NIST Publishes Final “Cybersecurity Resource Guide” on Implementing the HIPAA Security Rule

Jennifer Hennessy and Christopher Taylor of Foley & Lardner write:

In an important development for HIPAA-regulated entities looking for practical assistance in understanding, implementing, and enhancing compliance with the HIPAA Security Rule, the National Institute of Standards and Technology (NIST) has finalized its comprehensive guidance, Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (Resource Guide). This release follows the initial draft that NIST published for public comment in July 2022 and builds on NIST’s foundational 2008 publication. The updated Resource Guide comes at the heels of the U.S. Department of Health and Human Services (HHS) releasing voluntary performance goals to enhance cybersecurity across the health sector last month and a Department-wide Cybersecurity strategy for the health care sector in December of 2023.