• District of Columbia: HHS has proposed a new rule that increases cybersecurity requirements for healthcare organizations to ensure that sensitive healthcare data is protected. Under the proposal, entities covered by HIPAA would be required to achieve specific technical standards, such as encryption and multifactor authentication. Business associates would also be held to higher security standards, and group health plans will have a responsibility to protect electronic health information. According to HHS' Office of Civil Rights (OCR), the rapid advancement of technology since the HIPAA Security Rule was last updated in 2013 has led to increased use of electronic health information, as well as more frequent cyberattacks in healthcare. Steve Cagle, director of the cybersecurity firm Clearwater, said that while the proposed security updates will be minor for many healthcare organizations, those that are already behind on cybersecurity could struggle to comply. (Beavins, Fierce Healthcare, 1/7)
• Maryland: According to two sources who spoke to STAT+, President-elect Donald Trump will likely choose Abe Sutton to lead the Center for Medicare and Medicaid Innovation. Sutton would work under surgeon and TV personality Mehmet Oz, Trump's pick for CMS administrator, if Oz's appointment is confirmed by the Senate. Previously, Sutton served as an associate director of the National Economic Council, a policy advisor at the Domestic Policy Council, and an advisory to the secretary at HHS during Trump's first administration. Since 2021, Sutton has been part of Rubicon Founders, a healthcare investment firm, and cofounded the firm's first two companies, Honest Health and Evergreen Nephrology. (Zhang, STAT+ [subscription required], 1/13)
• Massachusetts: Gov. Maura Healey (D) last week signed a new law that will increase oversight of private equity investors in the healthcare industry in the state. Under the new law, private equity investors, real estate investment trusts, and management service organizations are subject to financial reporting requirements from the state's Center for Health Information and Analysis, as well as increased fines for noncompliance. The law also broadens the authority of the Massachusetts Health Policy Commission (MHPC) and allows MHPC to seek testimony from financial sponsors at its annual cost trends hearing. "We've seen bad actors exploit vulnerable hospitals and communities," Healey said. "We need to prevent that from happening again." According to Mary Bugbee, healthcare director at the Private Equity Stakeholder Project, the law will allow for greater transparency and could help give lawmakers more notice when healthcare facilities are facing financial challenges. (Taylor, Bloomberg/Modern Healthcare, 1/8)

The 2024 elections are behind us — but the future of the healthcare policy landscape remains uncertain. Access our updated resources to learn how the new administration is approaching healthcare, how key state-level ballot initiative decisions could impact national health policy, and more.