At a glance
- HIPAA Security Rule obligations remain law; the 2024–2025 cybersecurity update remains a proposed rule unless and until HHS publishes a final rule.
- HHS Healthcare and Public Health Cybersecurity Performance Goals and HICP 2023 are voluntary guidance, not certifications.
- HITRUST CSF v11.8 is a licensed assessment framework with distinct e1, i1, and r2 assurance paths.
- CMS EDE Year 9 is a program-native operational-readiness and third-party audit lane for PY 2026–2027, not another name for HIPAA or HITRUST.
Start by separating authority
Healthcare teams often say they need HIPAA, HITRUST, HHS guidance, and CMS evidence in the same breath. The operational work overlaps, but the authorities and outcomes differ. HIPAA is federal law and regulation. HHS sector guidance provides voluntary practices and priorities. HITRUST provides a licensed framework and assurance program. CMS EDE adds program-specific operational-readiness and audit requirements.
A platform should represent those distinctions directly. Each obligation or practice needs an issuing authority, edition, applicability basis, expected evidence, reviewer, and attainable outcome. That prevents a strong security artifact from being marketed as a legal opinion, certification, or CMS approval.
HIPAA is current law plus a monitored proposal
HHS states that the current HIPAA Security Rule is located in 45 CFR Part 160 and Part 164, Subparts A and C. HHS also published a proposed rule in late 2024 to strengthen cybersecurity protections for electronic protected health information. As of the current HHS Security Rule page review, that update remains listed as a proposed rule.
The correct operating model keeps the enforceable rule and the proposed change in separate lanes. Teams can prepare an impact assessment and evidence plan for the proposal without presenting proposed requirements as current law.
HHS guidance turns patient safety into operating priorities
The HHS Healthcare and Public Health Cybersecurity Performance Goals identify essential and enhanced voluntary goals informed by CISA goals, HICP, NIST CSF, and sector guidance. HICP 2023 organizes major healthcare threats and ten mitigating-practice areas for organizations of different sizes.
Those sources are valuable because they turn broad risk into concrete operating practices: identity and access, email, endpoints, data protection, assets, networks, vulnerabilities, incidents, connected medical devices, and governance. Evidence from those practices can also support HIPAA safeguards, NIST outcomes, HITRUST requirements, and customer assurance—but each mapping remains a reviewed proposition.
HITRUST and CMS add different proof decisions
HITRUST released CSF v11.8 in May 2026 with continued requirement consolidation and refreshed authoritative-source mappings, including PCI DSS v4.0.1 and AICPA SOC 2 Trust Services Criteria. Use of the detailed CSF is license-bound, and HITRUST certification follows its own assessment and quality-assurance process.
CMS EDE Year 9 guidance applies to plan years 2026 and 2027 and requires program-native evidence across operational, application, API, privacy, security, and third-party audit work. One access-control or incident-response artifact may be reusable across this stack; the HITRUST assessor, HIPAA accountable organization, CMS auditor, and other reviewer still make different decisions.
Put it into practice
- Label every healthcare requirement as law, proposed rule, voluntary guidance, licensed framework, or program-specific obligation.
- Pin the authority, edition, effective status, applicability, expected evidence, and decision owner.
- Collect operational evidence once with source, scope, owner, method, period, checksum, and sensitivity attached.
- Create separate candidate mappings and review decisions for HIPAA, HHS CPGs, HICP, HITRUST, CMS, and adjacent frameworks.
- Never convert evidence overlap into a claim of HIPAA certification, HITRUST certification, CMS approval, or auditor acceptance.
For the executive team
Healthcare assurance is one operating evidence system serving several different authorities.
The economic advantage comes from maintaining the artifact once and preserving the context each reviewer needs, not from collapsing distinct standards into one badge.
That is how a healthcare organization reduces duplicate requests while improving—not weakening—assurance discipline.