A pending HIPAA security rule relies on self-attestation instead of independent audits, leaving compliance unchecked. The speaker argues for mandatory annual third-party assessments like SOC 2 requires, pointing to CMMC as a model that actually works.
What this pending HIPAA security rule does not account for is, I think, some of the challenges is the, the honor system. What I mean by that is the HIPAA security assessments have been self-done. HISA and actually other entities, like let's take CMMC in for example, they actually require a third-party assessment. And I think that that's actually where I think we'll get a lot of traction is if the carrot and the stick aspect of the this security rule is updated, that every year a third-party assessment has to be done, almost like a SOC 2, I think that there'll be much more adherence and compliance.
