NIST Updates Guidance on HIPAA Security Rule Compliance
The National Institute of Standards and Technology (NIST) has updated its guidance for HIPAA-regulated entities on implementing the HIPAA Security Rule to help them better protect patients’ personal and protected health information.
The Security Rule of the Health Insurance Portability and Accountability Act established national standards for protecting the electronic protected health information (ePHI) that HIPAA-regulated entities create, receive, maintain or transmit. Ensuring compliance with the HIPAA Security Rule is more important than ever due to the increasing number of cyberattacks on HIPAA-regulated entities.
NIST published the first revision of its HIPAA Security Rule guidance in 2008, 6 years before the release of the NIST Cybersecurity Framework. Over the past 14 years, NIST has released other cybersecurity guidance and has regularly updated its Security and Privacy Controls (NIST SP 800-53). One of the main reasons for updating the HIPAA Security Rule guidance was to integrate it into NIST guidance that did not exist when Revision 1 was published in 2008.
“One of our main goals is to help make the updated publication more of a resource guide,” said Jeff Marron, a NIST cybersecurity specialist. “The revision is more actionable so that healthcare organizations can improve their cybersecurity posture and comply with the Security Rule.”
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
NIST has mapped the elements of the HIPAA Security Rule to the NIST Cybersecurity Framework subcategories, the controls in NIST SP 800-53, has increased the emphasis on the risk management component of the guidance, and has integrated enterprise risk management concepts. NIST has also factored in the feedback received from healthcare industry stakeholders in its pre-draft call for comments.
The latest revision is more of a refresh than an overhaul. The structure of the guidance has only changed slightly with the content updated to have an increased emphasis on assessment and management of risk to ePHI
“We provide a resource that can assist you with implementing the Security Rule in your own organization, which may have particular needs,” said Marron. “Our goal is to offer guidance and resources you can use in one readable publication.”
Comments will be accepted by NIST on the updated guidance – Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (NIST Special Publication 800-66, Revision 2) – until September 21, 2022.
