5 ms·
2026 HIPAA Security Rule Update
- tptacek 6mo agoAs is the case with SOC2, the "vulnerability scan" requirement here is likely to be meaningless; any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan", so all you have to do is run nmap.
- dgellow 6mo agoIf it is like SOC2 I would expect respected auditors to reject that
- morpheuskafka 6mo agoBut there are no auditors required for HIPAA. Only the government (HHS OCR) itself can enforce the standards.
- dgellow 6mo agoThanks for the clarification, in that case the text is indeed really weak. Does that system work in practice, or are companies just claiming they are HIPAA compliant with close to no actual auditing mechanism?
- tptacek 6mo agoYou get that the technical controls in SOC2 are also extremely weak, right?
- dgellow 6mo agoSure, yes. The way I understand SOC2 relies on the auditors to set the effective standard. So it really depends who audited you
- tptacek 6mo agoSOC2 auditors are accountants. A SOC2 auditor verifies only that you're doing what you say what you're doing.
- dgellow 6mo agoObviously, yes
- akerl_ 6mo agoA SOC auditor who tells you that you can’t use an nmap scan to meet SOC2 obligations is a bad SOC auditor, because they’re attempting to enforce a constraint on you that SOC2 does not. But the far more likely thing is that a medium SOC auditor, upon being told “we do our vulnerability scanning with nmap”, would say “I haven’t heard of nmap. You should use Tenable,” and if you’re letting SOC auditor drive your engineering you’d make a mistake and accidentally think that meant you needed to change your answer for SOC2 and go buy Tenable licenses.
- dgellow 6mo agoThe whole thread drifted way too far from a very mild push back I had regarding the claim « any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan" ». My experience is that no, SOC2 auditors won’t consider literally any automated process of that sort as compliant. Which in no way implies the auditors are forcing you to use a licensed tool or driving your engineering. I will stop that thread here, I don’t think that exchange is productive
- kevin_nisbet 6mo agoAnd the way they verify you are doing what you say you are doing is by asking you to provide evidence, which is usually pretty easy to demonstrate that a policy was followed once or twice, a lot harder for them to pick up consistency issues or exceptions.
- giaour 6mo agoIt's been a few years since I worked in this space, but HIPAA doesn't really work under the same kind of legal framework. Oversimplifying here, but basically HIPAA defines what constitutes personal health information, how such information may be used, and establishes monetary penalties for improper use and unauthorized disclosure. The law doesn't have any certification standard, no more than the prohibition on stealing cars does. Maybe there's some kind of third party certification system to support signing information sharing agreements ("BAAs") with other health information systems. I worked at CMS on first-party stuff so I'm not really familiar with how it works in the private sector.
- tptacek 6mo agoNo? Like, wildly no? This is a big part of why you pay for the most respected auditors.
- dgellow 6mo agoI guess we had different experiences. The ones I interacted with were ok and wouldn’t have accepted a simple nmap here
- tptacek 6mo agoI'm not being snarky when I say that not getting your automated vulnerability scan, whatever it might have been, past your SOC2 auditors is a skills issue. SOC2 audits are not technical and the vulnerability scan control in SOC2 is categorically not meaningful. Cloudflare wrote a whole post about this.
- dgellow 6mo agoFWIW I agree that SOC2 for automated vulnerability scans has a really low bar and isn’t too meaningful. At no point did I defend SOC2 here. The bar I’ve seen is above “just an nmap”, which is pretty bad standard IMHO. You seem to be reading way too much in my comments
- tptacek 6mo agoI brought up nmap. You said you'd expect respected SOC2 auditors to reject it. I don't just think that's not true, I know it not to be true.
- dgellow 6mo agoI know, that’s already established. I already acknowledged we had different experiences. I have no idea what you’re pushing for at that point
- 6mo ago
- john_strinlai 6mo agothey have comment/request for information sessions for HIPAA rule proposals, which your input would be valued.
- tptacek 6mo agoI don't think the rule would be better with more detailed vulnerability scanning requirements! All these things inexorably become races to the bottom.
- sonofhans 6mo agoYes, exactly, the rules are intentionally broad and vague. You can wave paper at most of them and technically succeed. And then when you release accidentally PHI for the first time and your bullshit comes to light, your chickens will come home to roost. Doing a good job on compliance is less about security and more about staying out of jail.
