HIPAA Security Rule Changes: What to Know

The HIPAA Security Rule is getting its first major overhaul since 2003. In December 2024, the HHS Office for Civil Rights (OCR) published a Notice of Proposed Rulemaking (NPRM).

It would rewrite how medical practices protect electronic protected health information (ePHI). The final rule is now targeted for July 2027 on OCR's regulatory agenda.

If you run a small or mid-size medical practice, these changes will affect you directly. The proposed rule eliminates the concept of "addressable" safeguards, adds strict timelines for patching and incident response, and requires annual penetration testing. Here is what you need to know — and what you should start doing now.

Where Things Stand Right Now

OCR published the NPRM on December 27, 2024, and it appeared in the Federal Register on January 6, 2025. A 60-day comment period followed. During that window, HHS received 4,745 public comments, according to OCR — one of the highest response volumes for any healthcare regulation in recent years.

On January 20, 2025, the incoming administration signed an executive order pausing pending rulemaking for review. Industry groups including MGMA and the CHIME coalition petitioned HHS to withdraw the proposal, citing cost concerns for small and rural practices. Despite the pushback, OCR kept the rule on its official regulatory agenda. The timeline has slipped, though — the agenda now projects final action in July 2027, a planning estimate rather than a deadline.

Healthcare cybersecurity has bipartisan support. Both parties recognize that the surge in ransomware attacks and data breaches demands stronger baseline requirements. The final rule may include modifications, but the core direction — tighter, more specific, mandatory controls — is unlikely to change.

Why This Update Matters

The current HIPAA Security Rule was written in 2003 and last revised in 2013. Healthcare cybersecurity has changed dramatically since then. Ransomware attacks on hospitals and clinics have surged. Data breach costs now average $7.42 million per incident in healthcare — the highest of any industry. OCR imposed 22 financial penalties in 2024 — one of its busiest enforcement years ever — collecting $9.9 million, per its 2024 Report to Congress.

HHS acknowledged that the existing rule has not kept pace. Too many covered entities treated "addressable" safeguards as optional. The result: gaps in encryption, multi-factor authentication, and basic security hygiene that attackers exploit every day.

The Biggest Change: "Addressable" Becomes "Required"

This single structural shift affects everything. Under the current rule, some security measures are "required" and others are "addressable." Addressable means you can implement an alternative if you document why the standard approach isn't reasonable for your organization.

The proposed rule removes this distinction entirely. Every implementation specification becomes required, with only narrow, specific exceptions. If you've been relying on documented alternatives to skip encryption or MFA, that approach will no longer work.

Key New Requirements

The proposed rule makes encryption and MFA mandatory for every system that touches ePHI. It adds 15-day critical patch deadlines, a written asset inventory and network map, 72-hour disaster recovery, and annual penetration testing. Practices would have roughly 240 days after publication to comply.

Mandatory Encryption — At Rest and In Transit

Encryption of ePHI is no longer addressable. Every server, laptop, mobile device, and data transmission must use encryption. The only exception is when an individual patient specifically requests unencrypted ePHI. If your practice still has unencrypted laptops, portable drives, or email systems, you will need to fix that before the compliance deadline.

Multi-Factor Authentication (MFA) for All Systems

MFA becomes required on every technology asset that accesses ePHI. That includes your EHR, patient portal, email, billing system, and administrative accounts. The proposed rule provides a limited exception for FDA-approved medical devices authorized before March 29, 2023 — but only if you maintain a written transition plan to move that data to MFA-supported technology.

If your practice hasn't rolled out MFA yet, this is the single most important step you can take right now. Our guide on cybersecurity threats facing medical offices explains why credential theft remains one of the top attack vectors.

Patch Management Timelines

The proposed rule introduces hard deadlines for applying security patches:

• 15 calendar days for critical-risk patches
• 30 calendar days for high-risk patches
• Reasonable timeframe (per your documented policies) for all other patches

For a small practice without dedicated IT staff, the 15-day critical patch requirement is aggressive. It means someone must be monitoring for vulnerabilities and deploying fixes within two weeks — every time. This is one area where managed IT services outperform break-fix support, since your provider handles patch monitoring and deployment as part of the service.

Technology Asset Inventory and Network Map

Every practice must maintain a written inventory of all hardware, software, and data systems that handle ePHI. You also need a network map showing how patient data moves through your systems — from the front desk check-in to the EHR to the billing clearinghouse to the cloud backup.

Both documents must be reviewed and updated at least once every 12 months, and whenever significant changes occur (new threats, security incidents, new technology, or changes in regulations).

72-Hour Disaster Recovery

The proposed rule requires written procedures to restore critical electronic information systems and data within 72 hours of a loss event. You must maintain exact backup copies of ePHI and perform a criticality analysis to set restoration priorities. Our guide on backup and disaster recovery planning for medical offices covers the fundamentals.

Annual Penetration Testing and Vulnerability Scanning

Penetration testing must occur at least once every 12 months. Vulnerability scanning must occur at least every 6 months. For most small practices, this means hiring a third-party security firm — the same kind of work a virtual CISO (vCISO) coordinates for you.

