Credit for security practice, payable only in arrears

The week

On January 5, 2021, the president signed H.R. 7898, a brief amendment to the HITECH Act, the law that strengthened enforcement of HIPAA, the federal rules that protect patients’ health information. It passed in a week dominated by other news, and very few people outside health care compliance noticed.

The bill had moved quickly at the end of the congressional session. The House passed it on December 9, 2020, and the Senate on December 19. The signature came a day before the attack on the Capitol consumed the news. For health care security teams, the timing fell in a hard stretch. In late October 2020, CISA, the FBI and HHS had issued a joint advisory warning of an increased and imminent ransomware threat to US hospitals and health care providers. Universal Health Services, a large hospital operator, had been hit by ransomware that September. In December the SolarWinds compromise added a supply chain worry, while hospitals were running COVID-19 surge operations and starting vaccinations.

Its idea was simple and, for hospitals, welcome. Health organizations are frequent targets of cyberattacks, and when patient data is exposed, the HHS Office for Civil Rights investigates and can impose penalties. The new law told HHS to weigh good behavior in the balance. HHS must now consider whether an organization had recognized security practices in place for the previous 12 months. That applies when it investigates a covered entity or business associate, sets a civil money penalty or decides audit outcomes.

A quick translation of the terms. A covered entity is an organization HIPAA directly regulates, such as a hospital, a doctor’s practice or a health plan. A business associate is a vendor that handles patient data on its behalf, such as a billing company or a cloud software provider. A civil money penalty is a fine.

The penalty structure the credit would act on was already tiered. HIPAA civil penalties rise with culpability, from violations an organization did not know about to willful neglect left uncorrected. Since 2019 HHS had applied lower annual caps to the less culpable tiers, under a notice of enforcement discretion. Many OCR investigations end without a formal penalty at all, in technical assistance or a negotiated resolution agreement. The new law reached each of those outcomes.

What counts as “recognized security practices”? The law defines them by reference to two well-known sources. The first is the NIST Cybersecurity Framework, a widely used structure from the National Institute of Standards and Technology for organizing security work. The second is the practices developed under section 405(d) of the Cybersecurity Act of 2015, which HHS publishes as the Health Industry Cybersecurity Practices, a guide written specifically for health care. Other approaches recognized by statute or regulation also count.

The text named three places to apply the credit. Recognized practices may mitigate fines, lead to the early and favorable termination of an audit, or mitigate the remedies in an agreement resolving potential Security Rule violations. The organization itself decides which practices to adopt, consistent with the Security Rule. The wording places the burden on the organization: HHS “shall consider” whether it has “adequately demonstrated” the practices were in place.

Adoption is voluntary. The law creates no new penalty for organizations that do not adopt these practices, and it does not change breach notification duties: an organization that suffers a breach must still tell the people affected.

The law also protected organizations in the other direction. It gave HHS no authority to raise fines or extend audits because an organization lacked recognized practices, and it created no liability for choosing not to adopt them. It left the Secretary’s power to enforce the Security Rule intact. A short second section, unrelated to security, gave the HHS inspector general investigative authorities for information blocking cases under the 21st Century Cures Act.

So the law offered a carrot. What matters is what it takes to earn it, and the answer turns on two short phrases in the text.

H.R. 7898 reads like a small kindness to hospitals: do the right things and regulators will go easier after a breach. That reading is accurate as far as it goes. The operative words are “in place” and “12 months.” A plan, a policy set or a framework mapping does not satisfy the law on its own. It rewards a year of demonstrated practice before the incident.

The burden moves from intent to evidence, under a timing rule no budget can reverse after the fact. The law works like a safe-driver discount on car insurance. The discount goes to people with a clean record over time, not to those who buy a book about safe driving the day after an accident. The implications fall into three parts: what qualifies, what must be proven, and what the law leaves untouched.

The law is also a rare piece of regulatory clarity about timing. Most security decisions are argued in terms of probability: how likely is an attack, how bad would it be. This law adds a calendar. Every month a key control is delayed is a month that cannot later be counted.

