Providers Warn New HIPAA Cybersecurity Rule Would Create “Crushing” Burdens, Urge HHS to Start Over

A broad coalition representing hospitals, long-term care providers and health IT leaders is urging federal officials to withdraw a proposed overhaul of the HIPAA Security Rule, warning that the changes would impose costly requirements and rigid technical mandates that many organizations cannot meet.

More than 100 provider associations, health systems and senior care organizations signed a Dec. 8 letter asking the US Department of Health and Human Services to pull back the proposal and work with the industry to create a more practical, risk-based cybersecurity framework.

Coalition Warns of Unfunded Mandates

Among the signers were the American Health Care Association / National Center for Assisted Living, LeadingAge, the Long Term and Post Acute Care Health IT Collaborative, Presbyterian Living and RiverSpring Living.

The groups said they support strong cybersecurity protections but argued that the proposed rule would create substantial unfunded mandates, significantly expand documentation and reporting requirements, and force extensive infrastructure redesigns. According to the coalition, many of the provisions do not reflect how modern IT environments function and would divert resources away from clinical care.

The letter also argued that the rule’s structure conflicts with longstanding efforts to reduce regulatory burden across healthcare, adding that the proposal should be reworked to avoid unnecessary complexity.

Concerns Over Rigid, One-Size-Fits-All Standards

Industry sources echoed those concerns. The College of Healthcare Information Management Executives said the proposal relies on “rigid, one-size-fits-all requirements” that could undermine providers’ ability to manage evolving cybersecurity threats in real-world clinical settings.

“Our members are not asking for less security — they are asking for smarter policy,” CHIME President and CEO Russell Branzell said in a statement. He warned that the draft rule adds cost and complexity “without meaningfully improving cybersecurity.”

Call for Collaboration and Flexibility

The coalition urged HHS to withdraw the proposal and begin a collaborative outreach effort with providers to shape a more flexible and scalable framework. They said any updated cybersecurity standards must accommodate the varied structures, capabilities and resources of healthcare organizations.

“We support updating cybersecurity standards for healthcare, and they must be flexible enough to accommodate the wide range of provider organizations,” the letter stated. “Standards should set strong protections while allowing innovation so providers can respond effectively to evolving cybersecurity risks.”

Senior Care Providers Cite Added Strain

Long-term and post-acute care groups have raised concerns about the rule throughout the year. In earlier comments to HHS, AHCA/NCAL noted that many providers — especially smaller, rural or financially constrained organizations — already struggle with significant workforce shortages and limited capital. Additional security mandates, the group said, could unintentionally discourage digital transformation and interoperability efforts.

LeadingAge submitted a separate comment letter urging “significant changes” to the proposal. The organization recommended clearer definitions to prevent non-healthcare entities, such as senior housing, from being unnecessarily covered, while also calling for greater flexibility, improved vendor accountability, federal funding to support cybersecurity upgrades and expanded public–private partnerships.