- akerl_ 6mo agoThe ideal flow here is: 1. Do good security and operations. 2. Overlap the minimum subset of your existing good security and operations as evidence for whatever compliance regimes help you get paid. 3. Get paid. Nobody is suggesting that you bullshit the auditors. They’re suggesting not letting the auditors accidentally trick you into letting step 2 get in front of step 1.
- jasonlotito 6mo ago> so all you have to do is run nmap. This is ignorance at best. No one who has ever actually had to do SOC2 compliance legitimately has just run nmap and been done with that.
- john_strinlai 6mo ago>No one who has ever actually had to do SOC2 compliance while i find tptacek's opinions very strong on the subject, you would be extremely mistaken to think those opinions were formed without experience
- jasonlotito 5mo agoYep, see that now. I'll try less next time.
- tptacek 6mo agohttps://blog.cloudflare.com/introducing-flan-scan/ https://blog.cloudflare.com/introducing-flan-scan/
- jasonlotito 5mo agoYou're right. I'm wrong. Cloudflare continues to prove it's a shit service, too.
- tptacek 5mo agoThey're 100% right, substantively, about how they're satisfying their SOC2 control requirement here. I'd be alarmed and skeptical of any security practice that was led by compliance requirements.
- kasey_junk 6mo agoI have direct experience telling a soc2 auditor that the approval control for installing applications on “endpoints” was a message to a slack channel that was assumed approved. To satisfy the audit they looked at an app that was installed on a laptop that was not part of our base image from the previous 6 months and a screenshot of the message where the user “asked” to install it. You can literally get a soc auditor to write up whatever you want as a control and if they don’t explain that and encourage it you should find a new auditor.
- time0ut 6mo agoInteresting. I haven’t fully read through the rule change, but seems like HHS is directly adopting the controls required by HITRUST? I have been out of the industry for a while. Always interesting how the industry shapes regulation and vice versa.
- jpitz 6mo agoI'm not sure how meaningful it is to adopt some of the controls from HITRUST without any of the consequences.
- 201984 6mo agoIs this why every healthcare website has 2FA now? It's so annoying.
- burnte 6mo agoMedical records are the most valuable records to steal. They contain financial info like SSN for card fraud, but also demographic info that makes it crazy valuable.
- iloveoof 6mo agoAlso, credit can be frozen and credit cards can be canceled. But the medical record, once stolen, can’t be frozen or canceled, so it’s always valuable
- mjevans 6mo agoHow kind of them to require 2FA without requiring the governments to issue real 2FA tokens for use in signing / interacting. No doubt this will require some rootkit 'authenticator' app on the consumer's purchased mobile device that they are then not allowed to truly own.
- pphysch 6mo agoTOTP should be totally fine and can be used with very dumb hardware/software.
- btown 6mo agoIt's worth noting that cybersecurity requirements can be a mechanism of control. As a government regime, do you want to build an effective surveillance system where health data on large numbers of suspects can be pulled into a data fusion system at the push of a button, once a judicial framework for rubber-stamping is in place? And do you want to be able to pressure vendors into not supporting certain types of research/analysis and even direct patient care that could be construed/presented as counter to the regime's goals? Both of these are easier when smaller vendors are forced out and larger vendors are the only ones left standing. As such, regulatory capture becomes a mutually beneficial tool to dominant vendors and regulators alike. There are few coincidences when lobbying is involved. Which is not to say that cybersecurity improvements aren't a good thing! But speed and mechanisms of required rollout need to be balanced. And with the numerous signatories of [0] opposing the rule and describing "unreasonable implementation timelines," it's hard to say that this is entirely done in the interest of patients. [0] https://assets.ctfassets.net/opszt4tga0mx/4QrJlGP2EkCiZjgvGxuGV1/490de7a60a8073dfb0c1de66dd5855bc/2025-12-8_Sign-On_Letter_re_HIPAA_Security_Rule.pdf https://assets.ctfassets.net/opszt4tga0mx/4QrJlGP2EkCiZjgvGx... (2025)
- deathanatos 5mo agoYour comment is essentially borderline conspiracy theory that HIPAA is somehow setting up a surveillance state. > As a government regime, do you want to build an effective surveillance system where health data on large numbers of suspects can be pulled into a data fusion system at the push of a button, once a judicial framework for rubber-stamping is in place? Sure, and I'm right there with you that people should protest frameworks for judicial rubber-stamping. But HIPAA is like the only privacy law in America, basically, and having it mandate that medical data is encrypted can be good on its own. While there are standardized formats for medical data, many are so ill-adopted that building some sort of surveillance system would be a monumental task; the bulk of data I've worked with has been in poorly documented, non-standard formats. > Both of these are easier when smaller vendors are forced out and larger vendors are the only ones left standing Clearer regulations and standardized, interoperable data formats benefit smaller players.