Breaches, controls and evidence

A breach, in HIPAA’s sense, is when patients’ health information is used or disclosed in a way the rules do not allow. Today the most damaging breaches usually come from cyberattacks, such as ransomware: malicious software that locks up an organization’s computer systems and data, with criminals demanding payment to unlock them and often threatening to publish stolen records.

A security framework is an organized catalog of the things a well-run security program should do. It describes outcomes to achieve and leaves room for different organizations to meet them in different ways.

A control is a specific safeguard that does part of that work. Requiring a second proof of identity when staff log in is a control. So is applying software fixes on a schedule, testing backups, and removing a departing employee’s access on their last day.

Multifactor authentication, often called MFA, is that second proof of identity. A password is something you know; MFA adds something you have, such as a code on your phone, and it defeats many attacks that rely on stolen passwords.

Patching means installing updates that software makers release to fix security weaknesses. A vulnerability is one of those weaknesses. The time between a vulnerability becoming public and an organization fixing it is a period when attackers know about the weakness and the door is still open.

Evidence, in this context, means records that show a control actually operated: logs, reports, tickets and screenshots with dates on them. It is the difference between saying “we test our backups” and producing the results of each test.

A risk analysis is the Security Rule’s foundational requirement: an accurate and thorough assessment of the risks to electronic patient information across the organization. Risk management is the follow-through, the measures that reduce those risks to a reasonable level. OCR resolution agreements have cited missing or incomplete risk analyses again and again, so the risk analysis is usually the first document an investigator requests.

A resolution agreement is how many OCR investigations end when problems are found: a settlement payment plus a corrective action plan. The plan lists the fixes the organization must make and report on, often under monitoring for two or three years. The new law lets recognized practices soften those remedies as well as fines.

What qualifies

The law points to frameworks rather than specific controls. The NIST Cybersecurity Framework is a structure of functions and outcomes. The 405(d) practices are more concrete and come in versions for small, medium and large organizations, which makes them a natural fit for clinics and community hospitals.

What the two frameworks contain

The NIST Cybersecurity Framework, in the version current in 2021, organized security into five functions: identify, protect, detect, respond and recover. Beneath them are categories and subcategories that describe outcomes. Examples include “remote access is managed” or “backups of information are conducted, maintained, and tested.” It says what to achieve, not which product or setting to use. Organizations describe their current and target states as profiles and then work the gap.

The 405(d) publication took a more concrete route. Its first edition, in 2018, started from five threats it judged most pressing for the sector. They were email phishing, ransomware, loss or theft of equipment or data, insider data loss, and attacks on connected medical devices. It answered them with ten practices, from email and endpoint protection to medical device security and incident response. Its technical volumes split the advice by organization size.

Neither is a pass-fail checklist. Each requires an organization to decide which practices apply, at what depth, and who owns them. That flexibility lets a rural hospital and an academic medical center both qualify. It also allows an organization to claim alignment with a framework without being able to show which practices it actually runs.

The practical choice is to pick one framework as the organizing spine and map existing controls to it, with gaps stated plainly. A “mapping” is simply a table that says, for each item in the framework, which of the organization’s controls addresses it, who owns it, and where it falls short. Health systems often use the 405(d) practices for clinical and operational detail and the NIST framework for board reporting. That works if one mapping links the two.

Scoping what counts as the organization

Before mapping anything, an organization has to decide what it is mapping. Health systems are often webs of hospitals, employed and affiliated physician groups, joint ventures and foundations. Some large institutions are hybrid entities under HIPAA, such as a university that designates its medical center and clinics as health care components. The Security Rule applies to those components, and the evidence scope should match the designation.

Scope gaps are where demonstrations fail. An affiliated practice that shares the hospital’s electronic health record but runs its own laptops and email may sit outside the evidence program by accident. If the incident starts there, the hospital’s year of evidence covers the wrong estate. The mapping should state its scope explicitly and list what is excluded and why.

