A 12-Month Healthcare Cybersecurity Series
HIPAA Security Readiness
Practical guidance for healthcare organizations preparing for the proposed HIPAA Security Rule changes, while strengthening compliance with the rule that is already in effect today.
Why This Series Exists
Why Prepare for the Proposed HIPAA Security Rule Now
The proposed HIPAA Security Rule represents a significant shift toward more specific, documented cybersecurity requirements. The final rule has not yet been published, but the current HIPAA Security Rule remains fully enforceable.
This series separates current requirements from proposed changes and explains how each topic appears inside a real healthcare organization. Every article includes practical actions, documentation guidance, and examples that leadership teams can use to evaluate their security posture.
What the series will cover
- Current HIPAA requirements versus proposed changes
- Asset inventories and ePHI data-flow mapping
- Risk analysis and risk management
- Identity management and multifactor authentication
- Encryption and secure transmission
- Network segmentation and secure configuration
- Patching and vulnerability management
- Monitoring and incident response
- Backup validation and disaster recovery
- Business associate oversight and compliance evidence
Regulatory Timeline
Proposed HIPAA Security Rule Timeline and Key Dates
NPRM Published
January 6, 2025
Projected Final Action
July 2027, subject to change
Proposed Effective Date
60 days after publication
Proposed Compliance Date
180 days after the effective date
Latest Article
Latest Article: Assets, Networks, and ePHI Flows
You Can’t Protect What You Can’t See: Asset Inventories, Network Maps, and ePHI Under the Proposed HIPAA Security Rule
Before you can assess your risks, you need to know what you are protecting. This month covers technology asset inventories, network maps, and tracing how ePHI actually moves through your organization.
Read the ArticleThe Complete Roadmap
The 12-Part HIPAA Security Readiness Roadmap
A new article will be added each month. Published articles will link directly from this page.
The Proposed Rule Timeline
What the July 2027 projection means and why healthcare organizations should prepare now.
Read Article →From Addressable to Required
How the proposed rule would replace broad discretion with more defined security expectations.
Read Article →Assets, Networks, and ePHI Flows
How to identify the systems, vendors, devices, and connections involved in handling patient information.
Read Article →Risk Analysis and Risk Management
Why identifying risks is only the beginning and how organizations should document remediation.
Identity, Access, and MFA
Unique identities, least privilege, multifactor authentication, and rapid account termination.
Encryption at Rest and in Transit
Protecting ePHI on devices, servers, backups, email systems, cloud platforms, and portable media.
Secure Networks and Devices
Network segmentation, secure configuration, device controls, and physical safeguards.
Patching and Vulnerability Management
Proposed 15-day and 30-day patching expectations, scanning, penetration testing, and unsupported systems.
Backups and Disaster Recovery
Backup currency, isolated recovery data, documented restore testing, and recovery planning.
Monitoring and Incident Response
Real-time monitoring, audit logs, alerting, workforce reporting, containment, and response testing.
Business Associates and Vendor Risk
BAAs, vendor inventories, annual verification, incident notification, and third-party oversight.
HIPAA Security Readiness Scorecard
A complete review of the core safeguards, supporting evidence, and next steps for final-rule preparation.
Stay current on HIPAA security
Receive each new article, regulatory updates, and practical healthcare cybersecurity guidance as the series progresses.
Continue Learning
Explore Solid’s latest insights
Visit our main blog for additional guidance on healthcare technology, cybersecurity, life safety, and managed services.
This page discusses proposed modifications to the HIPAA Security Rule published as a Notice of Proposed Rulemaking on January 6, 2025. The proposals have not been finalized and may change. This information is educational and does not constitute legal advice.
