Proposed Cybersecurity Rule Threatens Future of Private Radiology Practices

Summary

• A proposed update to the HIPAA Security Rule would add new cybersecurity requirements, and private radiology practices worry about the cost.
• The Radiology Business Management Association (RBMA) has raised concerns about the impact on small and midsize practices.
• Supporters say health care needs stronger defenses as attacks keep rising.
• Many groups want requirements scaled to the size of the practice.

What the Proposed Rule Would Do

In January 2025, the Department of Health and Human Services (HHS) proposed the first major update to the HIPAA Security Rule in more than a decade. It would make many security steps mandatory that used to be optional, including multi-factor authentication, encryption of patient data, an up-to-date technology inventory and regular vulnerability scans. The goal is better protection for patient data. For private radiology practices, the worry is cost and workload.

Concerns From the RBMA

The Radiology Business Management Association (RBMA), which represents the business side of radiology practices, has warned that the new rules would be expensive for small and midsize groups to meet. Many practices fear compliance costs could force hard choices about staff and services. HHS itself estimated first-year compliance costs for the whole health sector at roughly $9 billion.

Money and Staff

Stronger security is not only a technical job. It costs money. Many private practices run on thin margins, and new tools, audits, training and specialist staff all add up. Some practices say they would have to cut services or sell to larger groups if the rule takes effect as written.

A Call for Proportionate Rules

Most groups commenting on the rule accept that health care needs better security. Many have asked HHS to scale the requirements to the size and resources of each practice. Smaller practices could get more time or simpler options, while patient data protection stays strong.

Supporters of that approach say it would improve compliance rather than push small practices into impossible choices. Critics of scaling worry that attackers do not care how big a practice is.

The Bigger Picture: Attacks on Health Care

Health care has become one of the most targeted sectors. Patient records sell well on criminal markets, and ransomware can shut down imaging and scheduling for weeks. The 2024 Change Healthcare attack showed how far a single breach can spread. The proposed rule reflects those risks, even if smaller practices feel it misses their constraints.

Finding the Balance

The debate over the HIPAA update is about balance. Patient data needs protecting. So do the small practices that deliver much of the country’s imaging. Regulators will have to weigh the comments, including the RBMA’s, before issuing a final rule. A phased or tiered approach is one way to get stronger security without driving practices out of business.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.