How the choice differs by organization

A small physician practice or rural clinic, with no dedicated security staff, will find the small-organization guidance closest to its reality. Many of those practices can be contracted to a managed service provider. The evidence question then becomes a contract question: the provider’s monthly report has to show the controls operating, as well as the services delivered.

A community hospital typically adopts the medium-organization practices and maps them to the NIST framework for its board. An academic medical center adds research networks, affiliated physician groups and many more connected devices. It is more likely to run a formal NIST profile, with 405(d) practices as clinical detail beneath it. A health plan looks different again, with fewer clinical devices and more member data, claims systems and payment flows. Its security emphasis resembles a financial institution’s.

Business associates vary most. A cloud software company serving hospitals may already hold a SOC 2 report or an ISO 27001 certification. Neither is named in the law. Both can be mapped to the NIST framework, and a vendor relying on them should show that mapping rather than assume it is understood. A small billing company may have nothing formal at all, which is the gap a covered entity’s vendor review should find.

Running separate frameworks for different parts of the estate, without a single map, makes evidence much harder to assemble when an investigator asks. Take a health system that acquired two physician groups. Each brought its own security program and its own framework. When an investigator asks how MFA is enforced across the organization, three teams give three answers in three formats. None is wrong, but none adds up to a clear picture.

What must be proven

The 12-month look-back is the core of the law, and it is where most programs were weakest in 2021. Many health organizations could produce a risk analysis, a policy library and an annual penetration test report. A penetration test is a sanctioned simulated attack, carried out by specialists, to find weaknesses before criminals do. Far fewer organizations could show, month by month, that multifactor authentication was enforced and patches were applied within stated timeframes. Fewer still could show that backups were restored in tests and access reviews were completed.

That kind of evidence does not come from an annual assessment. It comes from systems that record control operation as a matter of course.

• Identity platforms, the systems that manage staff logins, log where multifactor authentication is enforced and which exceptions exist, with dates.
• Vulnerability tools record time from disclosure to remediation, by system class.
• Backup tools record restore tests and their results.
• Ticketing systems, the work-tracking tools IT teams use, capture access reviews, approvals and removals of access for departing staff.

Turning those outputs into evidence needs three decisions. Each practice needs a named owner. Each owner needs a defined evidence artifact, such as a monthly export or a dashboard snapshot, collected on a schedule. The artifacts need to be kept somewhere tamper-evident for at least as long as an investigation might reach back. “Tamper-evident” means that if anyone altered a record after the fact, it would show. HIPAA already expects security documentation to be retained for six years, so the storage policy largely exists.

What an investigator will ask

An OCR investigation typically starts with a data request letter. It asks for the risk analysis, the risk management plan, policies, evidence of specific safeguards and the facts of the incident, by a set deadline. After the 2021 law, organizations could also submit evidence of recognized security practices in that response. The statute’s test is whether the organization has “adequately demonstrated” them, and the organization carries that burden.

Adequate demonstration has two dimensions. The first is coverage: evidence that the practices span the organization, including acquired entities, remote sites and the systems involved in the incident. The second is duration: evidence for each month of the preceding year, not a single snapshot. A strong policy library with one month of reports fails the second test. Twelve months of reports from one hospital in a five-hospital system fails the first.

What a month of evidence looks like

For a medium-sized organization using the 405(d) practices, a month’s evidence might include the following.

• Email protection: the mail filtering policy export and the results of that month’s phishing simulation.
• Endpoint protection: a coverage report showing which devices have the endpoint security agent reporting, with exceptions listed.
• Access management: the MFA enforcement report and the completed review of privileged accounts.
• Asset management: a reconciliation of the inventory against what is actually on the network.
• Vulnerability management: time to remediate newly disclosed weaknesses, by system class.
• Incident response: the record of any exercise held, with the actions it produced.
• Medical devices: the device inventory and the exception register with compensating controls.

