Industry Continues to Push Back on HIPAA Security Rule Overhaul

Industry opposition to the proposed HIPAA Security Rule overhaul is solidifying as 100 healthcare organisations, led by CHIME, urge the rule to be withdrawn and revised. In January 2025, the US Department of Health and Human Services announced the update aimed at strengthening cybersecurity in the healthcare sector, with a public comment deadline of 7 March as the process progressed.

The coalition letter criticises new financial burdens and unrealistic implementation timelines, arguing the rule would impose significant cost and operational strain without delivering proportional security benefits. Chelsea Arnone, CHIME’s director of federal affairs, notes that the proposed deadlines for compliance—60 days after publication and 180 days to meet new standards—are misaligned with how hospitals operate, given the need for round‑the‑clock patient care and complex workflows.

Arnone also highlights that revising thousands of BAAs will be a lengthy process, potentially taking a year for well‑resourced hospitals to align contracts. Mind CEO Eran Barak emphasises that while cybersecurity standards must improve, the rule must be phased, risk‑based and realistically implementable to avoid disrupting patient care.