Health201 portal

From ClingantryAI Health Regulator News

healthcare ai & robotics — regulation, enforcement & breaches worldwide, sourced only from primary government record

Tagged “nprm” · 2 entries

Published 2025-01-06added 2026-07-03 Proposed NPRM — not final

No, HIPAA does not yet require encryption everywhere — that's still just a proposal

You may have heard that HIPAA now requires encrypting all patient data. It doesn't — not yet. Federal regulators proposed making encryption mandatory (it's currently just "recommended"), but that proposal has not been finalized into law as of this writing. There's no deadline to comply with yet. Once it is finalized, organizations would get 60 days before it takes effect and 240 days after that to actually comply — so there will be advance warning. Worth watching, not worth panicking about yet.

Sources differ:
  • This bulletin describes the proposed compliance clock as 60 days to take effect plus a further 240 days to comply; several compliance-industry summaries of the same NPRM describe it as 60 days to take effect plus 180 more days to comply (240 days total from publication). The cited Federal Register excerpt provided does not include the specific compliance-timeline section, so this could not be chec
#hipaa#federal#encryption#nprm
Primary source: Federal Register, 90 FR 800 · Checked against the record 2026-09-28
Published 2024-01-09added 2026-07-11 In force In force — repeal proposed

Right now you can demand an 'AI model card' from your EHR vendor — but that right may be going away

Two things every hospital should know about the AI built into their EHR. First: under a federal rule (HTI-1) that became fully enforceable this past February, your certified EHR vendor must disclose how its predictive AI tools work — what data trained them, who they're meant for, known risks, and how they were validated. That's 31 required disclosure items, often called an "AI model card." You can ask your vendor for this today, and they're required to have it. Second: the same federal office has proposed repealing exactly that requirement (the HTI-5 proposal, December 2025), arguing there's no evidence the disclosures improved care. Public comments closed February 27, 2026; no final decision has been published yet. Practical advice: if these model cards are useful to your AI purchasing decisions, request them from your vendors now, while the requirement is still in force.

Sources differ:
  • The cited HTI-1 rule text confirms the overall final rule took effect February 8, 2024; ONC's own Decision Support Interventions fact sheet states the specific predictive-model source-attribute ('AI model card') and risk-management requirements were not required to be met until January 1, 2025. Government source
#federal#onc#ehr#decision-support#transparency#nprm
Primary source: HTI-1 final rule (89 FR 1192) — federalregister.gov / HTI-5 proposed rule — healthit.gov · Checked against the record 2026-09-27
← Back to AI Health Regulator News