Compliance News Week Ending January 3, 2025

In this Article

Proposed HIPAA Security Rule

ACA Employer Reporting Changes Signed Into Law

Proposed HIPAA Security Rule

On December 27, 2024, the Department of Health and Human Services (HHS) released proposed rules to modify the Security Rule under HIPAA. Due to the rise in large-scale cybersecurity incidents, these proposed rules would raise the bar for cybersecurity protocols around electronic protected health information (ePHI) for HIPAA-regulated entities, including group health plans.

The proposed rule is scheduled to be formally published on January 6, 2025, after which HHS will be accepting comments on the proposal for 60 days. If and when a final rule is published by the Trump administration, the changes would not be effective for at least 180 days. While the potential finalization and implementation of these proposed rules is likely at least a year away, covered entities have been and are continuously encouraged by HHS to strengthen cybersecurity protections around ePHI.

ACA Employer Reporting Changes Signed Into Law

On December 23, 2024, H.R. 3801 and H.R. 3797 were officially signed into law by the President. Amongst other things, the legislation allows employers to meet Form 1095 distribution requirements by posting a notice of availability and then only distributing upon request.

In addition, for employers required to report self-funded group health plan coverage information for spouses and dependents, there is more flexibility to use the individual’s date of birth when the tax identification number (TIN) is not available.

None of the changes significantly alter existing employer reporting requirements, but the changes will provide employers with a little relief. The changes are effective for the current 2024 reporting year (for returns due early in 2025).

^{While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.}