Trump Administration Proposes 12.5% Cut to HHS Budget for FY 2027

Posted by Steve Alder

The HHS’ Office for Civil Rights (OCR) has long been seeking an increase to its budget to support its HIPAA enforcement activities; however, that is looking unlikely as the Trump Administration is seeking to cut funding for the Department of Health and Human Services (HHS) in 2027.

The Trump Administration has proposed $111.1 billion in discretionary funding for fiscal year 2027, a $15.8 billion (12.5%) cut in funding compared to FY 2026. One of the main casualties is the National Institutes of Health (NIH), which faces a $5 billion cut to its budget, plus $5 billion in cuts through consolidations and eliminations of programs across several sub agencies, including the Health Resources and Services Administration (HRSA), Substance Abuse and Mental Health Services Administration (SAMHSA), Centers for Disease Control and Prevention (CDC), and the Office of the Assistant Secretary for Health (OASH).

The Trump Administration is seeking to establish the Administration for a Healthy America (AHA), which, in part, will involve the elimination of programs that the Trump Administration says promote “radicalized DEI ideologies”, including programs that provide funding for youth LGBTQ services. The AHA was proposed last year, although Congress did not include funding to establish the new department in the budget.

While OCR does not appear to be facing any budget cuts, any increase to its budget to support its enforcement of HIPAA and the Part 2 regulations looks increasingly unlikely. OCR is already having to find funds from its existing budget to pay for an expanded workload, as OCR has been given the responsibility of enforcing the Part 2 regulations.

In a press call following the announcement of the Part 2 enforcement program, the OCR Director said the agency has sufficient resources to manage the additional Part 2 enforcement workload in fiscal year 2026, based on the expected volume of complaints and data breaches.

Since OCR started enforcing compliance with the Part 2 regulations in February and updated its data breach portal, there has been a major slowing of the publication of breach summaries on its “HIPAA Wall of Shame,” which had no breach reports added to the “under investigation” section after February 26, 2026, during the whole of March. Whether this is due to a lack of resources or a change in policy is unclear. OCR does appear to be working on closing investigations faster, as data breaches have been added to the archive section at an increased pace.

While the Trump Administration has proposed its budget with extensive funding cuts, it will be down to Congress to pass that budget, and there is likely to be some resistance to the proposed budgetary cuts at HHS, as was the case with the proposed budget for FY 2026. The Trump Administration sought to cut HHS funding last year; however, Congress actually increased the budget for the HHS in 2026.

The post Trump Administration Proposes 12.5% Cut to HHS Budget for FY 2027 appeared first on The HIPAA Journal.

Critical Flaws Identified in Progress Software ShareFile Service

Posted by Steve Alder

Two critical vulnerabilities have been identified in Progress Software’s ShareFile service. The flaws could potentially be chained by an unauthenticated remote attacker to make configuration changes and achieve remote code execution.

While there have been no known cases of the vulnerabilities being exploited in the wild to date, vulnerabilities in file sharing software are actively targeted by threat actors, so attempted exploitation is likely. In 2023, a zero-day vulnerability in Progress Software’s MOVEit file transfer software was mass exploited by the Clop ransomware group, which claimed hundreds of victims worldwide. To a lesser extent, vulnerabilities in Fortra’s GoAnywhere, Accellion FTA, and Cleo MFT were also mass exploited. Users are therefore encouraged to apply the security updates promptly to prevent exploitation.

The vulnerabilities affect ShareFile Storage Zones Controller v5 version deployments for customer-managed zones and include an authentication bypass flaw tracked as CVE-2026-2699 and a remote code execution flaw tracked as CVE-2026-2701.

According to Progress Software’s security alert, “These vulnerabilities allow an unauthenticated remote attacker to access on-prem storage zones controller’s configuration pages, potentially leading to changes in system configuration and remote code execution.” The authentication bypass flaw has a CVSS v3.1 base score of 9.8, and the RCE flaw has a CVSS base score of 9.1.

The vulnerabilities affect versions 0 through 5.12.3 and have been patched in version 5.12.4. The vulnerabilities do not exist in any v6 versions. Progress Software strongly recommends upgrading to a patched version of V6 as soon as possible to prevent exploitation. Any users of unsupported versions should ensure they upgrade to a supported and fixed version as soon as possible.

The vulnerabilities were identified by security researchers Sonny and Piotr Bazydlo of watchTowr, who reported them to Progress Software. According to Shadow Server, there are 334 Unique IPs associated with ShareFile in the United States.

The post Critical Flaws Identified in Progress Software ShareFile Service appeared first on The HIPAA Journal.