Network Segmentation

Practices must implement network segmentation to limit lateral movement. If an attacker compromises one device, segmentation prevents them from reaching your entire network. At minimum, your guest Wi-Fi, medical devices, and administrative systems should sit on separate network segments.

1-Hour Access Termination

When an employee leaves your practice, their access to all systems must be revoked within one hour. Other regulated entities must be notified of workforce access changes within 24 hours. This requires tight coordination between your HR process and IT systems — something you should document in advance, not scramble to figure out during a termination.

Business Associate Verification

This is entirely new. Every business associate must provide written verification once per year that they have deployed the required technical safeguards. That verification must include a written analysis by a subject matter expert, and a person of authority at the business associate must certify it in writing.

If you work with an EHR vendor, a billing clearinghouse, a cloud backup provider, or an IT company, you will need this annual certification from each one. Review your business associate agreements now and plan for this new requirement.

Incident Response and 24-Hour Notification

Written incident response plans must be reviewed and tested at least once every 12 months. Business associates must notify covered entities within 24 hours of activating their contingency plans. Subcontractors must do the same.

Annual Compliance Audits

The proposed rule requires compliance audits at least once per year. These can be internal or external, but they must verify adherence to the full Security Rule. Combined with the enhanced risk assessment requirements, this creates a continuous compliance cycle rather than a one-time checkbox.

Workforce Training Updates

New employees must complete security training within 30 days of getting system access. All staff must receive refresher training at least once every 12 months.

Compliance Timeline

If HHS finalizes the rule as proposed, the timeline is tight:

• 60 days after publication: the rule takes effect
• 180 days after the effective date: full compliance required

That gives you roughly 240 days — about 8 months — from publication to compliance. If the final rule publishes in mid-2027, your practice would need full compliance by early-to-mid 2028. That is not a lot of time for practices starting from scratch.

What About the Costs?

HHS estimates the new rule will cost the healthcare industry approximately $9 billion in the first year and $6 billion per year after that, per the NPRM's regulatory impact analysis (90 FR 898). Over five years, the total reaches roughly $33 billion across all covered entities and business associates.

For individual small practices, costs will vary based on your current security posture. If you already encrypt ePHI, use MFA, and have a managed IT provider, you may need only incremental changes. Think updated documentation, a penetration test, and revised business associate agreements.

If you have been deferring security investments, the catch-up costs will be higher. Expect new hardware encryption, MFA deployment, network segmentation, and potentially a full security assessment.

HHS argues that if the changes reduce breach-affected individuals by just 7 to 16 percent, the rule pays for itself. Given that a single ransomware attack can shut down a practice for weeks, proactive investment usually costs less than recovery.

Enforcement Is Getting Stricter

Current HIPAA penalty tiers range from $145 per violation (Tier 1, lack of knowledge) up to $2.19 million per violation (Tier 4, willful neglect). Annual caps reach $2.19 million. OCR does not give small practices a pass — enforcement actions in recent years have targeted organizations of all sizes.

With "addressable" eliminated, enforcement becomes more straightforward. You either meet the requirement or you don't. There is no documented-alternative defense.

Related: see preparing for an OCR HIPAA audit.

Your 10-Step Action Plan

You don't need to wait for the final rule. Every requirement in the proposed rule is already a cybersecurity best practice. Here is what to do now:

1. Run a gap assessment. Compare your current security setup against the proposed requirements. Identify what you already have and what you're missing.
2. Build your asset inventory. Document every device, application, and system that touches patient data — workstations, laptops, tablets, phones, printers, medical devices, cloud services.
3. Map your ePHI data flows. Trace how patient data moves from intake through treatment, billing, storage, and backup. This becomes your required network map.
4. Enable MFA everywhere. Start with your EHR, email, and any system accessible remotely. Use authenticator apps — not SMS codes — where possible.
5. Encrypt everything. Full-disk encryption on every laptop and workstation. TLS for every data transmission. Encrypted backups.
6. Write your incident response plan. Document who does what during a breach, how you notify patients and OCR, and how you restore operations. Then test it.
7. Schedule penetration testing. Get a baseline assessment from a qualified security firm. Address findings and plan for annual retesting.
8. Update your BAAs. Add language requiring annual written compliance verification from every business associate.
9. Document everything. The proposed rule requires written policies for every safeguard. If it isn't written down, it doesn't count.
10. Train your team. Run HIPAA security training for all staff. Make it specific: teach them to recognize phishing emails, social engineering, and common attack patterns.

You don't have to build all of this alone. Our HIPAA compliance services cover the gap assessment, documentation, and safeguards the proposed rule requires.

Don't Wait for the Final Rule

The proposed HIPAA Security Rule changes are coming. The specific dates may shift, and some details may change in the final version. But the direction is clear: HHS expects every covered entity to implement real, documented, verifiable security controls. The days of "addressable means optional" are over.

Starting now gives you time to spread the cost, fix gaps methodically, and avoid a last-minute scramble. Every step you take today reduces your risk of a breach, a fine, or both.