Each item is something a system already produces or a team already does. The evidence program adds the schedule, the owner and the place to keep it.

Investigators also look for consistency between documents. If the risk analysis names unpatched clinical devices as a high risk, the evidence should show what happened next. A risk identified and then left untouched for a year raises its own questions, because it shows the organization knew.

Privilege and the paper trail

Evidence programs raise a legal question security teams should not answer alone. Records created to show that controls operated are ordinary business records, and they can be sought in litigation as well as by regulators. Assessments commissioned by counsel to support legal advice may be treated differently. Courts have not always protected forensic and assessment reports, even when lawyers commissioned them. The sensible step is to agree with counsel which records are operational evidence and which analyses run under privilege.

Timing is the hard constraint

Because the look-back covers the year before an incident, the benefit cannot be bought after a breach. Investment in the months after an incident helps the next investigation, not the current one. For boards weighing security budgets, that is the most concrete argument the law offers. A control’s value in an investigation depends on how long it ran before something went wrong.

Suppose two community hospitals are hit by similar ransomware attacks on the same day. The first rolled out MFA for remote access fourteen months earlier and can produce monthly reports showing it was enforced, with a short, documented list of exceptions. The second approved the same project eight months ago, finished it three months ago, and has no reports from before go-live. Both now have MFA. Only the first can show a year of it.

Gaps in evidence carry their own risk. If an organization cannot show that a control operated, it should assume an investigator will treat it as absent. Evidence collection is therefore a control in its own right, and it deserves testing like any other. A quarterly check that each owner’s artifacts exist and are complete costs little.

Starting the clock

An organization starting from scratch faces a sequencing choice. It can wait until each control is mature before collecting evidence, or it can start collecting evidence of imperfect controls right away. The second is usually better. The 12 months begin only when the evidence does, and a record showing steady improvement is more persuasive than a record that starts late and looks perfect.

Early evidence also exposes problems that maturity work would otherwise hide. The first MFA report often reveals service accounts, vendor accounts and clinical workstations nobody had counted. Those exceptions become the work plan, and the monthly report shows them shrinking.

A year of evidence, built into the month

A year of evidence looks unremarkable when it is built into ordinary work. Take a community hospital whose chief information security officer keeps a single spreadsheet, the mapping, that lists each 405(d) practice relevant to a medium-sized organization. Next to each practice sits the name of an owner, the control that addresses it, the evidence that proves it, and how often that evidence is collected. The list is not long, but every line has a name and a date.

On the first business day of each month, a handful of things happen without anyone convening a meeting. The identity team exports a report from the login system showing which accounts require MFA and which exceptions exist, with the reason and approver for each. The infrastructure team exports the patching report, showing how long it took to fix each newly disclosed weakness, broken down by servers, laptops and clinical devices. The backup team records which systems were restored in a test that month and whether the restore worked. Each export goes into a protected evidence store where files can be added but not changed without a trace.

Every quarter, someone outside those teams, perhaps from internal audit or compliance, opens the evidence store and checks that each expected file is there. Where something is missing, the owner explains why and the gap is recorded. Those gap records matter too: an investigator who sees a missed month, explained and corrected, is looking at a program that works. An investigator who sees nothing at all for that month has no way to tell.

Once a year the mapping is reviewed against the framework, and the board receives a summary organized around the NIST framework’s functions, drawing on the same monthly evidence.

The evidence store needs a little design of its own. Files follow a naming convention that includes the practice, the month and the owner, so a missing file stands out. Access is limited to the people who add evidence and those who review it. The store keeps a log of additions, and retention is set to at least six years. An existing records or governance platform usually serves, which keeps the cost down.

Clinical devices need separate treatment. Infusion pumps, imaging systems and patient monitors often cannot be patched on the hospital’s schedule, because changes may need the manufacturer’s validation. The evidence for them looks different: an inventory, network segmentation that limits what an attacker can reach, compensating controls, and a record of each manufacturer’s patch status. An honest device exception register, with compensating controls, shows management at work. Devices missing from the patch report entirely show a gap.

