December 8, 2025 

Dear Secretary Kennedy:
The undersigned organizations, representing a broad range of clinicians, providers, and other health care stakeholders nationwide, have united to oppose the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) Notice of Proposed Rulemaking: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information.1 This Rule, originally proposed during the Biden Administration, should be immediately withdrawn without further consideration. We instead encourage HHS to conduct a collaborative outreach initiative with our organizations and other regulated entities that are impacted to develop practical and actionable cybersecurity standards for more robust protections of individuals’ health information, without the extreme and unnecessary regulatory burden that health care providers and other stakeholders would face under the crushing and unprecedented provisions of this Proposed Rule.

Our organizations share a firm conviction of the importance of the Health Insurance Portability and Accountability Act of 1996, and the cybersecurity safeguards it provides. However, the Proposed Rule would place substantial new financial burdens on health care providers and includes unreasonable implementation timelines that make it difficult to reconcile with the information technology complexities of modern health care delivery organizations.

View the full letter