What Does the Proposed HIPAA Security Rule Update Change, and What Should Healthcare Organizations Do Now?
Short answer: The proposed HIPAA Security Rule update, published by HHS in January 2025, would eliminate the current distinction between "required" and "addressable" safeguards, making nearly all specifications mandatory, while adding encryption; multi-factor authentication; 72-hour incident reporting; and annual penetration testing requirements. As of late 2026, the rule remains proposed, not final, and HHS has pushed its target for final action to July 2027. The current Security Rule remains in effect throughout, and healthcare organizations should prepare for the most likely elements of the proposal now rather than waiting for finalization.
Healthcare organizations have spent nearly two years hearing that a major HIPAA Security Rule update is coming, without a final rule ever arriving. That uncertainty makes it tempting to wait. It also creates real risk, since several of the proposed requirements represent significant operational changes that take time to implement well. This guide covers what is actually proposed, where the rule currently stands, and what to do while it remains unsettled.
What Triggered This Update to the HIPAA Security Rule?
HHS proposed this update in response to a sustained rise in healthcare cyberattacks and recurring compliance deficiencies the Office for Civil Rights (OCR) identified during its own investigations, and it represents the first major revision to the Security Rule since 2013. The proposal was issued as part of a broader federal cybersecurity strategy that specifically identified healthcare as critical infrastructure requiring stronger baseline protections.
This context matters for how healthcare organizations should read the proposal. It was not written as an abstract compliance update. It responds directly to patterns OCR has observed repeatedly across healthcare data breach investigations, which is part of why several of its provisions are likely to survive in some form even if the rule's final language changes.
What Is the Single Biggest Structural Change in the Proposed Rule?
The single biggest structural change is the elimination of the distinction between "required" and "addressable" implementation specifications, which would make nearly every safeguard mandatory rather than allowing organizations to document a risk-based alternative for addressable items. Under the current rule, an organization can determine that an addressable specification is not reasonable for its environment and implement an equivalent measure instead, with documentation.
Removing this distinction would close a gap that has effectively allowed some organizations to treat addressable specifications as optional. It would also remove the flexibility that smaller or resource-constrained organizations have historically relied on to tailor their compliance approach to their actual environment and risk profile.
What New Technical Requirements Does the Proposal Introduce?
The proposal introduces mandatory encryption of electronic protected health information (ePHI) at rest and in transit; required multi-factor authentication across systems accessing ePHI; a 72-hour incident reporting requirement; and annual penetration testing, along with enhanced oversight obligations for business associates. Each of these moves the Security Rule closer to a prescriptive technical standard rather than the more flexible, risk-based framework it has historically been.
The 72-hour incident reporting requirement deserves particular attention, since it would compress the timeline organizations currently have to assess and report an incident. Many healthcare organizations do not currently have an incident response process capable of reliably meeting a 72-hour window, which makes this one of the proposal's more operationally demanding elements.
What Is the Current Status of the Proposed Rule?
As of the Fall 2026 Unified Agenda, HHS moved the proposed rule to its Long-Term Actions agenda and identified July 2027 as its anticipated timeframe for final action, a significant delay from the May 2026 target originally set. The current Security Rule remains fully in effect throughout this process, and HHS has stated this explicitly on its own Notice of Proposed Rulemaking (NPRM) page.
This status matters practically. Nothing proposed is currently enforceable, and the rule's final form, scope, and timing all remain uncertain. It could be finalized largely as proposed, finalized with significant changes, delayed further, or in theory withdrawn entirely.
Why Are Healthcare Industry Groups Pushing Back?
Healthcare industry groups, led by a coalition including the College of Healthcare Information Management Executives, have pushed back primarily over cost, citing HHS's own projection of approximately 9 billion dollars in year-one implementation costs across the industry, along with concerns that smaller and rural providers could face existential financial pressure trying to comply. More than 100 hospital systems and provider organizations joined a letter urging HHS to withdraw the proposal entirely.
This pushback is worth understanding, not because it means the rule will disappear, but because it signals where the final rule is most likely to change if HHS responds to it. Provisions seen as disproportionately burdensome for smaller organizations are among the more likely candidates for modification before finalization.
What Should Healthcare Organizations Do While the Rule Remains Unfinalized?
Healthcare organizations should begin preparing for the proposal's most likely-to-survive elements now: encryption; multi-factor authentication (MFA); and a tested incident response process capable of meeting a compressed reporting window, rather than waiting for a final rule that could still be more than a year away. Waiting until finalization to begin these changes leaves very little runway once a compliance deadline is actually set.
