By Alexis Kennedy, CPA, Partner, and David Friedenberg, Director, Governance, Risk and Compliance Services, Weaver
For the first time in more than a decade, federal regulators have proposed substantive changes to the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. On December 27, 2024, the U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), issued a Notice of Proposed Rulemaking (NPRM) that would significantly change the way health care organizations and their vendors protect electronic protected health information (ePHI).
The proposal was published in the Federal Register on January 6, 2025, and generated substantial industry attention before the public comment period closed on March 7, 2025. More than a year later, health care compliance leaders are still waiting for a final rule. A May 2026 target date came and went without publication, and the rulemaking has since been moved to the federal government’s list of long-term regulatory actions with an updated target date of July 2027.
Here is what the proposal would change, where the rulemaking stands and what health care organizations can do while they wait.
Why OCR is acting now
OCR points to the growing frequency and severity of cyberattacks against the health care sector as a major reason for the proposed changes.
Between 2018 and 2023, reports of large breaches increased 102%, while the number of individuals affected increased 1,002%, driven largely by hacking and ransomware.1 OCR also estimates that only 14% of covered entities and 17% of business associates are conducting risk analyses that comply with the Security Rule.
Technology has also changed significantly since the Security Rule was last substantively updated in 2013. Cloud infrastructure, remote workforces, mobile endpoints, and third-party integrations are now routine parts of health care operations. The NPRM is intended to strengthen the Security Rule to address these and other evolving technology risk considerations.
The core structural change: “Addressable” goes away
The most significant change in the proposal is the elimination of the “addressable” implementation specification category. For two decades, “addressable” has allowed regulated entities to assess whether a safeguard is reasonable and appropriate for their circumstances and, if not, implement an equivalent alternative or document why neither is necessary. In practice, “addressable” has too often been interpreted to mean “optional.”
According to the U.S. Health and Human Services fact sheet, under the NPRM, nearly all specifications would become required, with only specific, limited exceptions. That change would significantly alter the compliance obligations of many regulated organizations.
Key new and strengthened requirements
The proposal names specific technical controls rather than implying them. Highlights include:
- Multi-factor authentication (MFA) for workforce access to ePHI systems, with limited, documented exceptions.
- Encryption of ePHI at rest and in transit, with documented exceptions.
- A written technology asset inventory and network map showing how ePHI flows through the environment, updated at least every 12 months or after a significant change.
- Vulnerability scanning at least every six months and penetration testing at least every 12 months, performed by qualified professionals and scoped to ePHI-touching systems.
- Network segmentation, anti-malware and configuration management as explicit requirements.
- 72-hour restoration objectives for critical systems and data.
- Written documentation of Security Rule policies, procedures, plans and analyses.
- Expanded requirements for business associates, including verification obligations.
Notably, OCR did not carve out small or rural providers. The agency’s position is that strong safeguards are equally important regardless of an organization’s size.
The anticipated timeline
Here is the timeline that matters:
| Milestone | Date |
| NPRM issued by OCR | Dec. 27, 2024 |
| Published in Federal Register | Jan. 6, 2025 |
| Public comment period closed | Mar. 7, 2025 |
| Final rule target (Spring 2025 Regulatory Agenda) | May 2026 |
| Final rule published | Not yet, as of September 2026 |
| Current projected final action | July 2027 |
If the rule is finalized as proposed, it would take effect 60 days after publication in the Federal Register, followed by a 180-day compliance period.
What’s holding it up
Several key factors may be contributing to the delay:
Volume of public comments. OCR received 4,680 comments from providers, payers, business associates, vendors and industry groups. Reviewing that volume of feedback, including conflicting recommendations, takes time and analytical resources.
Opposition from provider organizations. More than 100 hospital systems and provider associations, including Cleveland Clinic, Yale New Haven Health System, Advocate Health, the American Medical Association and the American Academy of Pediatrics, have asked HHS to withdraw the proposal, citing cost, operational burden, and workforce concerns.
Change in administration and regulatory priorities. The NPRM was issued near the end of the Biden administration, leaving the incoming Trump administration to determine how to proceed with the proposal.
Cost and small-provider concerns. The absence of a carve-out for small or rural providers, combined with the proposed technical requirements, could require significant investment. Provider organizations have argued that the costs and operational burden could be particularly difficult for smaller organizations and disproportionate to their risk profiles.
Federal rulemaking timelines. Regulatory agenda dates are targets rather than legally binding deadlines, and proposed rules can take longer to finalize when agencies must address extensive public comments and other policy considerations.
What compliance leaders should do now
While the final rule remains uncertain, many of the controls identified in the NPRM align with areas OCR is already addressing under the existing Security Rule, including risk analysis, asset visibility, ransomware preparedness, vendor oversight and other cybersecurity safeguards.
Practical steps organizations can consider now:
- Review the organization’s current risk analysis and document identified gaps and mitigation strategies.
- Build or update the technology asset inventory and ePHI network diagrams and data flows.
- Evaluate the use of MFA for workforce access to ePHI systems.
- Review encryption practices for ePHI, including email, endpoints and backups.
- Formalize vulnerability scanning and annual penetration testing practices.
- Enhance business associate oversight and documentation.
- Document decisions, exceptions and control operations.
The bottom line
The proposed changes to the HIPAA Security Rule would significantly expand cybersecurity requirements for organizations that handle ePHI. Although the timing and final form of the rule remain uncertain, health care organizations can use this period to evaluate their current security practices, identify gaps and prepare for requirements that may become more prescriptive.