In January 2025, HHS published a proposed rule to overhaul the HIPAA Security Rule for the first time since it took effect in 2005. The proposal drew thousands of public comments. HHS has since moved the rule to its long-term agenda, and the federal regulatory agenda now lists July 2027 as the target for a final rule, about a year later than originally planned.
That delay is not a reason to set this aside. Most of the proposed requirements reflect what OCR already expects to see during investigations, and the proposal would give organizations only about 240 days to comply once the final rule is published.
What the proposed rule would change
- No more “addressable” safeguards. Nearly all implementation specifications would become required, with limited exceptions.
- Technology asset inventory and network map. A written inventory of systems that touch ePHI and a map of how ePHI moves through them, reviewed at least annually.
- More detailed risk analysis. Specific required elements, tied to the asset inventory.
- Multi-factor authentication for access to systems containing ePHI.
- Encryption of ePHI at rest and in transit, with limited exceptions.
- Vulnerability scanning at least every six months and penetration testing at least annually.
- Restore critical systems within 72 hours after an incident, with written contingency plans.
- Annual compliance audits against the Security Rule.
- Business associate verification. Written confirmation, at least annually, that business associates have deployed required safeguards.
Other HIPAA changes that already happened
While the Security Rule waits, other changes have moved forward. Covered entities had until February 16, 2026 to update their Notices of Privacy Practices and comply with the rule aligning 42 CFR Part 2 substance use disorder records with HIPAA. The 2024 reproductive health privacy rule was vacated by a federal court in June 2025.
What to do now
- Build your asset inventory and data flow map. It is the foundation for everything else, and OCR already asks for it during investigations.
- Close MFA gaps, starting with email, remote access, and EHR access.
- Confirm encryption on laptops, mobile devices, backups, and data in transit.
- Set a testing schedule for vulnerability scans and an annual penetration test.
- Test your recovery time. Could you restore your critical systems within 72 hours today?
- Start collecting safeguard confirmations from your business associates.
Organizations that do this work now will be in a much better position on the day the final rule is published, and in a stronger position during any OCR investigation in the meantime.
How Eagle can help
Eagle’s security risk assessments already map to the proposed requirements, including asset inventories, data flow documentation, and vulnerability testing. We can show you where you stand against both the current rule and the proposal, and build a realistic plan to close the gaps. Schedule a consultation.
Sources: The HIPAA Journal; Clark Hill; Alston & Bird. This article is general information, not legal advice.