- bob1029 6mo agoThe institutional moats grow ever wider. PCI-DSS still takes the cake for most oppressive rules out of all the compliance frameworks. The notion that your system might become "in-scope" is one of the scariest things you have to deal with. Avoiding this designation is almost always easier than satisfying all the controls they prescribe. Stripe & friends have it really good. I don't know who their equivalents are in the health care industry but I am certain they exist.
- kstrauser 6mo agoI despise PCI-DSS. A friend owns a small business and has a credit card reader. Due to that, we had to build out a separate LAN so that the reader is on its own precious network, and have to pay an external auditor for a quarterly scan of our external IP. Bullshit past findings were things like “your VPN server supports old encryption algorithms”. “But our clients don’t support them. They select the newer algorithms!” “But they could!” “What do you care? Those clients aren’t even on the same LAN as the scanner.” “PCI-DSS lol!” I have no way of knowing, but I bet the firewall might’ve accidentally blocked the scanning IP from reaching the VPN server port on the retest and called it a day, but surely not. Basically, Visa and friends externalized their own shitty security and made every other company in the land responsible for wrapping their janky hardware in electronic bubble wrap. A real security framework would’ve said “don’t make a credit card scanner so weak that it can’t survive being on the same LAN as a printer”. Instead, the whole country has to waste billions of dollars mitigating that risk for them.
- akerl_ 6mo ago> Bullshit past findings were things like “your VPN server supports old encryption algorithms”. “But our clients don’t support them. They select the newer algorithms!” Given that downgrade attacks are a massive category of attacks for network protocols, and in fact modern protocols go to great lengths to make them impossible, that doesn’t sound very bullshit at all.
- kstrauser 6mo agoIf a client doesn’t support an algorithm, you can’t force a downgrade to it. A compensating control is that the clients are managed and only support the newest algorithms, and aren’t vulnerable to a downgrade attack. Context is everything. Here, the context is that within this scan environment, it was, in fact, a bullshit finding.
- bonsai_spool 6mo agoIt's so grating to read obviously LLM-generated text, even more so from a company that is asking us to hire them for a security audit. AI writing makes somewhat more sense on tech blogs. Where a business' value proposition is "We are knowledgeable and reliable about computer security", it seems unwise.
- usernamed7 6mo agoI was thinking the same - makes the article feel very amateur and unprofessional. And I know for a fact that AI can do a better job at writing than this, I doubt they read it and had any sense of how poor the writing actually is.
- dwa3592 6mo agoIt really depends on who is testing and enforcing these standards. I have worked in this area, built scalable systems for medicare. The annual pen testing used to be a joke. Any consultant who would come had no clue what was being built, how the process worked - and they wouldn't even care to understand. After a meeting, we'd get the notification that the pen testing was successful. So, on paper you can change any rule - if the consultants you are hiring don't give a shit (which they usually don't)- nothing gets enforced. We would go out of our 'job responsibilities' to do internal testing of all sorts (the external agency would not even do 2% of that).
- marsbars241 6mo agoWait a second. If encryption is required for all ephi, that means faxes will finally die, right? Right??? Please!
- theptip 6mo agoMy thought too. This would be huge if true.
- saltcured 6mo agoNah, in legal compliance minds, faxes are magical, remote, wet ink.
- supermdguy 6mo agoI think the conduit exception still applies for analog faxes. Which makes no sense, since tapping a fax line is probably way easier than compromising a data center.
- mooreds 6mo agoHere's the full proposed rule: https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information https://www.federalregister.gov/documents/2025/01/06/2024-30...
- mapt 6mo agoI don't understand why there shouldn't be a strict-liability play here on top of penalties for knowing violations. You lose all your customer's data to a darknet leak? We should be taking a huge chunk out of your balance sheet. My insurer has disclosed names, social security numbers, and ENTIRE MEDICAL CASEFILES for their entire client base more than once at this point in overlapping data breaches. Why exactly don't they owe me $10k for my trouble, or N% shares of the company? If that's too much, why do these penalties exist for knowing disclosure, if incompetence is so tolerated that knowing disclosure does no damage?
