HIPAA enforcement has stepped up a lot over the past two years. The Office for Civil Rights (OCR) is issuing bigger penalties and widening investigations that start from breach notifications. If your organization handles protected health information (PHI), here's what you need to know going into 2025.
Key changes to watch
The biggest recent development is the proposed update to the HIPAA Security Rule, the first major revision since 2005. The proposal would require more specific technical safeguards, including mandatory MFA, network segmentation and encryption standards that match current technology.
What still catches organizations off guard
- Business Associate Agreements (BAAs): Many organizations still have outdated or missing BAAs with vendors that access PHI. Any software vendor, IT company or cloud provider that touches PHI needs a current BAA.
- Risk analysis: OCR's most common finding in investigations is a weak or missing Security Risk Analysis. It needs to be a documented, formal process, not a checkbox.
- Access controls: Shared logins, accounts with too much access and no clear offboarding process are still common problems.
- Encryption: Unencrypted laptops and phones that hold PHI are still a major liability.
What to do right now
If you haven't done a formal Security Risk Analysis in the past 12 months, schedule one. Review your BAA list and make sure every vendor with PHI access is covered. Turn on MFA for your EHR and email systems. Write down your policies and train staff every year.
Sentiva offers HIPAA compliance assessments for healthcare organizations. Contact us to get started.