Regulatory update · Notice of Proposed Rulemaking
The 2026 HIPAA Security Rule: what is actually in effect, what remains proposed, and what practices should do now.
In January 2025, OCR proposed the most significant modernization of the HIPAA Security Rule since 2003 (90 FR 898). It has not been finalized.The current Security Rule remains in effect and fully enforceable. HHS’s Unified Agenda currently places the proposal (RIN 0945-AA22) in Long-Term Actions with July 2027 listed as an agency planning estimate for possible final action — not a binding deadline. This page separates what HIPAA requires today, what the January 2025 NPRM would change, and what Patient Protect believes practices should do regardless of how the rulemaking lands.
The proposed change
What “addressable” means today — and what the January 2025 NPRM would change.
Since the Security Rule was adopted in 2003, implementation specifications have been classified as either “required” or “addressable.” Required means you must implement it. Addressable means you must assess whether it is reasonable and appropriate — and if you determine it is not, you can implement an equivalent alternative measure, or document why neither is necessary.
In practice, addressable has too often functioned as optional. Practices documented that encryption was too expensive, that MFA was too disruptive, that penetration testing was unnecessary for their size. Auditors sometimes accepted those justifications. The gap between what the Security Rule intended and what practices actually implemented grew wider every year.
If finalized, the January 2025 NPRM would remove the required/addressable distinction and make implementation specifications required, subject to specific limited exceptions. The proposal has not been finalized and the current Security Rule remains in effect. Regardless of when or whether the NPRM lands, Patient Protect’s position is that the documentation-as-defense era is functionally over: what matters operationally is whether the control is implemented and evidenced.
If finalized, the proposal would apply to every covered entity and Business Associate — regardless of size.
The NPRM does not contain a small-practice exemption. Under the current Security Rule, a solo dentist and a hospital system are already both covered entities subject to the same rule; the practical difference is that the hospital has a CISO, a security team, and a seven-figure compliance budget. Most independent practices have none of those things — which is why any tightening of the Security Rule tends to hit them hardest.
Six proposed mandates
Current Security Rule vs. the January 2025 NPRM.
Six major provisions the January 2025 NPRM would change if finalized. For each, the “Current rule” column reflects what HIPAA requires today; the “NPRM proposes” column reflects what would change if the proposal is finalized in its current form. Where the proposal is silent on a specific technical detail (algorithm choices, exact review cadence), Patient Protect standards are labeled as such below.
Encryption of ePHI
Current: §164.312(a)(2)(iv), §164.312(e)(2)(ii) / NPRM: 90 FR 898
Would require encryption of ePHI at rest and in transit, subject to limited exceptions
Current rule (in effect today)
The current Security Rule classifies encryption at rest (§164.312(a)(2)(iv)) and in transit (§164.312(e)(2)(ii)) as “addressable” implementation specifications: implement it, implement an equivalent alternative, or document why neither is reasonable and appropriate.
NPRM proposes (not yet law)
The NPRM would remove the required/addressable distinction and require encryption of ePHI at rest and in transit, subject to limited exceptions. Specific algorithm choices (e.g. AES-256, TLS 1.3) are Patient Protect standards; the NPRM does not name specific ciphers.
Multi-factor authentication for ePHI access
Current: §164.312(a)(1), §164.312(d) / NPRM: 90 FR 898
Would require multi-factor authentication, subject to limited exceptions
Current rule (in effect today)
The current Security Rule does not explicitly require multi-factor authentication. Access control (§164.312(a)(1)) and person or entity authentication (§164.312(d)) are required standards, but the implementation specifications leave the mechanism open.
NPRM proposes (not yet law)
The NPRM would require multi-factor authentication for access to ePHI, subject to limited exceptions. Patient Protect treats MFA as a baseline security control today, regardless of when the rule finalizes.
Vulnerability scanning and penetration testing
Current: §164.308(a)(8) / NPRM: 90 FR 898
Would require vulnerability scanning and penetration testing on defined cadence
Current rule (in effect today)
The current Security Rule requires periodic technical and non-technical evaluation (§164.308(a)(8)) but does not prescribe a specific vulnerability-scanning or penetration-testing frequency. Most independent practices have never conducted either.
NPRM proposes (not yet law)
The NPRM would require vulnerability scanning and penetration testing on defined cadence, with documented results and remediation. Verify actual proposed frequencies against the current NPRM text before designing your program around a specific interval.
Technology asset inventory and network map
Current: §164.308(a)(1)(ii)(A) / NPRM: 90 FR 898
Would require a written technology asset inventory and network map with defined review cadence
Current rule (in effect today)
The current Security Rule requires accurate and thorough risk analysis (§164.308(a)(1)(ii)(A)) but does not separately require a formal asset inventory or network map.
NPRM proposes (not yet law)
The NPRM would require a written technology asset inventory and network map covering systems that create, receive, maintain, or transmit ePHI, with review on a defined cadence.