- erikerikson 6mo agoPenalties are $100-$50,000 per violation (i.e. per leak for each person), up to $1.5 million per year[0]. If in the US (I'm assuming given you mention your health insurance) you can report it to your state insurance commissioner which may have already occurred for your incidents. [0] https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement https://www.ama-assn.org/practice-management/hipaa/hipaa-vio...
- panny 6mo agoThere's also possible prison sentences. I just love it when someone wants to "get tough on X" when all the laws are already tough on X and just unenforced. That's how you end up with every American committing three felonies a day without knowing it.
- erikerikson 6mo agoI'll bite: examples?
- iamalizard 6mo ago[dead]
- Bender 6mo agoIt's from a topic in a book [1] that is sometimes also discussed on forums. The gist of it is something to the effect of, there are so many laws and so much wiggle room in most of the laws that each person is committing multiple felonies per day without knowing it thus empowering agencies to arrest just about anyone at any given time. The United States of America has the highest incarceration rate of the world is just one small example of that. [1] - https://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp/1594032556 https://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp...
- caycep 6mo agoeh how are they going to make the usual small practice do "penetration testing"?
- ck2 6mo agoyou can be certain the DOGE kids downloaded as much as they could grab from federal systems about everyone's medical history including the federal e-prescription system rules for thee but not for me
- saltcured 6mo agoOf course they have to double down on yet another compliance regime. Why not converge on an existng NIST 800-53 baseline, or some HHS "tailored" variant? Or CMMC, if they want to push for more strict certification processes instead? It's getting absurd with how many different compliance regimes a modern research university will have to follow simultaneously, if they do a broad set of defense, energy, basic sciences, and health research as well as having an attached medical school and teaching hospital.
- Cider9986 6mo agoAs explained here[1], HIPPA makes our medical privacy worse, not better. [1] https://www.youtube.com/watch?v=4sfIBRTcRpU https://www.youtube.com/watch?v=4sfIBRTcRpU https://odysee.com/@NaomiBrockwell:4/HIPAA:7 https://odysee.com/@NaomiBrockwell:4/HIPAA:7
- burnte 6mo agoI've got this saved and I'll watch it and reply soon, but my kneejerk reaction is "this is someone who probably doesn't actually understand what they're talking about" simply because as someone who is in healthcare IT, I can assure you privacy is taken extremely seriously and I can guarantee medical privacy today is far better than it ever was before.
- hoppyhoppy2 6mo agoI rarely give credence to opinions about HIPAA from people who don't spell it correctly.
- Cider9986 6mo agoLet me know your analysis.
- MallocVoidstar 6mo ago"As explained by" someone regurgitating the views of the "Citizens’ Council for Health Freedom", an anti-vax, right-wing organization that opposes HIPAA, Medicare, and government involvement in healthcare in general.
- Jeremy1026 6mo agoMandatory annual security assessments are going to be brutal for small businesses.
- iloveoof 6mo agoUniversal encryption of PHI at rest is going to be INCREDIBLY painful. Hospitals mostly have onprem, locked down mainframe IRIS systems that host data. If the IRIS data is encrypted at rest then it can’t be compressed which means hospitals will have to buy a bunch more hardware which is super expensive, especially these days. This doesn’t get you much in terms of security. The IRIS system itself is an OLTP so it’s going to need to constantly pass around the encryption key and use it constantly, and if an attacker gets disk access they also will have access to the keys. So this is a big waste of everyone’s time and money.
- CodesInChaos 6mo agoShouldn't full disk encryption be enough to satisfy that requirement?
- joncp 6mo agoI'm not sure why there's so much negativity in this thread. The listed requirements were already basic table-stakes security standards. IMO, anyone not encrypting all user data at rest, requiring MFA, etc. is bush league.
- mchusma 6mo agohighly irritating. HIPAA was originally designed to be a "portability" standard (meaning easier to share). It has done the opposite. Health data is important to developing a cure, and privacy is unimportant to many people. The world would be better if there we were zero regulation here at all.
- threecheese 6mo agoThis was a pleasant surprise; I fully expected a gutting of the rules, based on what’s been on the front page these past few months. I’m glad to see that someone in the federal govt is paying attention to the risk landscape.
- throw03172019 6mo agoI thought these haven’t been approved/finalized yet?