The Patient Protect Readiness Index (PPRI)

Authored by Alexander Perrin, CEO, Patient Protect. Author of The Economics of ePHI Exposure (SSRN 5257628) and The Cyber-Economic Stack (SSRN 5792382).

Technically reviewed by Joseph Perrin, CTO, Patient Protect.

Compliance reviewed by Angie Perrin, CCSO, Patient Protect (RDH, CHPC).

Last reviewed: May 13, 2026. Next review: August 13, 2026. Corrections welcome at research@patient-protect.com.

Key findings

• The useful question when comparing platforms is proportion: how much of the program a system actually carries, and how much still rests on somebody remembering. Every product in this category has some of each.
• The proposed Security Rule (RIN 0945-AA22) would narrow the addressable/required distinction substantially. It has not been finalized. The Spring 2025 Unified Agenda targeted May 2026; that date has passed without a final rule, which is worth knowing when a vendor tells you the deadline is imminent.
• What is not speculative is OCR's enforcement record, which has concentrated on risk analysis that was never revisited rather than risk analysis that was never done.
• This post sets out the Patient Protect Readiness Index (PPRI) — 24 points across eight criteria. Score whatever you are evaluating, including us.
• Nothing here scores a competitor for you. It gives you the questions; you run them at the demo.

What you are really choosing between

Most "best HIPAA compliance software" lists rank products. This one does not, because a ranking assumes your constraints match the reviewer's, and in this market they usually do not.

A note on the regulatory backdrop, since every vendor now sells against it. HHS published an NPRM in January 2025 (RIN 0945-AA22) proposing the first major Security Rule update in two decades — multi-factor authentication, asset inventories, network segmentation, tighter vendor notification. The Spring 2025 Unified Agenda targeted May 2026 for finalization. That date has passed and no final rule has issued. Treat any pitch built on an imminent deadline accordingly, and ask the vendor to name the citation.

That is the split worth measuring. Policy libraries, SRA wizards, BAA trackers and training portals record what a practice intends and what it has done. Technical controls decide what the system permits. Every product in this category carries some of each, and the useful question at a demo is the proportion — not which noun the vendor uses for itself.

Products differ in that proportion, and the difference is not visible from a feature list — a policy library and a technical control both appear as a row called "access management". You find out which you are buying by asking what happens when the control is violated: does the system record that it should not have happened, or does it prevent it? Both are legitimate purchases. Only one survives the person who was supposed to be watching.

So you are making a proportion decision first and a product decision second.

The 2026 reality check

Before the framework, a quick grounding on what is actually changing.

What is already in effect. The HIPAA/Part 2 alignment Final Rule was published February 8, 2024, took effect April 16, 2024, and required full compliance by February 16, 2026. If your Notice of Privacy Practices was not updated for the new patient rights language, that deadline has already passed. The current Security Rule — the one from 2003, with minor 2013 amendments — is still the operative law.

What is pending. The Security Rule NPRM was published in the Federal Register on January 6, 2025 (90 FR 898). OCR's Spring 2025 Unified Agenda lists May 2026 as the target for a final rule. From publication, regulated entities get 60 days until effective date and 180 days after that until compliance is mandatory — 240 days total.

What is uncertain. OCR received thousands of public comments. The current administration has not confirmed it will proceed on the original timeline or scope. Industry pushback has been substantial. The final rule could be slimmed, delayed, or — in the most aggressive scenario — withdrawn and reissued.

What is certain regardless of timing. OCR has formally expanded its enforcement initiative to include risk management — what organizations actually do about risk — not just risk analysis. Industry observers note that the NPRM has already drawn attention to the need for better compliance across the sector, whether or not it is finalized as written.

The worst place to be is the one most legacy compliance platforms put their customers in: confidently "compliant" against the 2003 rule, structurally unprepared for anything more demanding. The right question is not will the rule land in May. It is will the platform we pick still be the right one in eighteen months.

