Where things stand

In January 2025, the HHS Office for Civil Rights published a proposed rule to update the HIPAA Security Rule, which has protected electronic protected health information (ePHI) since 2003. HHS had targeted a final rule for May 2026, but the federal regulatory agenda now lists the final rule for July 2027.

The proposal is not law yet, and the final version may change. The direction is clear, though: fewer optional safeguards and more specific, verifiable requirements.

What the proposed rule would require

  • No more "addressable" safeguards. Today some specifications are addressable, meaning an organization can document why it chose an alternative. The proposal would make them required, with limited, documented exceptions.
  • Encryption. ePHI would have to be encrypted at rest and in transit.
  • Multi-factor authentication. MFA would become a requirement rather than an option.
  • Asset inventory and network map. Organizations would maintain a written inventory of technology assets and a map of how ePHI moves, reviewed at least every 12 months and whenever something significant changes.
  • 72-hour restoration. Written procedures to restore certain systems and data within 72 hours of a loss.
  • Regular testing. Vulnerability scans at least every six months, penetration tests at least every 12 months, and an internal compliance audit at least every 12 months.
  • Business associate verification. Business associates would confirm in writing, at least every 12 months, that required technical safeguards are in place.

Why act before the final rule

Almost every item above is something an attacker would exploit if it were missing. Ransomware groups target healthcare because downtime is so costly, and insurers already ask about MFA, backups and endpoint protection before writing policies. Doing this work now lowers your risk today and makes compliance with the final rule a much smaller project.

A practical starting list

  1. Update your risk analysis. It is required today and is the foundation for everything else.
  2. Turn on MFA everywhere, starting with email, remote access and your EHR.
  3. Confirm encryption on laptops, mobile devices, backups and email containing ePHI.
  4. Build your asset inventory and network map. You cannot protect what you have not documented.
  5. Test a restore. Time how long it takes to bring a critical system back. If it is longer than 72 hours, plan to fix that.
  6. Review your business associate agreements and ask key vendors how they protect your data.

How Strong Connexions helps

Our standard already includes MFA, encryption, endpoint protection, tested backups and documented configurations for every client. For healthcare organizations, we add the Security Rule risk analysis, policies and procedures, and evidence to show the safeguards are working. See our HIPAA services.

This article is general information, not legal advice. Requirements change; contact us for guidance on your situation.