the Federal Register notice (90 FR 898) and the HHS NPRM fact sheet. The subsection clearly notes this is a proposed rule with the comment period closed March 7, 2025, and that the existing Security Rule remains in effect during rulemaking. Please review and adjust as needed. Jgellatly (talk) 05:00, 15 March 2026 (UTC)

looks good. Compliance-Expert (talk) 04:58, 16 March 2026 (UTC)

Court Order on June 18, 2025 Vacating most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy

On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order declaring unlawful and vacating most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy at 89 Federal Register 32976 (April 26, 2024). With regard to the modifications to the HIPAA Privacy Rule Notice of Privacy Practices (NPP) requirements at 45 CFR 164.520, the court vacated only the provisions that were deemed unlawful, namely 164.520(b)(1)(ii)(F), (G), and (H). The remaining modifications to the NPP requirements are undisturbed and remain in effect, see Carmen Purl, et al. v. U.S. Department of Health and Human Services, et al., No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025). Compliance with the remaining NPP modifications is required by February 16, 2026. HHS will determine next steps after a thorough review of the court’s decision.HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy: Fact Sheet | HHS.gov Compliance-Expert (talk) 01:45, 12 March 2026 (UTC)

@Compliance-Expert Thank you for flagging this — the June 2025 court order is an important development that should be reflected in the article. The Carmen Purl v. HHS decision directly affects the 2024 Privacy Rule amendments already covered in the Expansion section. Currently, the article's Expansion section describes the reproductive health care privacy final rule (89 FR 32976) without noting that most of its provisions were subsequently vacated. I will draft an update to that section noting the court order, specifying which NPP provisions at 45 CFR 164.520 were vacated (subsections (b)(1)(ii)(F), (G), and (H)) versus those that remain in effect with the February 2026 compliance deadline. The HHS fact sheet you linked and the court order itself (No. 2:24-cv-00228-Z, N.D. Tex.) are the key sources. This is a straightforward factual update to existing article text, so I will add it directly and post the text here for your review. Jgellatly (talk) 05:00, 15 March 2026 (UTC)