Health IT Security and Compliance



HIPAA Enforcement Marches On (?)

By Matt Fisher – The Office for Civil Rights announced another cyber incident driven HIPAA civil monetary penalty on February 20, 2025. The settlement broke a one month lull in HIPAA enforcement announcements, though looking at the dates in the documents (all go back to the last quarter or so of 2024), it may not necessarily be an indication that enforcement of HIPAA remains an ongoing immediate priority.




Not 1, Not 2, but 6 Settlements

By Matt Fisher – Prior to the changeover of the administration, the HHS Office for Civil Rights went on a bit of a HIPAA settlement bender. The fast pace of announced settlements felt a bit like a clearing of the decks. The various settlements continued recent trends around the issues being selected by OCR for settlement along with the still random amount of settlements.


Security Changes in the Wind

By Matt Fisher – On January 6, 2025, the Department of Health and Human Services officially published a notice of proposed rulemaking to modify and update the HIPAA Security Rule. The timing of the proposed rule leaves any sort of immediate action with a lot of uncertainty (changing administrations bring changing priorities and delays).