White Paper · HIPAA · Security Rule

The Proposed HIPAA Security Rule: What It Would Change, Where It Stands, and How to Plan

The January 2025 proposal is not final, and the current rule still governs. Which investments pay off either way.

By Lincoln Square Law · 8-minute read

The HIPAA Security Rule has been built on flexibility since it took effect in 2005. It tells covered entities and business associates what to protect and leaves much of the how to a documented judgment about what is reasonable and appropriate for the organization. In January 2025, the Department of Health and Human Services proposed to change that bargain, replacing much of the discretion with specific, mandatory controls. Nearly two years later, the proposal has not been finalized. This paper explains what the proposal would require, where the rulemaking stands, how compliance dates would work if it is finalized, and how to plan spending and effort while the outcome remains uncertain.

Where the rulemaking stands

HHS announced the proposal on December 27, 2024, and published it in the Federal Register on January 6, 2025 (90 Fed. Reg. 898). The comment period closed on March 7, 2025. The Spring 2025 Unified Agenda listed the rule at the final rule stage with a target date of May 2026. As of late September 2026, the Federal Register shows no final rule, and the January 2025 proposal remains the only published rulemaking document. HHS has stated that while the rulemaking is under way, the current Security Rule remains in effect.

That last point is the one that matters for enforcement. Every investigation today is measured against the existing regulations at 45 C.F.R. 164.302 through 164.318, and the Office for Civil Rights continues to bring actions under them. Planning for the proposal is sensible. Treating it as a reason to defer the current requirements is not.

What the proposal would change

The HHS fact sheet summarizes the principal changes. The most consequential are:

• No more addressable specifications. The distinction between required and addressable implementation specifications would be removed, making nearly all of them mandatory with limited exceptions.
• Written inventory and network map. Regulated entities would maintain a written technology asset inventory and a network map of how electronic protected health information moves through their systems, reviewed at least every twelve months and whenever operations change.
• More specific risk analysis. The risk analysis would have to include identified threats, vulnerabilities, and risk levels, documented in writing.
• Encryption and multi-factor authentication. Encryption of ePHI at rest and in transit, and multi-factor authentication, would be required, with limited exceptions.
• Testing on a schedule. Vulnerability scanning at least every six months and penetration testing at least once a year.
• Recovery and response. Written procedures to restore certain systems and data within 72 hours, and written incident response plans.
• Access changes. Notice to other regulated entities within 24 hours when a workforce member’s access to ePHI is changed or terminated.
• Compliance audits. A compliance audit at least once every twelve months.
• Business associate verification. Written verification from business associates, at least once a year, that required technical safeguards are deployed.

Many of these controls are already expected in practice. The difference is that today an organization can document why a particular addressable specification is not reasonable and appropriate for it (45 C.F.R. 164.306(d)(3)). Under the proposal, that option would largely disappear.

How the compliance dates would work

The proposal describes the timing a final rule would follow. It would take effect 60 days after publication. Regulated entities would then have 180 days from the effective date to comply, the standard compliance period under 45 C.F.R. 160.105. The proposal also includes a separate transition period, beyond the 180 days, for updating existing business associate agreements, to be codified at proposed 45 C.F.R. 164.318. In practical terms, an organization would have roughly eight months from publication to meet most new requirements, with somewhat longer for its contracts.

Eight months is not long for a small or mid-sized practice to complete an asset inventory, deploy multi-factor authentication across every system, arrange penetration testing, and renegotiate vendor terms. That is the strongest argument for starting now with the controls that would be required under either version of the rule.

Planning under uncertainty

The useful question is not whether the final rule will match the proposal. It is which investments pay off whether or not it does. Several meet that test:

• An asset inventory and data-flow map. The current rule already requires an accurate and thorough risk analysis of all ePHI (45 C.F.R. 164.308(a)(1)(ii)(A)), and that is not possible without knowing where ePHI resides. OCR’s recent enforcement actions repeatedly cite the failure to conduct one.
• Multi-factor authentication for remote and privileged access. It supports the current person or entity authentication standard (45 C.F.R. 164.312(d)) and would be required under the proposal. OCR has stated that hacking and ransomware are the most frequent type of large breach reported to it.
• Encryption where ePHI is stored or transmitted. Encryption is addressable today (45 C.F.R. 164.312(a)(2)(iv), (e)(2)(ii)), but encrypted data that meets HHS guidance is not unsecured PHI for breach notification purposes, which changes the consequences of a lost device or intercepted file.
• Tested backups and restoration. The current contingency plan standard already calls for data backup, disaster recovery, and testing (45 C.F.R. 164.308(a)(7)). Testing a restore against a real deadline shows whether the plan works.
• Vendor inventory and contract review. Knowing every business associate, and what each one does with ePHI, is a prerequisite for both the current contract requirements (45 C.F.R. 164.314(a), 164.504(e)) and any future verification obligation.

Controls that exist only to satisfy a proposed schedule, such as a fixed calendar for penetration tests, can reasonably wait for the final text. Controls that close real gaps in the current risk analysis should not.

A realistic sequence

For most practices, the order of work is:

• Inventory first. Systems, devices, applications, and vendors that create, receive, maintain, or transmit ePHI.
• Refresh the risk analysis against that inventory, and write down the risk levels.
• Close the largest gaps, which usually means multi-factor authentication, encryption on laptops and mobile devices, and patching.
• Test a restore from backup against a real time target.
• Review vendors and contracts at each renewal.
• Update policies so they describe what the organization actually does.

The enforcement context

OCR’s current priority is risk analysis. In March 2026, OCR described its settlement with a software business associate, whose breach affected about 15 million people, as the twelfth enforcement action under its Risk Analysis Initiative. In April 2026, it announced four more ransomware settlements in which the recurring violation was the failure to conduct an accurate and thorough risk analysis. Penalties follow the tiers in 45 C.F.R. 160.404, with dollar amounts adjusted for inflation each year.

The statute also rewards preparation. Under the 2021 amendment to the HITECH Act, HHS must consider whether an entity had recognized security practices in place for the prior twelve months when it decides fines, audit outcomes, and other remedies (Pub. L. 116-321). A documented program built on a recognized framework, such as the NIST Cybersecurity Framework or the HHS 405(d) practices, is therefore a mitigation argument as well as a security measure.

Business associates and vendors

The proposal would require covered entities to obtain written verification from business associates, at least annually, that required technical safeguards are in place. Even without that rule, a covered entity can ask for security attestations in its contracts now. Adding a verification clause during ordinary renewals is far easier than renegotiating every agreement in a compressed transition period.

What to watch

When a final rule appears, compare it with the proposal on four points: whether addressable specifications survive in any form, the length of the business associate transition period, any change to the compliance period, and whether small practices receive any different treatment. Then update the risk analysis and remediation plan against the final text. Until then, the current rule governs, and a current risk analysis with a documented remediation plan is the best preparation for either outcome.