This does not mean treating every detail of the current proposal as certain. It means prioritizing the changes that address well-documented, recurring OCR findings, since these are the parts of the proposal least likely to be removed regardless of how the rest of the rule evolves.
Proposed HIPAA Security Rule Changes and Current Status
| Proposed Change | What It Would Require | Current Status Consideration |
|---|---|---|
| Eliminate "addressable" safeguards | Nearly all specifications become mandatory, with limited exceptions | Most likely to survive in some form given its role in closing a known compliance gap |
| Mandatory encryption | ePHI encrypted at rest and in transit | Widely expected to remain, aligns with existing best practice |
| Required multi-factor authentication | MFA across systems accessing ePHI | Widely expected to remain, already common in cyber insurance requirements |
| 72-hour incident reporting | Compressed timeline for incident assessment and reporting | Operationally demanding; timeline could be adjusted in final rule |
| Annual penetration testing | Required technical testing on a yearly cadence | Cost-sensitive provision, a likely target for CHIME-led pushback |
| Enhanced business associate oversight | Stronger verification obligations for vendor security practices | Directly addresses a recurring source of healthcare breaches |
What Do Healthcare Organizations Get Wrong About the Proposed Rule?
The most common mistake is waiting for finalization before making any changes, given how far the timeline has already slipped. Organizations that wait risk having very little time to implement genuinely difficult changes, like a 72-hour reporting capability, once a compliance deadline is actually set.
A second common mistake is assuming the proposal will be withdrawn entirely because of industry pushback. While pushback may shape or narrow the final rule, HHS has retained its finalization target throughout the process, and the underlying problems the rule addresses—rising cyberattacks and recurring compliance deficiencies—have not gone away.
A third mistake is treating this as purely a compliance department concern. Several of the proposed requirements, particularly MFA, encryption, and incident response timelines, are technical implementations that require IT leadership involvement well before any compliance deadline arrives.
What the Data Shows About This Rulemaking Process
HHS's Office for Civil Rights published the Notice of Proposed Rulemaking (NPRM) in the Federal Register on January 6, 2025, opening a 60-day comment period that closed March 7, 2025 (HHS Office for Civil Rights, 2025). The rule drew more than 4,000 public comments, with OCR officials later citing approximately 4,745 in remarks at the 42nd National HIPAA Summit.
The College of Healthcare Information Management Executives (CHIME) led a coalition of more than 100 hospital systems and provider organizations in a December 8, 2025 letter urging HHS to withdraw the proposal. The letter cited HHS's own Regulatory Impact Analysis, which projected approximately 9 billion dollars in year-one implementation costs across the industry.
Frequently Asked Questions
Is the HIPAA Security Rule update currently in effect?
No. It remains a proposed rule. The current Security Rule, unchanged, remains fully in effect, and HHS has stated this explicitly on its own website.
When will the final rule be issued?
As of the Fall 2026 Unified Agenda, HHS has targeted July 2027 for final action, though this date has already slipped once from an earlier May 2026 target and could change again.
Will the final rule look exactly like the current proposal?
Not necessarily. Significant industry pushback, particularly around cost for smaller and rural providers, makes some modification to the final rule likely, though the core direction of the proposal is unlikely to disappear entirely.
Should healthcare organizations wait until the rule is finalized to make changes?
No. Several proposed requirements, particularly encryption, multi-factor authentication, and incident response readiness, represent sound practice regardless of the rule's final form and take significant time to implement well.
Does the proposed rule apply to business associates as well as covered entities?
Yes. The proposal includes enhanced oversight obligations specifically addressing business associate security practices, reflecting how often healthcare incidents originate with a vendor rather than the covered entity itself.
Related Reading
- How Much Does a Data Breach Cost a Healthcare Organization in 2026?
- What Fine Print in a Cyber Insurance Policy Can Cause a Healthcare Organization's Claim to Be Denied?
- How Can a Healthcare Organization Know If Its Security Controls Meet Its Cyber Insurance Carrier's Requirements?
- Cybersecurity for Healthcare Organizations
- Request a Free Security Assessment
What to Do Next
If your organization has been waiting for the HIPAA Security Rule update to finalize before addressing encryption, multi-factor authentication, or incident response readiness, the timeline has already shown how much that waiting can cost in lost preparation time.
Request a HIPAA Security Rule readiness assessment from Badger Fortress. We help healthcare organizations prioritize the proposal's most durable requirements now, so a future compliance deadline is a formality, not a scramble.