The work is unglamorous by design and happens whether or not anything goes wrong. If the hospital is attacked next spring, the question “can you show your practices were in place for the past twelve months?” is answered by opening a folder. The alternative, reconstructing a year of records from memory and old emails in the middle of a crisis, is slow, stressful and far less convincing.

What the law leaves untouched

Three things did not change. The HIPAA Security Rule’s own requirements, including the risk analysis, remained in force; recognized practices can reduce penalties but do not replace the rule. Breach notification duties are unaffected, so a well-run program that is breached must still notify patients, HHS and, where required, the media. And the law offers no protection from state attorneys general, class actions or contract claims, which often carry more financial weight than federal penalties.

One control does change the notification duty, and it predates this law. HIPAA’s breach rules apply to unsecured health information. Data encrypted in line with HHS guidance, with the keys kept safe, falls outside that definition, so losing an encrypted laptop need not trigger patient notice. Evidence that encryption was in place on a given device on a given day is therefore valuable in its own right. Asset and encryption reports belong in the monthly evidence for that reason.

Where notice is required, the clock is fixed and short. Affected individuals must be told without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people go to HHS at the same time, and to prominent media where more than 500 residents of a state are involved. The evidence store helps here too, because the breach risk assessment draws on the same records of what was in place.

Anyone who reads the law as a shield should dwell on that last point. A federal penalty is only one of the costs of a breach. Lawsuits from patients, actions by state officials and disputes with business partners can each outweigh it. The law softens one blow; it does not stop the others.

State law and other regimes

State law adds its own incentives. Some states reward recognized frameworks directly. Ohio’s Data Protection Act of 2018, for example, offers an affirmative defense in certain data breach tort claims to organizations whose security program reasonably conforms to an industry framework. Such statutes differ in scope and conditions, and none uses the federal 12-month test. A health system operating in several states faces a patchwork that counsel should map.

Other obligations run alongside HIPAA. Health systems that accept card payments are bound by the payment card industry standard through their contracts. Health care companies with listed securities have disclosure duties. Research institutions may handle data under federal grants or contracts with their own security terms. Recognized practices under HITECH satisfy none of these automatically, though the same evidence often helps with each.

Public hospitals add a further wrinkle. A county or state-owned hospital is a HIPAA covered entity like any other, but it may also be subject to state public records laws and state security standards for government bodies. Security evidence kept for HIPAA purposes may be requested under those laws, subject to their exemptions for security information. Counsel will usually want a say in how such evidence is labeled and stored.

The law applies to business associates too. Health systems can reasonably ask key vendors the question regulators will ask: can you show your security practices operated over the past year? The answer belongs in due diligence and renewal reviews as well as in the questionnaire signed at onboarding. How to write that requirement into a business associate agreement is a question for the hospital’s lawyers.

Business associates have their own reason to care. Since the 2013 omnibus rule, they have been directly liable for complying with the Security Rule, and OCR can investigate and penalize them on their own account. The 2021 credit applies to them in those investigations exactly as it does to hospitals. A vendor that builds the evidence habit protects itself and makes its customers’ due diligence easier.

This matters because many of the systems that hold patient data, or that keep a hospital running, are operated by someone else: the electronic health record host, the billing company, the medical imaging provider. A vendor that signed a security questionnaire three years ago and has not been asked since is a blind spot. Asking for twelve months of the same evidence the hospital keeps for itself, such as MFA reports and backup restore results, turns a promise into something checkable.

Contract terms can make the request routine. A business associate agreement, or the services agreement beside it, can require the vendor to maintain recognized practices. It can require operating evidence kept for a defined period and produced on request or after an incident. It can also require prompt notice when a key control lapses. Vendors will push back on open-ended audit rights. A defined evidence package, delivered annually and after incidents, is usually easier for both sides to agree.

