New HIPAA rule makes the ‘addressable’ required, even before it’s finalized, Part B News quotes Avery Dial, Esq., 1-20-2025

A proposed rule from HHS would confirm that cybersecurity measures such as multi-factor authentication (MFA) and encryption of electronic protected health information (ePHI) are not option safeguards, but something covered entities such as physician practices are required to implement to stay compliant with HIPAA.

There are many nuances to the rule for entities to consider, notes Avery A. Dial, Fort Lauderdale Partner and Chair of KD’s Data Privacy and Cybersecurity Practice Group in the article in Part B News. He clarifies in the article that the rule states that entities must be able to not only authenticate persons requesting ePHI, but also authenticate “technology assets” such as servers and apps that make those requests. The rule also requires that your “electronic information systems are segmented to limit access to ePHI to authorized workstations.” That means, Dial says, “you only allow people to access what [ePHI] they need to do their jobs.” 

This article was reprinted with permission from Part B News: https://pbn.decisionhealth.com/

Read more at the full article.