What the data says: the upstream BA problem

In our State of Compliance Q1 2026 report — published by the Secure Care Research Institute under Patient Protect LLC — analysis of HHS OCR breach disclosures identified upstream business associate aggregation as the dominant pattern of catastrophic ePHI exposure: a small number of upstream vendors aggregating data from hundreds of downstream covered entities, then becoming single points of failure when breached. Four upstream incidents accounted for 67.6% of all individuals affected in Q1 2026, across just 1.9% of the period's incident count.

This is the dynamic behind the largest healthcare breaches of the last cycle. It is also the dynamic the 2026 NPRM is built to address. The proposed expansion of business associate oversight under 45 CFR 164.308(a)(8) — annual compliance attestation by BAs to covered entities, 24-hour cross-entity notification on contingency plan activation, written verification of BA security controls — maps directly to the aggregation failure mode.

The implication for platform selection: any HIPAA compliance software that treats the BAA as a stored document, rather than as the spine of a continuously-managed BA oversight workflow, is selling you a 2003 product in a 2026 market.

The Patient Protect Readiness Index (PPRI)

The Patient Protect Readiness Index is our framework. We wrote it, we publish it, and we sell a product it scores. It is not an independent certification, not a government standard, not an industry consensus and not externally validated — it is a vendor rubric, and you should read it with the scepticism that deserves.

What makes it usable anyway is that the scoring rules are all here. Eight criteria, each scored 0–3, each tied to a provision of the proposed Security Rule or to OCR's enforcement record. You can apply it yourself, disagree with a score, or throw out a criterion that does not matter to your practice. A rubric you can reproduce is worth more than a verdict you have to trust.

Each criterion is scored 0–3:

Score	Definition
0	Not addressed. The platform has no functionality covering this criterion.
1	Documented only. A policy or attestation exists; no system-level enforcement.
2	Partially enforced. Some system controls present; manual or procedural gaps remain.
3	Fully enforced. System-level, continuous, auditable. The platform performs the control.

Total score interpretation:

Score	Tier	Meaning
19–24	Enforcement Tier	The platform already performs the security work the proposed rule would require. Readiness for a proposal, not compliance with a rule.
13–18	Transitional Tier	Material gaps against the proposal. If it is finalized broadly as written, this is remediation work.
0–12	Documentation Tier	The product mostly records intent and activity. That is a real job and some practices need no more than it; know that it is what you are buying.

The PPRI is designed to be applied to any HIPAA compliance platform — including Patient Protect. The point is not to score competitors. The point is to give buyers a verifiable, repeatable evaluation method that does not depend on vendor marketing.

The eight criteria

1. MFA enforcement at the system level

What the proposed rule would require. Under proposed 45 CFR 164.312, multi-factor authentication is required for all access to relevant electronic information systems handling ePHI. "MFA-enabled" is not the same as "MFA-enforced."

Documentation Tier behavior (score 1). Policy exists stating MFA is required. The platform tracks acknowledgments. It cannot tell you whether MFA is actually live across your stack.

Enforcement Tier behavior (score 3). The platform enforces MFA on its own access and produces real-time reports of which workforce members logged in with a second factor. Login without MFA is blocked, logged, and alerted.

Verification question. Show me what happens, on screen, when a workforce member tries to log in without MFA. If the answer is "we would note it in the audit log," that is documentation. If the answer is "the login is blocked, the attempt is logged, the security officer is alerted," that is enforcement.

2. Encryption verifiable end-to-end

What the proposed rule would require. Encryption of ePHI at rest and in transit, with the previous "addressable" status removed. The proposal effectively makes encryption a default requirement with narrow, well-justified exceptions.

Documentation Tier behavior (score 1). A policy attests that ePHI is encrypted. The attestation is signed annually.

Enforcement Tier behavior (score 3). Every piece of ePHI is encrypted using current-standard ciphers (AES-256-GCM or equivalent), all connections terminate TLS 1.3, and the platform can produce evidence of both — specific cipher suites, key rotation policy, verification chain from data-at-rest back to documented control.