Where the evidence pays off

A security program can look like a cost center with no visible return until something goes wrong. This law offers one of the clearer ways to connect security spending to outcomes a board understands.

Penalties and investigations. A year of documented practice gives HHS a reason to reduce penalties and to weigh audit outcomes more favorably. That is a direct financial effect, though it is only available to organizations that started early.

Insurance and audit. The same evidence serves other audiences. Around this time, cyber insurers were moving toward asking for proof of specific controls, such as multifactor authentication and tested backups, before renewing coverage. Internal and external auditors ask similar questions. An organization that collects evidence once, to a standard an HHS investigator would accept, can reuse the same artifacts for its insurer, its auditors and its own board.

Insurance renewals made the point sharper over the following years. Applications increasingly asked whether MFA protected remote access, email and privileged accounts, whether endpoint detection was deployed, and whether backups were kept offline and tested. An attestation that later proves false can complicate a claim. Monthly evidence lets the person signing the application check each answer against records rather than memory.

Boards benefit from the same data in summarized form. Monthly artifacts produce trend lines: MFA coverage over time, the time to fix critical weaknesses, the share of restore tests that succeeded. Those trends say more about a program than a maturity score, because they show whether things are getting better and how fast.

Patients and operations. The controls the law rewards are the ones that keep clinical systems running. Tested backups decide whether a hospital can restore its records in days or weeks after ransomware. The stakes there are patient care rather than paperwork.

The restore tests worth recording are demanding ones. Restoring a single file proves little. A useful test brings back a clinical application end to end, with its database, interfaces and user access, and records how long it took against the recovery time the clinical leaders expect. Each test that misses its target is a finding with an owner, and the next month’s evidence shows whether it was fixed.

Staff. Evidence collected automatically by systems is far less burdensome than evidence assembled by hand after the fact.

The case that the credit is too small to matter

A sceptic could reasonably say the law offers little. HHS must consider recognized practices, but it is not required to reduce anything. HIPAA penalties are small next to the cost of recovering from ransomware, class actions or lost revenue. Organizations that already run strong programs gain least from a discount on penalties they were unlikely to face.

Each point is fair, and the law alone would not justify a security budget. The case for the evidence habit rests on reuse. The same monthly artifacts answer insurers, auditors, boards, business partners and any later rule. The HITECH credit is one more beneficiary, and the only one with a statutory clock attached. A program that builds evidence for the credit builds it for everyone else at little extra cost.

A second objection is that evidence programs drift into paperwork, with teams producing reports that look good rather than controls that work. The risk is real. The defense is to choose artifacts produced by the systems doing the work, such as configuration exports and logs, rather than narratives written for the file. Someone independent should sample them and compare them with what is actually running.

The shape of a program that qualifies

Strong programs have a recognizable shape.

• One framework is the spine, with a single map to any others the organization reports against.
• Each practice has a named owner and a defined piece of evidence, collected on a schedule.
• Evidence is produced by the systems doing the work, not written up afterward.
• Evidence is stored for at least six years somewhere it cannot be altered unnoticed.
• Someone checks every quarter that the evidence is complete.
• Key vendors are asked for the same kind of evidence at renewal.

The weak programs are equally recognizable.

• Treating a framework mapping or policy library as proof of practice.
• Relying on an annual assessment for a law that asks about every month of the year.
• Delaying a key control, such as MFA, and assuming the credit will apply once it is live.
• Letting evidence live on individual laptops or in email, where it is hard to find and easy to lose.
• Reading the law as protection from lawsuits or notification duties.

Roles should be explicit. The chief information security officer owns the mapping and the evidence design. Control owners in IT operations own the artifacts. Compliance or internal audit owns the completeness check. The privacy officer, who usually leads breach notification, needs to know where the evidence lives, because an OCR investigation typically follows a breach report.

The ongoing effort is modest once exports are automated: a short monthly task for each owner and a periodic completeness check. The larger investment comes first, in building the mapping, agreeing artifacts with each owner and setting up the store. Mergers reset part of that work, because an acquired hospital’s evidence has to be brought into the same scheme before its months count.

