HHS OCR Seeks Questions About HIPAA Security Rule Risk Management Requirement

The HHS Office for Civil Rights (OCR) is producing a pre-recorded video for HIPAA covered entities and business associates reviewing the HIPAA Security Rule’s Risk Management implementation specification. According to HHS Office for Civil Rights, OCR welcomes questions that could be addressed during this video and asks regulated entities to send them to [email protected] no later than 8 December 2025.

The speaker identified for the session is Nicholas Heesters, Senior Advisor for Cybersecurity, HHS Office for Civil Rights. Topics to be covered include the Security Rule Risk Management requirements, OCR investigations with potential Risk Management violations, and available risk management and cybersecurity resources, as well as responses to select submitted questions.

The post announcing the event was published on 1 December 2025, and the request for questions provides a clear deadline and contact avenue for interested regulated entities.