Verification question. Show me the encryption stack diagram and current key rotation status. A sentence in a policy = documentation. An architecture diagram with named ciphers, key management procedures, and TLS configuration = enforcement.

3. Live asset inventory and data flow mapping

What the proposed rule would require. Proposed 45 CFR 164.308 requires a written inventory of technology assets that create, receive, maintain, or transmit ePHI, plus a network map showing ePHI movement. Annual review minimum; more often after material changes.

Documentation Tier behavior (score 1). A spreadsheet template the customer fills in once. Goes stale immediately.

Enforcement Tier behavior (score 3). A continuously-updated registry of every system, endpoint, integration, and data flow touching ePHI. New connections detected and surfaced. The data flow map is generated from actual system state.

Verification question. Show me the asset inventory 90 days after deployment. Identical to day one = documentation. Reflects actual changes — new devices, new integrations, decommissioned systems — = enforcement.

4. Network segmentation enforced architecturally

What the proposed rule would require. The 2026 NPRM moves network segmentation from implicit best practice to explicit technical safeguard at 45 CFR 164.312, with language requiring procedures to segment ePHI to limit access and prevent lateral movement by intruders.

Documentation Tier behavior (score 1). Segmentation policy stored. Whether segmentation exists in the customer's actual network is unknown to the platform.

Enforcement Tier behavior (score 3). The platform enforces segmentation within its own architecture (separating ePHI workflows, communications, and storage from non-ePHI workflows) or integrates with network controls to verify segmentation status. Cross-segment access triggers alerts.

Verification question. How does the platform itself segment ePHI from non-ePHI? An answer about the customer's network = documentation. An answer describing the platform's architectural separation — for example, ePHI messaging gated behind an active Business Associate Agreement flag — = enforcement.

5. Workforce access lifecycle

What the proposed rule would require. Proposed termination of access to ePHI as soon as possible, but no later than one hour after a workforce member's relationship with the regulated entity ends. Notification to other regulated entities within 24 hours.

Documentation Tier behavior (score 1). Termination is a checklist. HR notifies the security officer. Manual revocation across systems. The audit log captures policy adherence; whether timing met the one-hour bar depends on whoever was at the keyboard.

Enforcement Tier behavior (score 3). Termination is a workflow. Role change automatically revokes credentials, invalidates active sessions, and produces timestamped revocation evidence across every system the platform controls. Downstream notifications automated.

Verification question. Show me the elapsed time from "mark terminated" to "all access revoked." Hours or days = documentation. Seconds = enforcement.

6. Continuous risk management

What the proposed rule would require. OCR's existing enforcement initiative — already in force, regardless of the NPRM's fate — has expanded to include risk management, not just risk analysis. The bar is a living program, not an annual deliverable.

Documentation Tier behavior (score 1). The SRA is a project. Annual delivery. Risks identified are tracked in a parallel spreadsheet that ages between cycles.

Enforcement Tier behavior (score 3). Risk analysis runs continuously. New vulnerabilities, configuration drift, control failures, and security events feed back into the risk register. Mitigations have owners, deadlines, and tracked closure. The output is not a document; it is a state.

Verification question. Show me the risk register the day before and the day after a new vendor onboards. Identical until next annual cycle = documentation. New entry, triggered BAA workflow, updated data flow map = enforcement.

7. Business associate oversight and annual attestation

What the proposed rule would require. Proposed 45 CFR 164.308(a)(8) requires business associates to verify their compliance status to covered entities annually and notify within 24 hours of contingency plan activation. Covered entities must, in turn, validate that BAs are meeting obligations. This is the regulatory response to the upstream BA aggregation pattern documented above.

Documentation Tier behavior (score 1). The platform stores executed BAAs. Verifying BA compliance is the customer's problem.

