The (Proposed) HIPAA Security Rule Overhaul

For the first time in over a decade, the HIPAA Security Rule (found at 45 CFR Part 160 and Part 164, Subparts A and C) is facing a massive overhaul. On December 27, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released its Notice of Proposed Rulemaking (NPRM). If finalized, the proposed rule would be the heaviest shake-up to the HIPAA Security Rule for healthcare providers, health plans, clearinghouses, and business associates since the 2013 HIPAA Omnibus Rule. Moreover, this would be a hard pivot away from flexible, discretionary guidelines toward mandatory, prescriptive controls.

The most important thing for any regulated organization to recognize is that none of this is legally binding yet. The NPRM is merely a proposal. The public comment period closed on March 7, 2025, drawing roughly 4,700 comments that OCR is likely still sorting through.

The timeline for a final rule keeps shifting. OCR first signaled a spring 2026 release of the final rule, only for that window to come and go. The latest Unified Agenda from the Office of Management and Budget now projects July 2027 for final release. Bear in mind that these dates are rough planning estimates rather than hard deadlines. Because they have already shifted once, they could easily do so again. Some experts even suggest the final rule may come ahead of July 2027.

If the rule is largely finalized as written, it will completely transform HIPAA security compliance. Here are the main proposed changes:

• An end to "addressable" specifications: Right now, the HIPAA Security Rule sorts safeguards into two buckets: "required" and "addressable." Addressable never meant optional; rather, it meant that a healthcare entity could customize how it met the standard based on its size and risk profile, provided that the entity documented its logic. Under the proposal, almost every specification would become mandatory, with only a few narrow exceptions. This is the biggest structural change in the rule because it removes the documentation route that many organizations have used to delay putting certain controls in place.
• Mandatory encryption: Electronic Protected Health Information (ePHI) would have to be encrypted both at rest and in transit, with only strict and heavily documented exceptions.
• Mandatory multi-factor authentication (MFA): MFA would become a requirement for any system handling ePHI. The text of the proposed rule strongly pushes phishing-resistant methods as a defense against credential stuffing and password-based attacks.
• Network segmentation: Entities would be required to segment their networks to prevent hackers from moving laterally during a breach.
• Asset inventories and network maps: Organizations would be required to maintain a written inventory of their technology assets alongside a network map showing how ePHI flows through their systems. These must be reviewed at least annually or whenever major changes occur.
• Strict compliance timelines: The proposal replaces flexible timing with fixed deadlines: termination of a workforce member’s access to ePHI within one hour of the end of employment; notice to other regulated entities within 24 hours of a change or termination in a workforce member’s access; notice from a business associate to a covered entity within 24 hours of activating a contingency plan; restoration of critical systems within 72 hours of a loss; patching of critical vulnerabilities within 15 calendar days and high-risk vulnerabilities within 30; vulnerability scans at least every six months; and penetration testing and compliance audits at least once every 12 months.
• 72-hour restoration clock: The proposed 72-hour requirement is an internal recovery deadline: regulated entities would need written procedures to restore critical electronic information systems and data within 72 hours of a loss. It is not an incident-reporting deadline, and it does not displace the existing HIPAA Breach Notification Rule timelines for notifying individuals and HHS.
• Stricter business associate oversight: Business associates would have new documentation and disaster-recovery obligations. Covered entities, as a result, would have to obtain written annual verification that their vendors have actually implemented these safeguards, rather than relying on a signed agreement alone.

The smartest approach is neither to panic over the proposal nor to ignore it. Acting early makes sense for two reasons.

First, OCR's current enforcement patterns already point in the direction this rule is heading. Deficient or missing risk analyses remain the most frequently cited failure in enforcement actions, and recent settlements center heavily on the same controls this proposal would codify. Many of these proposed steps already amount to baseline cybersecurity hygiene.

Second, once a final rule is released, the compliance window will likely be short: roughly 240 days in total (effective 60 days after publication, with compliance required 180 days after that). Business associate agreements would run on a separate clock, with a transition period lasting until one year after the effective date. More difficult tasks, such as mapping ePHI assets or closing legacy encryption gaps, take months rather than weeks.

A smart near-term checklist includes mapping every system that touches ePHI, running a gap analysis against the proposed requirements, extending MFA and encryption coverage, and building templates for vendor verification.

This proposed overhaul marks a turning point for healthcare cybersecurity, pushing the industry away from flexible guidelines and toward hard, auditable mandates. For now, it remains a proposal with an unclear timeline and an uncertain final form. The better approach is to watch the rulemaking closely while treating its most demanding controls as sound security practices worth adopting nonetheless.

Disclaimer: This industry insight is for general information only, is not legal advice, and does not create an attorney-client relationship.