HHS Eases Security, Privacy Rules for Hospital EHR Vendors Under Trump Administration

The U.S. Department of Health and Human Services has relaxed several security, privacy, and transparency requirements for vendors of electronic health record (EHR) software used by hospitals, according to a STAT News report. The changes, enacted under the Trump administration, remove certain federal mandates that previously governed how EHR companies must safeguard patient data and disclose software capabilities. Hospitals and health systems rely on EHR systems from major vendors like Epic, Cerner, and Meditech to manage patient records, clinical workflows, and billing. By rolling back these rules, HHS aims to reduce regulatory burden on health IT developers, but critics warn it could weaken protections for sensitive health information. The move comes as healthcare organizations face growing cybersecurity threats, including ransomware attacks that have disrupted hospital operations nationwide. Privacy advocates argue that less oversight may lead to inconsistent security practices across different EHR platforms. The long-term impact on patient data safety and interoperability remains uncertain as the industry adjusts to the new regulatory landscape.