Enforcement Tier behavior (score 3). The platform manages the full BAA lifecycle — first-party and third-party BAAs, with mode transitions from staging through pending to active, gating ePHI-related features (like secure messaging) until the BAA is in place. Annual attestation requests issue automatically; non-responses flag.

Verification question. What happens 365 days after a BAA is executed? Document still in a folder = documentation. New attestation request generated, sent, tracked = enforcement.

8. Audit trail integrity and 24-hour breach response

What the proposed rule would require. Proposed 24-hour cross-entity notification, expanded breach response workflow, and audit logs that survive scrutiny under enforcement examination.

Documentation Tier behavior (score 1). Activity logs sit in the same database as everything else. Administrator-modifiable. Evidentiary value questionable in a breach response.

Enforcement Tier behavior (score 3). Audit logs write to tamper-evident storage. Activity is monitored continuously by an application-layer detection system that flags suspicious behavior in real time. Breach response is a workflow with assigned roles, communication templates, and a 24-hour clock from detection.

Verification question. Can an administrator edit a historical audit log entry? "Yes, with elevated permissions" = documentation. "No, the logs are append-only and integrity-checked" = enforcement.

The PPRI at a glance

#	Criterion	Documentation Tier (Score 1)	Enforcement Tier (Score 3)	NPRM / OCR Reference
1	MFA Enforcement	Policy stored; system optional	System blocks non-MFA logins, logs attempts	Proposed 45 CFR 164.312
2	Encryption	Annual attestation	AES-256-GCM at rest, TLS 1.3 in transit, evidence chain	Proposed 45 CFR 164.312 (mandatory)
3	Asset Inventory	Static spreadsheet	Live registry, drift detection	Proposed 45 CFR 164.308
4	Segmentation	Policy stored	Architectural separation enforced, alerts on lateral access	Proposed 45 CFR 164.312
5	Workforce Access	Manual checklist; hours-to-days revocation	Automated revocation in seconds	Proposed one-hour access termination
6	Risk Management	Annual SRA project	Continuous, event-driven risk register	OCR risk-management enforcement expansion
7	BA Oversight	BAA stored	Lifecycle workflow, annual attestation, ePHI feature gating	Proposed 45 CFR 164.308(a)(8)
8	Audit & Breach Response	Mutable logs, manual incident response	Tamper-evident logs, automated detection, 24-hour breach workflow	Proposed 24-hour cross-entity notification

How Patient Protect scores on its own framework

A framework published by a vendor is worth nothing unless the vendor scores itself with it and publishes the losses. Patient Protect scores 21 out of 24, with three gaps named below.

#	Criterion	Score	Notes
1	MFA Enforcement	3/3	Second-factor authentication is enforced on login rather than offered as a toggle, with lockout after repeated failures.
2	Encryption	3/3	ePHI encrypted at rest and in transit.
3	Asset Inventory	2/3	A register of the systems a practice records. Honest gap: it cannot discover anything. Systems appear because someone entered them, so shadow IT stays invisible until a person notices it.
4	Segmentation	3/3	ePHI workflows architecturally separated from non-ePHI, gated behind active BAA flags. Cross-segment access logged and alerted.
5	Workforce Access	2/3	Access within Patient Protect is revoked when a workforce member is offboarded in it. Honest gap: everywhere else — the M365 tenant, the EHR, the practice management system — remains a manual checklist. We do not connect to those systems and cannot revoke anything in them.
6	Risk Management	3/3	Findings reopen against recorded changes — a new vendor, a workforce change — instead of waiting for an annual cycle.
7	BA Oversight	3/3	Six-state agreement lifecycle, with ePHI messaging gated on active state — without a current agreement the exchange is blocked rather than flagged.
8	Audit & Breach Response	2/3	Event log holding Resolved and Reported as separate fields, with Time Occurred distinct from Time of Action so the notification clock has a real date. AppSensor detects anomalous behavior inside the Patient Protect application. Honest gap: we do not claim tamper-evident storage, because that needs storage-layer evidence we have not published.