Testing the twelve-month record

1. Which framework is the spine of our security program, and is there one map linking it to everything else we report against?
2. For each recognized practice, who is the owner, and what evidence do they collect, how often?
3. If we were breached tomorrow, could we show twelve months of MFA enforcement, patching times, backup restore tests and access reviews?
4. Where is that evidence stored, how long do we keep it, and could anyone alter it without it showing?
5. Which important controls are less than a year old, and what does that mean for our position if something happens soon?

The most telling of these is the third. If the honest answer is “we would need a few weeks to pull it together,” the evidence is not yet part of daily operations.

The third question can be tested without waiting for a breach. Once a year, compliance can send the security team a mock data request modeled on a real OCR letter, with a short deadline. The team assembles twelve months of evidence for a sample of practices and a sample of sites. Whatever takes longest to find, or cannot be found, goes on the work plan. The exercise costs a few days of effort and shows the board, in a form it can judge, whether the credit would be available tomorrow.

With hindsight

OCR followed the law with a request for information in 2022 and later guidance on how organizations can show recognized security practices during an investigation. That guidance turned the law’s short text into something organizations could plan around, but it did not change the central requirement: practice in place, over time, with evidence.

The 2022 request paired two questions. It asked how organizations were implementing recognized security practices, and how HHS should share a percentage of civil money penalties and settlements with harmed individuals. HITECH had required that sharing mechanism back in 2009. The pairing showed how much of HITECH was still unfinished more than a decade after it passed. OCR has also not published any schedule for how much credit recognized practices earn, so organizations cannot predict a discount.

The frameworks the law named kept moving. HHS published an updated edition of the 405(d) practices in 2023. NIST released version 2.0 of the Cybersecurity Framework in February 2024, adding a sixth function, govern, for oversight and accountability. Organizations with a 2021 mapping had to revise it. Those whose evidence was tied to practices and owners could re-point it to the new structure rather than start again.

The amendment did not, on its own, change the course of health care breaches. Large incidents continued, and the February 2024 attack on Change Healthcare showed how one third party could disrupt claims and payments across the industry. That attack made vivid a point implicit in the law: an organization’s security depends on its vendors as well as its own controls.

UnitedHealth Group later said the data stolen in that attack covered around 190 million people, making it the largest health care breach reported to HHS. The disruption reached providers that had no direct contract with Change Healthcare, through the clearinghouse connections their billing depended on. Vendor evidence requests, which the 2021 law made sensible, were shown to need a wider view of dependencies than a list of direct contracts.

HHS then moved toward firmer expectations. It published voluntary cybersecurity performance goals for the health sector in January 2024. At the end of 2024 it proposed a substantial update to the HIPAA Security Rule that would make safeguards such as multifactor authentication and asset inventories explicit requirements. An asset inventory is a complete, current list of the organization’s systems and devices; it is hard to protect what you do not know you have. That proposal had not been finalized as of this writing, and the regulatory agenda pointed to 2027.

The proposal also went further on vendors. It would require business associates to verify their technical safeguards to covered entities at least once a year, through a written analysis and a certification. It would require a written plan to restore critical systems within 72 hours of a loss. Both would turn practices the 2021 law merely rewarded into obligations with their own evidence trail.

For organizations that took the 2021 amendment seriously, these steps were less of a shock. They were already collecting regular evidence on safeguards such as multifactor authentication, which the proposal would make explicit, and their mapping showed where their gaps were.

The law’s second section had its own sequel. The HHS inspector general’s rule setting civil money penalties for information blocking by health IT developers, exchanges and networks took effect in September 2023, using the investigative authorities the 2021 law had confirmed.

Whichever way the rule goes, investigators, insurers and auditors now ask the same thing: show that the control operated, over time. The evidence habit pays off with every one of those audiences at once. The 2021 amendment rewarded it first. Its real subject was whether an organization could prove what it did before the day it needed to.