The Proposed HIPAA Security Rule Update: What This Month’s Regulatory Timeline Change Really Means
What Changed in the HIPAA Security Rule Timeline
If you follow healthcare news, you may have noticed headlines this month asserting that the federal government has delayed the proposed HIPAA Security Rule update.
That isn’t quite what happened.
The federal regulatory agenda now projects final action on the proposed HIPAA Security Rule in July 2027, approximately one year later than the previous projection. While that projection is not legally binding and could change again, it gives healthcare organizations more time to plan.
For many organizations, the initial reaction is relief: one more project can wait.
We recommend viewing it differently.
This additional time is an opportunity to deliberately strengthen your cybersecurity posture rather than attempt to complete multiple major initiatives within a short compliance window. Over the next twelve months, this series will explain one proposed change at a time, in plain language, so you can understand what each one means for healthcare organizations of every size.
Before we discuss what may change, it is important to understand what already exists today.
What current HIPAA already requires
The HIPAA Security Rule has protected electronic protected health information (ePHI) since 2003. Although many people think of HIPAA primarily as a privacy law, the Security Rule is fundamentally a cybersecurity regulation.
Covered entities and business associates are already required to implement administrative, physical, and technical safeguards to protect patient information. Those responsibilities include:
- Conducting an accurate and thorough risk analysis
- Managing identified security risks
- Limiting access to patient information
- Training workforce members
- Maintaining contingency and recovery plans
- Documenting security activities
None of those responsibilities are on hold.
The current Security Rule remains fully enforceable today. In recent years, the Office for Civil Rights (OCR) has focused not only on whether organizations identified security risks, but also on whether they actively addressed them. Repeatedly documenting the same unresolved vulnerabilities has become a common theme in enforcement actions, so organizations should ensure they can show both identification and remediation.
“If finalized as proposed, numerous safeguards that are currently ‘addressable’ would become required.”
CONTACT USWhat the Proposed HIPAA Security Rule Would Change
In January 2025, the Department of Health and Human Services published a Notice of Proposed Rulemaking (NPRM) proposing what would be the most significant revision to the HIPAA Security Rule in more than a decade.
HHS concluded that today’s cybersecurity threat landscape has evolved far beyond what existed when many of the current requirements were written. Technologies such as multi-factor authentication, encryption, centralized monitoring, and modern backup strategies are now widely available and increasingly viewed as baseline security practices rather than advanced protections.
If finalized as proposed, numerous safeguards that are currently “addressable” would become required, subject to limited documented exceptions. Those proposed requirements include:
- Multi-factor authentication
- Encryption of ePHI at rest and in transit
- Technology asset inventories
- Network and data-flow mapping
- Network segmentation
- Vulnerability scanning
- Penetration testing
- Backup validation and recovery testing
- Expanded recordkeeping requirements
The proposal generated nearly 4,700 public comments, including significant feedback from healthcare organizations regarding implementation costs and timelines. Regulators continue to review those comments, and the projected final-action date has been revised in the meantime.
It is important to understand what that date means:
It is not a compliance deadline.
It is not a guaranteed publication date.
It is simply the federal government’s current projection for completing the rulemaking process.
Under the proposal, a final rule would become effective 60 days after publication, followed by a proposed 180-day compliance period. While the final timeline may change, the proposal illustrates an important reality: healthcare organizations could have only about eight months to implement any newly adopted requirements once the final rule is published.
What this looks like inside a healthcare organization
Eight months sounds generous until you consider what may need to happen during that time.
Imagine a typical medical office: clinical workstations, front-desk computers, servers, cloud-based electronic health records, email systems, imaging equipment, VoIP phones, remote access tools, wireless networks, and third-party vendors. Every one of those systems becomes part of the security discussion.