Total: 21/24. Three of the eight are honest 2s, and the third was a 3 until this page was audited — a tamper-evidence claim came out because we could not evidence it. A framework whose author scores himself down when the evidence is missing is worth more than one that returns 24/24.

The two 2/3 scores reflect a real limitation worth naming: any compliance platform's enforcement reach ends at its perimeter. Inside that perimeter, Patient Protect performs. Outside it, we depend on customer practice and integration. That is true of every platform in this category; pretending otherwise is what produces 24/24 self-scores that look like marketing copy.

The Patient Protect onboarding is built around the in-perimeter behavior this scoring describes: role-based access, agreement lifecycle activation, a Compliance Scoreboard reflecting recorded state, and the risk analysis as something you revisit rather than reproduce. What the first hour actually looks like is written up separately.

Self-score reflects platform architecture as of August 2026, revised down from 22 during audit when a tamper-evidence claim could not be evidenced. Dispute any score at research@patient-protect.com.

Should you switch?

Usually not, and a buyer's guide that concludes otherwise should be read with suspicion — including this one. Switching costs are real, and a platform your staff actually uses beats a better platform they abandon. Three questions worth asking before you consider it.

One — what would change if the rule is finalized? Put it to your current vendor and listen for specificity rather than for a category. "We would update templates and add training" and "we would change how the platform enforces X" are both real answers; which one you need depends on what you were buying it for. What should worry you is a vendor who cannot say, or who tells you the rule is already in force.

Two — what evidence you can produce today. Score your current platform against the PPRI and read the result as a description, not a verdict. We have not surveyed the market and will not tell you where any vendor lands; run the eight questions at your own demo.

Three — what your blast radius looks like. OCR's expanded enforcement focus on risk management, combined with the inflation-adjusted civil monetary penalties — which now range into seven figures per violation category at the willful-neglect-uncorrected tier — means the cost of being structurally unprepared has gone up significantly. A breach today triggers OCR enforcement, state attorney general action, class action litigation, and — for boards — Caremark-doctrine liability questions. The "we have a compliance platform" defense holds up only if the platform actually does what its category claims.

A low score is information, not an instruction. It tells you which of the eight your current tool leaves to a person, which is worth knowing whether or not you ever switch — and if you do, the harder problem is carrying your existing evidence across, not choosing a replacement.

The next 90 days

If you have read this far, you already know what to do.

Week 1. Score your current platform on the PPRI. Document each verification question's answer. Note where the platform documents versus enforces.

Weeks 2–3. Inventory the controls the NPRM treats as mandatory that are not currently enforced anywhere in your stack. MFA universality, asset inventory currency, segmentation status, workforce access termination timing — these are the four that catch most organizations.

Weeks 4–6. If you have decided to switch platforms, run a focused proof of concept with at least one Enforcement Tier option. Bring the eight verification questions to the demo. Refuse to accept "we will have that in the roadmap" as an answer for anything in the NPRM.

Weeks 7–12. Migrate. The right time to make this transition is before the final rule drops, because the moment it does, every vendor in the market will be re-marketing as 2026-ready and every buyer will be in the same procurement queue.

The HIPAA compliance software market is splitting. The platforms that win the next decade are the ones built for the rule that is coming, not the rule that was written before the iPhone existed. The best HIPAA compliance software for 2026 is the one your security officer would still defend in an OCR audit two years from now.

Apply the PPRI to your evaluation

Print this page or copy the framework into your notes. Bring the eight verification questions to every vendor demo you take — including Patient Protect's. The eight questions are the post; no separate scorecard needed.

See how Patient Protect's onboarding stands up the security stack from day one →

Not ready to evaluate a full platform yet? Run our free Unified Risk Assessment to see where your practice actually stands today — no credit card, no account.

Definitions

HIPAA compliance software — A platform used by HIPAA-regulated entities (covered entities and business associates) to manage the policies, procedures, technical controls, workforce training, business associate agreements, and audit evidence required by the HIPAA Privacy, Security, and Breach Notification Rules.

