The proposed HIPAA Security Rule update: what it would change, what to do now, and what can wait

In January 2025, HHS published a proposed overhaul of the HIPAA Security Rule. Almost two years later, practice managers and hospital leaders still ask us the same two questions: is it final, and do we have to do all of it now? The short answers are no and no. The longer answer is that some of it is worth doing anyway, because it is already expected or inexpensive, and some of it is better left until the final text is known.

Where the proposal stands

The Office for Civil Rights published the notice of proposed rulemaking in the Federal Register on January 6, 2025, at 90 FR 898. The comment period closed March 7, 2025. If finalized, it would be the first major revision of the Security Rule since 2013.

The expected finish date has already moved. An earlier regulatory agenda anticipated a final rule in May 2026. That month passed without one, and the current Unified Agenda entry now lists final action for July 2027. The same entry places the rule under long-term actions, a category for items an agency does not expect to act on within the next 12 months. Agenda dates are statements of intent, not commitments. July 2027 could slip again, and the final rule could look different from the proposal.

There has also been organized pushback. In December 2025, more than 100 hospital systems, provider organizations, and associations wrote to HHS asking that the proposal be withdrawn, citing its cost and an unrealistic timeline. HHS's own estimate put the industry's first-year cost at about $9 billion, with about $6 billion a year in years two through five.

If a final rule keeps the proposal's timing, it would take effect 60 days after publication, with compliance due 180 days after that. A final rule in July 2027 would put compliance in early 2028 at the earliest.

What the proposal would change

The proposal is long, but most of it falls into a handful of themes. As HHS summarized it, regulated entities would need to:

• Treat nearly everything as required. The distinction between required and addressable implementation specifications would go away, with limited exceptions. All policies, procedures, plans, and analyses would have to be written.
• Keep a written technology asset inventory and network map showing how ePHI moves through your systems, reviewed at least every 12 months and when changes occur.
• Review, verify, and update the written risk analysis at least every 12 months, with more specific required content, including a risk level for each identified threat and vulnerability.
• Use multi-factor authentication and encrypt ePHI at rest and in transit, each with limited exceptions.
• Scan for vulnerabilities at least every six months and run penetration tests at least every 12 months, and patch critical risks within 15 calendar days and high risks within 30.
• Segment networks, maintain anti-malware and consistent configuration standards, and keep separate technical controls for backup and recovery.
• Be able to restore critical systems and data within 72 hours, with written restoration procedures based on a criticality analysis, written incident response plans, and procedures for testing them. Contingency plans would be tested at least every 12 months.
• Send 24-hour notices in certain cases, such as when a workforce member's access changes or ends, or when a business associate activates its contingency plan.
• Audit Security Rule compliance at least every 12 months.
• Get written verification from each business associate at least every 12 months that required technical safeguards are in place, backed by an analysis from a subject matter expert and a certification.

What you are measured against today

Until a final rule takes effect, organizations remain subject to the current Security Rule. That rule is firmer than people sometimes assume.

Its core is the risk analysis at 45 CFR 164.308(a)(1)(ii)(A): an "accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of electronic protected health information. It is paired with risk management at 164.308(a)(1)(ii)(B), which requires security measures sufficient to reduce those risks to a reasonable and appropriate level. OCR has made this a priority. Its Risk Analysis Initiative produced its first enforcement action in October 2024, and by June 2026 OCR had announced 14 of them.

It also helps to remember what "addressable" means right now. It has never meant optional. Under 164.306(d)(3), you must assess whether each addressable specification is reasonable and appropriate, implement it if it is, and if it is not, document why and put an equivalent alternative in place when that is reasonable. Encryption and access termination are both addressable today. An organization that skipped them without a written rationale already has a gap, proposal or no proposal.

What makes sense to start now

These items are either already expected under the current rule or inexpensive enough that waiting gains you very little.

• An asset inventory and a map of where ePHI goes. HHS's risk analysis guidance already says an organization "must identify where the e-PHI is stored, received, maintained or transmitted," and OCR described the proposed inventory and map as making existing expectations explicit. A list of systems, devices, and applications, plus a simple diagram of how patient data moves between them, is the foundation of a credible risk analysis anyway.
• A yearly risk analysis review. The current rule calls the process ongoing without setting a number. If you report MIPS, you already have to conduct or review the analysis within each calendar year. Our article on how often a risk analysis is required covers the details.
• Multi-factor authentication on email, remote access, and the EHR. In our experience it is often available in systems you already license, so the work is mostly configuration and staff training.
• Encryption on laptops, phones, removable media, and backups. Beyond the Security Rule, there is a direct payoff: PHI encrypted in line with HHS guidance is not "unsecured," so breach notification duties do not apply if an encrypted device is lost or stolen.
• A current list of business associates and their agreements. Satisfactory assurances from business associates are required now under 164.308(b)(1). Knowing which vendors touch ePHI is the first step whether or not annual verification arrives. See our overview of business associate requirements.
• A ranking of your systems by how critical they are, and an honest restore test. A data backup plan, disaster recovery plan, and emergency mode operation plan are required today, and a criticality analysis is addressable. Restoring a key system from backup once tells you how far you are from 72 hours.
• Prompt access removal when someone leaves. Termination procedures already exist in the current rule. Tightening the handoff between HR and IT costs little.
• Writing it down. The current rule already requires written (including electronic) policies, procedures, and records of required activities, kept for six years.

What can reasonably wait

Some proposed requirements carry real costs, or their final shape is uncertain enough that building to the proposal now risks paying twice.

• A separate annual compliance audit program. The current rule already requires periodic evaluation at 164.308(a)(8), so keep doing that. Building a new audit structure can wait until the final language is known.
• Expert-certified business associate verification. Hold off on a formal certification process or a rewrite of every agreement until the final wording is settled. The proposal itself includes a transition period for updating business associate agreements.
• Fixed-schedule penetration testing and six-month scanning. If your risk analysis already points to a need, act on it now. Otherwise, gather quotes and budget, and set the schedule once the rule is final.
• Network redesign and system replacement. Segmentation, replacing systems that cannot support MFA or encryption, and infrastructure built for 72-hour restoration can be capital projects. Identify and price them now; schedule the spending when the requirements are clear.
• New 24-hour notice clauses in contracts. Contract language is worth drafting once, against the final rule.

A practical next step

For most small practices and rural hospitals, the most useful thing to do is what the current rule already requires: an accurate and thorough risk analysis, followed by a risk management plan that ranks what to fix and when. Done well, it does double duty. It answers the question OCR asks today, and it shows how far you are from the proposed requirements, so the final rule becomes a list of known gaps rather than a surprise.

That is most of what we do at EHR Resources. We conduct the risk analysis, then work with your team on a remediation plan that separates what needs attention this quarter from what can be budgeted for next year or held until the final rule. When the rule is finalized, we will update this guidance. Until then, the current rule is the one that counts.