On March 7, 2025, APA’s CEO Arthur C. Evans Jr., PhD, sent a letter on behalf of APA Services (PDF, 335KB)opens in new window to the Office of Civil Rights for the U.S. Department of Health and Human Services (HHS) in response to HHS’s proposed changes to the HIPAA Security Rule.
This proposed rule seeks to significantly increase the security requirements that health care providers (and other covered entities) must follow for any and all technological tools used in creating, sending, storing, and receiving patient’s electronic protected health information (ePHI). In the letter, APA Services highlighted concerns about how these substantial administrative and technical requirements would be unduly burdensome for psychologists in solo and small practices. Many of the proposals would necessitate specific IT expertise or dedicated staff.
These proposals also would require providers to create a detailed inventory of technology assets, conduct risk analyses at least annually, regularly review audit trails, event logs, and security incident tracking reports, as well as perform vulnerability scans and penetration tests at regular intervals. APA Services raised concerns that many psychologists do not have the staff, financial resources, or technical knowledge to meet these requirements. Having to divert substantial time and resources to enhanced cybersecurity measures can impact the psychologist’s ability to focus on treating patients.
While APA Services acknowledges the need for more robust protections in light of the increasing use of technology in health care and the growing number of data breaches such as the cyberattack on Change Healthcare, it urges HHS to take a more measured, scalable approach. While larger organizations face a larger risk given the size of their systems and the volume of ePHI that they handle, small practices present a much lower risk.
In its letter, APA Services makes several recommendations to shift some of the onus from solo and small practices. It asks HHS to consider exempting solo and small practices from the proposed requirements or in the alternative, instituting delayed implementation. Other recommendations include maintaining flexibility for many requirements so that psychologists can determine which security measures are most appropriate and feasible to implement, providing financial funding to those providers who weren’t eligible for federal health IT funding under HITECH, and developing specific guidance and resources to help smaller practices with compliance.
APA Services would also like to thank the nearly 4,000 psychologists who submitted individual feedback to HHS.
Because these are proposed rules, none of the proposals go into effect until HHS issues its final rule. As part of the rulemaking process, HHS officials will review the public comments and decide whether to amend any of the proposals.