Documentation Tier platform — A HIPAA compliance platform whose primary deliverable is documentation: policies, attestations, training logs, BAA repositories. The security work it describes happens in other systems. PPRI score range: 0–12.

Enforcement Tier platform — A HIPAA compliance platform that performs the security controls the regulation requires — MFA enforcement, encryption, access lifecycle, audit integrity — directly within its own architecture, producing evidence as a byproduct of operation. PPRI score range: 19–24.

Patient Protect Readiness Index (PPRI) — A 24-point evaluation framework for HIPAA compliance platforms in the 2026 Security Rule era, scoring eight criteria from 0 (not addressed) to 3 (fully enforced).

2026 HIPAA Security Rule — The proposed update to the HIPAA Security Rule, published as an NPRM in the Federal Register on January 6, 2025 (90 FR 898), targeting May 2026 for finalization. The first major update since 2003.

Upstream BA aggregation — A breach pattern in which a small number of upstream business associates aggregate ePHI from many downstream covered entities, then become single points of catastrophic exposure when breached. Documented as the dominant exposure pattern in the State of Compliance Q1 2026 report.

FAQ

When does the new HIPAA Security Rule take effect?

OCR's Spring 2025 Unified Agenda targets May 2026 for finalization. Once the final rule is published in the Federal Register, regulated entities have 60 days to the effective date and another 180 days to the compliance date — 240 days total. The timeline could shift; the current administration has not confirmed it will proceed on the original schedule.

What is the best HIPAA compliance software?

An Enforcement Tier platform — one that scores 19 or higher on the Patient Protect Readiness Index. It enforces MFA, encrypts ePHI verifiably end-to-end, maintains a live asset inventory, enforces segmentation, automates workforce access lifecycle, runs continuous risk management, manages full BAA lifecycle with annual attestation, and writes audit logs to tamper-evident storage. Patient Protect scores 22/24 on its own framework, with two acknowledged gaps disclosed in the post.

How much of a compliance program should run in software?

Documentation — policies, attestations, training logs — records what should happen. Technical controls determine what does. Both are required, and a product mixes them in some proportion rather than belonging to a category. Under the proposed 2026 rule, most implementation specifications become mandatory and prescriptive — describing a control is no longer the same as having it.

Is my current HIPAA compliance software still valid?

Yes, for the rule as it stands today. The 2003 Security Rule is still operative. The question is whether your platform will still be sufficient when the new rule lands, and whether it meets OCR's current enforcement focus on continuous risk management, which is already in force.

Do I need to replace my compliance platform before the final rule is published?

You do not need to. Waiting until publication means competing for procurement attention with every other regulated entity in the country, and discovering structural gaps under time pressure. Organizations that have run the PPRI on their current platform have generally decided to move earlier rather than later.

How long does Enforcement Tier onboarding take?

A typical Patient Protect onboarding for an independent provider stands up the core security stack — RBAC, MFA, BAA lifecycle, SRA, event logging — within the first hour of platform access, with the full Compliance Scoreboard active from day one. Larger organizations take proportionally longer; the architecture is built for the platform to do the work, not the customer.

What if the final rule gets watered down?

The direction of OCR enforcement is set regardless. Addressable specifications remain addressable, and a practice that assesses one and documents why it chose an alternative has complied. What the enforcement record does show is that few practices can produce that documentation, which is a different problem and the one worth solving. A slimmed final rule would defer some prescriptive language but would not reverse the trajectory. Platforms architected for the documentation tier will fall further behind enforcement expectations either way.

How is the Patient Protect Readiness Index different from other HIPAA compliance scoring tools?

The PPRI scores platforms against the 2026 enforcement direction, not the 2003 rule. It distinguishes between documenting a control and performing it — the distinction the NPRM is built around. It is applied uniformly, including to Patient Protect itself (with acknowledged gaps), and the verification questions are designed to be answered on-screen during a vendor demo, not from marketing materials.