Amid the letters of congratulations to new HHS Office for Civil Rights (OCR) Director Lisa Pino is a plea from the American Hospital Association (AHA): “victims” of escalating health care attacks need OCR to quickly identify security practices as required under a law enacted in January.

“Absent the implementation of this law, there may be continued reluctance by health care victims of cyber attacks to cooperate with law enforcement, due to a fear of regulatory repercussions,” AHA Executive Vice President Stacey Hughes recently wrote to Pino.^[1]

In the waning days of the 2020 session, Congress passed a law giving OCR the ability to lessen penalties for security rule violations if the covered entity (CE) or business associate (BA) could prove that, in the prior year, it had “recognized security practices in place.”^[2] Although the law does not require it, OCR officials signaled this spring they would be engaging in rulemaking to implement the law.^[3]

Nearly a year after H.R. 7898 was signed into law by then-President Trump, there’s no sign of any related rules, and, based on how OCR is planning to move forward, it will be some time before a rule emerges. However, in response to questions from RPP, an agency spokesperson said the law “was effective upon enactment” and that the agency “has implemented the requirements of H.R. 7898 into the HIPAA Enforcement Program.”