Organizations waiting until publication of the final rule could find themselves simultaneously conducting asset inventories, completing risk analyses, deploying multi-factor authentication, validating encryption, redesigning network architecture, updating vendor agreements, training staff, and documenting every step while competing with thousands of other organizations for the same consultants, hardware, and implementation resources.
Organizations that begin strengthening those areas today will spend that same period updating current controls rather than building them from scratch.
Meanwhile, cyberattacks are not waiting for the rulemaking process to finish.
According to HHS, reported healthcare data breaches approximately doubled between 2018 and 2023, while the number of people affected increased by roughly 950 percent. Smaller healthcare organizations are not protected by their size. In many cases, they are targeted precisely because attackers expect fewer cybersecurity resources.
The interconnected nature of healthcare magnifies that risk. The 2024 ransomware attack on Change Healthcare, a claims clearinghouse used by providers nationwide, ultimately affected roughly 190 million people and disrupted payment operations for organizations of every size. It remains the largest healthcare data breach on record.
Four HIPAA Security Steps to Take This Month
- Understand the difference between today’s Security Rule and the proposed changes, and use that distinction to guide your next steps.
- Begin building a complete inventory of systems that create, receive, maintain, or transmit ePHI.
- Locate your most recent documented risk analysis. If you cannot find it, or if it consists only of a generic checklist, make improving it a priority.
- Ask your IT provider one question: “If OCR audited us today, what are our three biggest security gaps, and what should we address first?” A thoughtful answer should be immediate and supported by documentation.
HIPAA Security Documentation to Retain
Begin maintaining a dedicated security documentation repository to keep key records organized and accessible.
Risk analyses, training records, vendor agreements, policies, recovery testing results, and remediation projects all belong in that repository.
Whether under the current Security Rule or the proposed changes, documentation is how an organization demonstrates that its security program exists. If an activity cannot be documented, regulators have little evidence that it occurred.
How Solid Approaches HIPAA Security Readiness
Rather than waiting for the proposed rule to become final, Solid has aligned its managed security standards with the proposal’s direction while continuing to satisfy today’s HIPAA requirements.
This allows our clients to strengthen their security posture incrementally through documented asset inventories, risk assessments, recovery planning, workforce training, and other managed security deliverables, instead of compressing multiple initiatives into a short implementation period.
Current Rule vs. Proposed Rule at a Glance
| Current HIPAA Security Rule | Proposed Rule (Jan 2025 NPRM) | Solid Managed Standard | |
|---|---|---|---|
| Overall approach | Flexible; many safeguards are “addressable” based on the organization’s own analysis | Prescriptive; most safeguards required, with limited documented exceptions | Proposed requirements adopted as the working baseline |
| Compliance timing | In effect and enforced now | No fixed date; roughly eight months after a final rule publishes, as proposed | Clients brought to baseline on an ongoing managed cadence |
| Risk analysis | Required today | Required, with more specific written elements | Delivered annually as a documented client deliverable |
| Documentation | Required today | Expanded and more specific | Named deliverables produced on a defined schedule |
Regulatory Status (July 2026)
- Proposed Rule: HIPAA Security Rule NPRM (90 FR 898, RIN 0945-AA22)
- Published: January 6, 2025
- Public comments closed: March 7, 2025
- Current Unified Agenda projection: Final action in July 2027 (subject to change)
- Current HIPAA Security Rule: Fully effective and actively enforced
Next in the Series: From Addressable to Required
Next month, we will examine perhaps the most significant conceptual change in the proposal: the gradual shift from flexible, risk-based “addressable” safeguards toward more defined cybersecurity expectations.
Follow the series
To receive each month’s article by email, subscribe here. Every article in this series is also collected on our HIPAA Security Readiness resource page, along with a maintained summary of the rulemaking’s current status.
This article discusses proposed modifications to the HIPAA Security Rule published as a Notice of Proposed Rulemaking on January 6, 2025. The proposals have not been finalized and may change. Nothing in this article is legal advice; consult qualified counsel regarding your organization’s obligations.
