The HIPAA Security Rule Update: What's Proposed and What's Required Now

If you've read anything about HIPAA lately, you've probably seen headlines about new mandatory requirements: multi-factor authentication, encryption, annual audits. Some of it is written as though it's already law. It isn't — yet. This piece separates what HHS has proposed from what's required today, and what a small practice should actually do about it.

What happened

In January 2025, HHS published a proposed rule to overhaul the HIPAA Security Rule — the most significant revision since the rule took effect. The public comment period closed in March 2025 and drew thousands of comments. A final rule was originally targeted for May 2026; HHS's latest regulatory agenda moves it to its long-term list, with a projected final rule in July 2027.

What the proposal would change

The headline change is removing the distinction between "required" and "addressable" safeguards. Today, some safeguards (encryption is the famous one) are addressable: you implement them where reasonable and appropriate, or document why not and use an equivalent alternative where that's reasonable. Under the proposal, almost everything would simply be required. Among the specifics:

• Encryption of patient data at rest and in transit, with limited exceptions
• Multi-factor authentication for access to systems holding patient data
• A written inventory of technology assets and a map of how patient data moves through them
• A compliance audit at least every 12 months
• Vulnerability scanning at least every six months and penetration testing at least annually
• Written procedures to restore critical systems and data within 72 hours

What's required right now

The current Security Rule is fully in force, and it already requires more than many practices realise:

• A written risk analysis, kept accurate and up to date
• Risk management — actually acting on what it finds
• Unique user IDs for everyone, and procedures for access control
• Security awareness training for the whole workforce
• Business associate agreements with every vendor that handles patient data
• A data backup plan, a disaster recovery plan and an emergency mode operation plan
• Encryption where reasonable and appropriate — or a documented reason why not, plus an equivalent alternative

The first item matters most. HHS's Risk Analysis Initiative, which began in late 2024, had produced at least 14 enforcement actions by June 2026, and they keep citing the same thing: no accurate, thorough risk analysis. Small providers aren't exempt — a 2025 penalty against a small California provider that had never done one carried the subtitle "Small Health Care Providers Also Must Comply with the HIPAA Rules."

Why you shouldn't wait for the final rule

Three reasons. First, the proposal mostly writes down what a good risk analysis already concludes. If you're holding patient data in email without multi-factor sign-in, or on unencrypted laptops, your current risk analysis should already flag that — and "we were waiting for it to become mandatory" is not a strong position after a breach.

Second, if the rule is finalised roughly as proposed, the compliance window will be short — months, not years. Doing the work calmly now is cheaper than doing it in a rush alongside every other practice.

Third, cyber insurers already ask about most of this. Multi-factor authentication, tested backups and endpoint protection show up on nearly every application, regardless of what HIPAA says.

What a small practice should do now

• Do, or update, the written risk analysis. Everything else follows from it.
• Turn on multi-factor authentication for email, the EHR and remote access.
• Confirm encryption is on for every laptop and portable drive.
• Make a simple list of every device and system that touches patient data — you'll need it for the risk analysis anyway, and the proposal would require it.
• Test a backup restore and write down how long it took.

Our free HIPAA self-check covers most of these in ten questions. For the risk analysis itself, see what a HIPAA risk assessment actually involves, or talk to us about our HIPAA security service.