Credit for security practice, payable only in arrears

The week

On January 5, 2021, the president signed H.R. 7898, a brief amendment to the HITECH Act. HHS must now consider whether an organization had recognized security practices in place for the previous 12 months. That applies when it investigates a covered entity or business associate, sets a civil money penalty or decides audit outcomes.

The law defines recognized security practices by reference to the NIST Cybersecurity Framework and the practices developed under section 405(d) of the Cybersecurity Act of 2015, which HHS publishes as the Health Industry Cybersecurity Practices. Other approaches recognized by statute or regulation also count. Adoption is voluntary. The law creates no new penalty for organizations that do not adopt these practices, and it does not change breach notification duties. It passed in a week dominated by other news and drew modest attention.

H.R. 7898 reads like a small kindness to hospitals: do the right things and regulators will go easier after a breach. That reading is accurate but incomplete. The operative words are “in place” and “12 months.” A plan, a policy set or a framework mapping does not satisfy the law on its own. It rewards a year of demonstrated practice before the incident. That moves the burden from intent to evidence, and it sets a timing rule no budget can reverse after the fact. The implications fall into three parts: what qualifies, what must be proven, and what the law leaves untouched.

What qualifies

The law points to frameworks, not specific controls. The NIST Cybersecurity Framework is a structure of functions and outcomes. The 405(d) practices are more concrete and come in versions for small, medium and large organizations, which makes them a natural fit for clinics and community hospitals.

Neither is a pass-fail checklist. Each requires an organization to decide which practices apply, at what depth, and who owns them. That flexibility lets a rural hospital and an academic medical center both qualify. It also allows an organization to claim alignment with a framework without being able to show which practices it actually runs.

The practical choice is to pick one framework as the organizing spine and map existing controls to it, with gaps stated plainly. Health systems often use the 405(d) practices for clinical and operational detail and the NIST framework for board reporting. That works if one mapping links the two. Running separate frameworks for different parts of the estate, without a single map, makes evidence much harder to assemble when an investigator asks.

What must be proven

The 12-month look-back is the core of the law, and it is where most programs were weakest in 2021. Many health organizations could produce a risk analysis, a policy library and an annual penetration test report. Far fewer could show, month by month, that multifactor authentication was enforced and patches were applied within stated timeframes. Fewer still could show that backups were restored in tests and access reviews were completed.

That kind of evidence does not come from an annual assessment. It comes from systems that record control operation as a matter of course.

• Identity platforms log where multifactor authentication is enforced and which exceptions exist, with dates.
• Vulnerability tools record time from disclosure to remediation, by system class.
• Backup tools record restore tests and their results.
• Ticketing systems capture access reviews, approvals and removals of access for departing staff.

Turning those outputs into evidence needs three decisions. Each practice needs a named owner. Each owner needs a defined evidence artifact, such as a monthly export or a dashboard snapshot, collected on a schedule. The artifacts need to be kept somewhere tamper-evident for at least as long as an investigation might reach back. HIPAA already expects security documentation to be retained for six years, so the storage policy largely exists.

Timing is the hard constraint. Because the look-back covers the year before an incident, the benefit cannot be bought after a breach. Investment in the months after an incident helps the next investigation, not the current one. For boards weighing security budgets, that is the most concrete argument the law offers. A control’s value in an investigation depends on how long it ran before something went wrong.

Gaps in evidence carry their own risk. If an organization cannot show that a control operated, it should assume an investigator will treat it as absent. Evidence collection is therefore a control in its own right, and it deserves testing like any other. A quarterly check that each owner’s artifacts exist and are complete costs little.

What the law leaves untouched

Three things did not change. The HIPAA Security Rule’s own requirements, including the risk analysis, remained in force; recognized practices can reduce penalties but do not replace the rule. Breach notification duties are unaffected, so a well-run program that is breached must still notify patients, HHS and, where required, the media. And the law offers no protection from state attorneys general, class actions or contract claims, which often carry more financial weight than federal penalties.

The law applies to business associates too. Health systems can reasonably ask key vendors the question regulators will ask: can you show your security practices operated over the past year? The answer belongs in due diligence and renewal reviews, not only in a questionnaire signed at onboarding. Organizations should check with counsel on how to frame that in agreements.

The same evidence serves other audiences. Around this time, cyber insurers were moving toward asking for proof of specific controls, such as multifactor authentication and tested backups, before renewing coverage. Internal and external auditors ask similar questions. An organization that collects evidence once, to a standard an HHS investigator would accept, can reuse the same artifacts for its insurer, its auditors and its own board.

With hindsight

OCR followed the law with a request for information in 2022 and later guidance on how organizations can show recognized security practices during an investigation. The amendment did not, on its own, change the course of health care breaches. Large incidents continued, and the February 2024 attack on Change Healthcare showed how one third party could disrupt claims and payments across the industry.

HHS then moved toward firmer expectations. It published voluntary cybersecurity performance goals for the health sector in January 2024. At the end of 2024 it proposed a substantial update to the HIPAA Security Rule that would make safeguards such as multifactor authentication and asset inventories explicit requirements. That proposal had not been finalized as of this writing, and the regulatory agenda pointed to 2027. Whichever way the rule goes, investigators, insurers and auditors now ask the same thing: show that the control operated, over time.