Cybersecurity and Compliance for Healthcare
HIPAA, HITRUST, CMS EDE and AI Governance for Clinical Environments
Risk analysis is the single most cited deficiency in OCR enforcement, and every action brought under the Risk Analysis Initiative since October 2024 includes a finding under that provision. That is where a healthcare compliance programme should start, ahead of the proposed Security Rule overhaul that remains a proposal with a target date now in 2027. Elevate Consult builds against the rule in force, prepares for the one that is coming, and supports the HITRUST, CMS and AI governance obligations that sit alongside it.
UPDATE
What changed and what has not
The Security Rule overhaul is still proposed
HHS published the Notice of Proposed Rulemaking on 6 January 2025 and the comment period closed on 7 March 2025. No final rule has been issued, the target for final action moved to July 2027, and a coalition of more than a hundred hospital and provider associations petitioned HHS to withdraw it. The current Security Rule remains what OCR enforces.
HITRUST added AI assurance
AI security and AI risk management products are now part of the HITRUST portfolio, combined with an underlying e1, i1 or r2 certification rather than assessed standalone. New e1, i1 and rapid assessments moved to CSF v11.8.0 on 7 May 2026, and versions retire on a published schedule.
CMS EDE runs on a fixed annual window
The audit submission window for primary EDE entities and for phase changes runs from 1 April to 1 July, and CMS releases toolkit baselines in the first quarter. Development has to be complete before the window opens, and a missed submission costs a full cycle.
Risk analysis is what is actually enforced
Failures under 45 CFR 164.308(a)(1)(ii)(A) appear in essentially every major enforcement action. An organization with one thing to fix should fix the risk analysis, assessed against the nine essential elements in OCR's guidance and aligned to NIST SP 800-30, with implementation guidance from NIST SP 800-66 Revision 2.
AI reached clinical and administrative workflows faster than governance did
Ambient documentation, imaging support, triage, scheduling and revenue cycle tools all process patient information. ISO 42001 and the NIST AI RMF are the frameworks enterprise health systems are starting to ask vendors about.
WHO WE HELP
Providers, payers, and the technology that serves them
Health systems and provider organizations, health plans and payers, digital health and health technology vendors, business associates and service organizations, and web-brokers and issuers operating under the CMS Direct Enrollment pathways.
Technological change has been faster than the compliance function absorbing it: electronic health records, networked medical devices, complex data transfers between organizations, and now AI embedded in clinical and administrative workflows. Data security and privacy are where that innovation meets its constraint
WHERE THE OBLIGATIONS COME FROM
Four distinct sources
Healthcare compliance is rarely one framework. It is a statutory obligation, a buyer requirement, a programme requirement and increasingly an AI governance question, each with a different owner internally.
Security Rule safeguards, Privacy Rule use and disclosure, and Breach Notification. The risk analysis under 164.308(a)(1)(ii)(A) is the most cited deficiency in enforcement by a wide margin.
HIPAA and HITECH
Health systems and payers frequently specify e1, i1 or r2 in vendor requirements. The threshold is applied per assessment domain, so a single weak domain produces a validated report rather than a certification.
HITRUST
Primary entities undergo business requirements and privacy and security audits inside a fixed annual window. Entity type determines the audit burden and it is the first thing to establish.
CMS EDE
SOC 1 where the organization affects client financial reporting, SOC 2 where the enterprise customer asks for security, availability, processing integrity, confidentiality or privacy assurance.
SOC 1 and SOC 2
ISO 42001 certification and NIST AI RMF alignment for organizations deploying AI in clinical or administrative workflows, increasingly requested in health system vendor reviews.
AI governance
CCPA and the state patchwork where consumer data is processed outside the HIPAA-covered set, and GDPR where the organization reaches EU individuals.
Consumer privacy
HOW ELEVATE HELPS | SERVICES FOR HEALTHCARE ORGANIZATIONS
Enforcement exposure first
Elevate sequences the work by what is actually enforced rather than by what is most discussed, which in healthcare means the risk analysis before anything else.
HIPAA risk analysis and gap assessment
Risk analysis against the nine essential elements using OCR’s own audit protocols, plus Security, Breach Notification and Privacy Rule gap analysis, aligned to NIST SP 800-30 and 800-66 Revision 2.
HITRUST readiness and certification support
Assessment type selection against the actual customer requirement, CSF version and retirement date management, domain-level score tracking, and validated assessment support through quality assurance.
CMS EDE audit readiness
Entity type determination, architecture readiness review, and preparation for the privacy and security portion of the third-party audit, without holding system access.
SOC 1 and SOC 2
Readiness, control design, evidence structure and audit support for the report the customer specified.
AI governance
ISO 42001 certification readiness and NIST AI RMF programme build for organizations deploying AI in clinical documentation, imaging, triage, scheduling or revenue cycle.
Penetration testing
Network, application, wireless and physical testing. Healthcare facilities carry structural physical exposure that a corporate office does not, because clinical staff are focused on patients and visitors are expected.
Privacy programme
CCPA, the state patchwork and GDPR where consumer or international data sits outside the HIPAA-covered set.
Virtual CISO
Security leadership for organizations without a dedicated function, which describes most provider organizations below health system scale.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
Privacy and compliance officers
CISOs in healthcare
Health plan and payer operations
Digital health and health tech vendors
Business associates
GET STARTED
Ready to fix what OCR actually enforces?
Elevate Consult conducts the risk analysis against the nine essential elements, runs the Rule gap analysis using OCR’s own protocols, and supports the HITRUST, CMS and AI governance obligations your buyers and programmes require.
FAQ
Common Questions
🡪 Is the new HIPAA Security Rule in effect?
No. The Notice of Proposed Rulemaking was published on 6 January 2025 and the comment period closed on 7 March 2025, but no final rule has been issued and the target for final action moved to July 2027. The current Security Rule remains in force. Compliance material describing mandatory multi-factor authentication and encryption as present Security Rule obligations is describing a proposal.
🡪 What does OCR actually enforce?
The risk analysis requirement more than anything else. Failures under 45 CFR 164.308(a)(1)(ii)(A) appear in essentially every major enforcement action, and every action under the Risk Analysis Initiative since October 2024 includes a finding under that provision. A vulnerability scan is not a risk analysis and a policy stating that risks are assessed is not one either.
🡪 Which HITRUST assessment do we need?
Whichever the customer specified. Health systems and payers frequently name e1, i1 or r2 in vendor requirements, and they are separate products rather than steps. Delivering an e1 where an i1 was specified satisfies nobody. Note that the scoring threshold applies per assessment domain, so a single weak domain produces a validated report rather than a certification.
🡪 Do AI tools in clinical workflows need governance?
Increasingly yes, driven by buyers before regulators. Ambient documentation, imaging support, triage and revenue cycle tools process patient information and produce outputs clinicians rely on. ISO 42001 is the only accredited certification for an AI management system, and HITRUST now offers AI assurance combined with an underlying certification.
🡪 What is required for CMS EDE?
It depends on entity type. Primary EDE entities undergo both a business requirements audit and a privacy and security audit within the annual submission window from 1 April to 1 July. Hybrid non-issuer upstream entities need a privacy and security audit covering the functionality they add. White-label issuers making only minor branding changes are not audited but still file documentation and hold a Partner ID.
🡪 Should we prepare for the proposed Security Rule now?
Selectively. If finalized, compliance would be required roughly 240 days after publication, which is not enough time to build an asset inventory, network map and segmentation programme from nothing. Those have long lead times and they improve the current risk analysis regardless of whether the rule finalizes. Buying tooling against a proposal that may be withdrawn is a different decision.