Final actions on proposed HIPAA Security Rule updates are anticipated next year. Since the Security Rule hasn’t had a major overhaul since 2003, and technology has significantly advanced over the last 20 years, major changes are expected. Dentists will want to understand how the updates could impact their practice and what steps they should take to minimize risk of noncompliance.
CDA members have ongoing access to specialized guidance and resources for staying on top of HIPAA, OSHA and other regulatory requirements. However, changing HIPAA rules may feel especially complex and unclear. That’s why CDA is working with Abyde, the Endorsed Services partner for HIPAA and OSHA compliance, to translate the security rule changes and help members navigate them with confidence.
What’s changing
Clearing up language: “Addressable” was never optional
Current: The Security Rule categorizes implementation specifications as either required or addressable
Proposed update: Eliminate the “addressable” categorization
Why the change? Some practices have misunderstood “addressable” to mean optional, and the Department of Health and Human Services’ Office for Civil Rights says that interpretation is incorrect. Covered entities and business associates must implement an addressable specification if it’s reasonable and appropriate. If it isn’t, the practice must document why and adopt an equivalent alternative where reasonable.
What’s brand new
The Security Rule changes would add:
- Asset inventories and network maps
- Annual compliance audits
- Vulnerability scanning every six months
- Annual penetration testing
- Multifactor authentication and network segmentation
- 72-hour system restoration procedures
- Annual business associate verification
If a cyberattack occurs, OCR will request documentation either way. By implementing these preventive measures, practices will be investigated by OCR for how their safeguards failed rather than why they didn’t have safeguards.
What practices should do now
Your practice’s first step should be conducting a Security Risk Analysis. If one is already in place, confirm that it’s thorough, current and accurate. For practices that don’t—or have one that is more than a year old—start by understanding what a satisfactory analysis includes and prioritize conducting one.
A Security Risk Analysis that satisfies the requirement:
- Is accurate and thorough
- Reviews how a practice keeps patient data secure
- Covers electronic patient health information as it enters, moves within and leaves the practice
What doesn’t satisfy the requirement:
- A gap analysis or a simple checklist
The HIPAA Security Rule changes are approaching quickly. Don’t wait until they’re finalized in July 2027 to take action to manage compliance risks. Check upcoming compliance deadlines or schedule a compliance consultation with Abyde for more guidance specific to your practice.
Abyde is a CDA Endorsed Services partner and provides HIPAA compliance software for independent and group dental and medical practices. This article is intended for educational purposes and does not constitute legal advice.