Business Associate technical verification
Current: §164.314(a)(1)–(2) / NPRM: 90 FR 898
Would strengthen expectations that covered entities verify BA safeguards, not just contract for them
Current rule (in effect today)
The current Security Rule requires covered entities to obtain satisfactory assurances that a business associate will appropriately safeguard ePHI (§164.314(a)(1)–(2)). Historically, a signed BAA has been treated as sufficient assurance.
NPRM proposes (not yet law)
The NPRM would strengthen the assurance framework, moving from contractual attestation toward verified evidence that a business associate actually implements the safeguards specified. Verify the exact obligations against the proposed regulatory text before designing internal audit procedures.
72-hour system restoration capability
Current: §164.308(a)(7) / NPRM: 90 FR 898
Would require capability to restore certain relevant electronic information systems and data within 72 hours
Current rule (in effect today)
The current Security Rule requires a documented contingency plan (§164.308(a)(7)) without a specific restoration time target.
NPRM proposes (not yet law)
The NPRM would require the capability to restore the loss of certain relevant electronic information systems and data within 72 hours, subject to specified conditions. This is a restoration/recovery obligation — NOT a change to the HHS breach notification deadline, which remains 60 calendar days after discovery for breaches of 500+ (§164.408).
Patient Protect standard · What to do regardless
Six steps every practice should take now — whether or not the NPRM finalizes.
These are Patient Protect recommendations, not current HIPAA mandates. The current Security Rule sets a floor; independent-practice threat exposure has moved well past that floor. Regardless of what the January 2025 NPRM ultimately requires, these controls are the operational baseline responsible practices should already be building toward.
Verify encryption
Confirm AES-256 encryption is active on every system storing or transmitting ePHI — EHR, email, backups, cloud storage. If it's not, enable it or replace the system.
2Implement MFA
Enable multi-factor authentication on every account with ePHI access. Start with EHR and email. Eliminate shared credentials entirely.
3Inventory your assets
Document every device, application, and system that touches patient data. Map how ePHI flows between them. Our free ePHI Flow Mapper does this in 15 minutes.
4Audit your vendors
Review every Business Associate Agreement. Verify — don't just trust — that your vendors implement the technical safeguards they promised.
5Schedule your first pen test
Engage a qualified security firm for a penetration test. Plan for annual recurrence. Document results and remediation actions.
6Update your incident response plan
Document your restoration capability — the NPRM would require restoring certain relevant electronic information systems and data within 72 hours. HIPAA breach notification to HHS remains 60 calendar days after discovery for breaches of 500+ (§164.408). Train your team on both timelines and rehearse the plan.
Patient Protect standard
We built for the direction Security Rule modernization is heading — before the NPRM was written.
Patient Protect’s platform was designed around modern healthcare security controls — the same set of controls the January 2025 NPRM would elevate to explicit requirements if finalized. Every mandate below is already operational as our own standard. Whether you use Patient Protect alongside your existing compliance partner or as a standalone platform, these controls are ready today.
Encryption
ePHI encrypted at rest and in transit.
Multi-factor authentication
Multi-factor authentication available and used; each workforce member has their own credential.
Penetration testing
Independent vulnerability scanning and penetration testing of the production environment on defined cadence; scope, environment, and result summaries documented internally.
Audit logging
Per-session ePHI access logs, attributable, timestamped and access-controlled.
BA verification
Vendor Risk Scanner tracks BAA status and documented vendor safeguards. Vendors self-attest during onboarding; the platform surfaces gaps and lapses in real time.
Asset inventory
ePHI Data Flow Mapper + technology asset tracking built into the compliance engine.
Resources
Go deeper.
Blog
What the HIPAA Security Amendments Mean for Your Practice
Full analysis of every proposed change with practice-level action items.
Regulatory tracker
All HIPAA Regulatory Updates
Track proposed rules, final rules, and enforcement guidance as they develop.
Free tool
HIPAA Risk Assessment
See where your practice stands against the new requirements — 10 minutes, no login.
Free training
Security Rule training for the workforce
Video + companion content on ePHI, safeguards, and the Security Risk Analysis.
Related references
Continue across the regulation library.
Three companion pages for HIPAA regulatory work — high-level tracker, provision-level map, and the 2026 Security Rule deep dive. Each links to the others for navigation.
Live tracker
Regulatory updates
Active and proposed federal rules, ranked by practice impact, with OCR enforcement and guidance tracked alongside them.
Open
Provision map
Regulation map
Look up what a Security, Privacy or Breach Notification provision covers, by citation, and where to go next. Provisions the proposed Security Rule would change are flagged as proposed.
Open
This page reflects the HIPAA Security Rule amendments as proposed in the January 6, 2025 NPRM, published at 90 FR 898. No final rule has been issued; the current Security Rule remains in effect. The Unified Agenda entry for RIN 0945-AA22 places the proposal in Long-Term Actions with July 2027 given as the agency’s planning timetable for possible final action. That is an agenda estimate, not a legal deadline, a promised publication date, or an effective date. Final rule text may differ from the proposal. Patient Protect will update this page as the rulemaking progresses. This is not legal advice — consult a qualified HIPAA compliance professional for guidance specific to your practice.