HIPAA Security Rule Modernisation (Proposed Rule)

HHS proposal to remove the addressable/required distinction, mandate MFA, encryption, asset inventories, network segmentation, annual audits and 72-hour restoration plans for ePHI. Final rule now projected for July 2027.

Analysis

The HIPAA Security Rule Modernisation you describe corresponds to the HIPAA Security Rule NPRM (“To Strengthen the Cybersecurity of Electronic Protected Health Information”) issued December 27, 2024 and published January 6, 2025; it is not yet final, and the current HIPAA Security Rule remains in effect until HHS/OCR publishes a final rule in the Federal Register.HIPAA Security Rule NPRM – HHS HHS HIPAA Regulatory Initiatives Summary of the HIPAA Security Rule – HHS

Where your description aligns with the NPRM (mandatory encryption, MFA, asset inventories, network mapping, enhanced contingency planning), I treat those as proposed requirements, not yet binding. Where your description diverges (e.g., a July 2027 final rule projection), I note this as speculative, because official sources currently show an earlier projected final action date in the Unified Agenda.Reginfo.gov Unified Agenda – Security Rule (RIN 0945-AA22) Federal Register NPRM – HIPAA Security Rule Cybersecurity

Key Requirements (as described in the NPRM)

Below are the main proposed requirements, each tied to primary HHS/OCR or Federal Register sources. Until finalized, they are proposed obligations, but they are highly indicative of the compliance direction for covered entities and business associates.

1. Removal of “addressable vs. required” distinction for key safeguards

• Proposal: Certain security measures that are currently “addressable” under the HIPAA Security Rule would become explicitly required, tightening flexibility around core safeguards such as encryption and certain technical controls.Federal Register NPRM Text (Regulations.gov HTML) HIPAA Security Rule NPRM – HHS Fact Sheet
• The existing Security Rule uses “required” and “addressable” implementation specifications under 45 CFR 164.308, 164.310, and 164.312; entities can adopt alternative controls for addressable specs if reasonable and appropriate.Summary of the HIPAA Security Rule – HHS Security Rule – HHS Overview
• The NPRM’s objective is to reduce discretion on core cybersecurity controls given modern threat conditions, using more prescriptive language for certain technical safeguards while retaining risk-based flexibility elsewhere.HIPAA Security Rule NPRM – HHS HHS Regulatory Initiatives – HIPAA Security Rule NPRM

2. Mandatory multi‑factor authentication (MFA) for systems accessing ePHI

• Proposal: The NPRM would effectively require multi‑factor authentication for access to systems containing or processing electronic protected health information (ePHI), with limited exceptions and documented compensating controls where MFA is technically infeasible.HIPAA Security Rule NPRM Fact Sheet – HHS HIPAA Updates and HIPAA Changes in 2026 – HIPAA Journal
• Current HIPAA Security Rule language at 45 CFR 164.312(d) requires person or entity authentication but does not prescribe MFA; OCR has emphasized authentication weaknesses in enforcement actions but has not previously mandated MFA in regulation text.Summary of the HIPAA Security Rule – HHS OCR Cybersecurity Newsletter June 2023 – HHS
• The NPRM responds to repeated ransomware incidents and large breaches by elevating MFA from best practice to regulatory baseline, aligning with broader federal cybersecurity guidance for critical infrastructure and healthcare.HIPAA Security Rule NPRM – HHS NCVHS Recommendations to Strengthen the HIPAA Security Rule (PDF – HHS Advisory)

3. Mandatory encryption of ePHI at rest and in transit

• Proposal: Encryption of all ePHI both at rest and in transit would become mandatory, with limited exceptions and documentation of risk-based alternatives only where technical or operational constraints exist.HIPAA Security Rule NPRM Fact Sheet – HHS HIPAA Updates and HIPAA Changes in 2026 – HIPAA Journal
• Under the current Security Rule, encryption is an addressable specification at 45 CFR 164.312(a)(2)(iv) and 164.312(e)(2)(ii); entities may adopt alternative measures if encryption is not reasonable and appropriate, but must document their decision and risk analysis.Summary of the HIPAA Security Rule – HHS Security Rule – HHS Technical Safeguards
• The NPRM reflects an expectation that modern healthcare IT can and should encrypt ePHI by default, considering cloud adoption, mobile access, and persistent ransomware threats.HIPAA Security Rule NPRM – HHS HHS Regulatory Initiatives – HIPAA Security Rule NPRM

4. Technology asset inventory and network map updated at least annually

• Proposal: Regulated entities must maintain an accurate and thorough written technology asset inventory and a network map showing the movement of ePHI across all relevant electronic information systems and technology assets, updated on an ongoing basis and at least every 12 months, and when environmental or operational changes affect ePHI.HIPAA Security Rule NPRM Fact Sheet – HHS Federal Register NPRM Text – Asset Inventory & Network Map
• This requirement is proposed as part of a revised security management process standard at 45 CFR 164.308(a)(1)(i), replacing the current, more general risk management language with explicit asset and network mapping obligations.Summary of the HIPAA Security Rule – HHS Security Rule – HHS Overview
• The NPRM positions asset inventories and network maps as foundational to accurate risk analysis and effective incident response, given complex healthcare environments and third‑party connectivity.HIPAA Security Rule NPRM – HHS NCVHS Recommendations – Defense in Depth & Visibility

5. Network segmentation requirements

• Proposal: The NPRM would introduce explicit requirements for network segmentation, ensuring that systems holding ePHI are logically or physically separated from less trusted network segments to reduce ransomware blast radius and lateral movement.HIPAA Security Rule NPRM Fact Sheet – HHS HIPAA Updates and HIPAA Changes – Network Segmentation Summary
• Network segmentation is framed as part of a defense‑in‑depth approach, echoing prior recommendations to HHS from advisory bodies encouraging layered controls to protect ePHI.NCVHS Recommendations – Defense-in-Depth HHS Cybersecurity Guidance – General
• Under the current rule, segmentation is implied but not expressly mandated; the NPRM seeks to transform implied good practice into a codified requirement.Summary of the HIPAA Security Rule – HHS HIPAA Security Rule NPRM – HHS

6. Annual audits, testing, and vulnerability management

• Proposal: The NPRM references regular vulnerability scans and penetration testing, including at least twice‑yearly vulnerability scans and annual penetration tests, plus annual verification of business associate and contractor security measures.HIPAA Updates and HIPAA Changes – Testing & BA Requirements HIPAA Security Rule NPRM Fact Sheet – HHS
• These testing and verification requirements would reinforce the existing security management process, evaluation, and business associate provisions under 45 CFR 164.308(a)(1), (a)(8), and 164.308(b), which currently lack explicit frequencies.Summary of the HIPAA Security Rule – HHS Security Rule – Administrative Safeguards
• The idea is to align HIPAA with modern cybersecurity governance practices that rely on continuous monitoring and periodic independent assessment, not just one‑time risk analyses.HIPAA Security Rule NPRM – HHS NCVHS Recommendations – Ongoing Risk Management

7. 72‑hour restoration plans for critical systems and ePHI

• Proposal: Entities must implement written procedures to restore critical electronic information systems and data within 72 hours, including restoration priority based on system criticality and separate technical controls for backup and recovery.HIPAA Security Rule NPRM Fact Sheet – Contingency Planning New HIPAA Regulations – Contingency & 72‑Hour Restoration
• This builds on existing contingency plan requirements at 45 CFR 164.308(a)(7), which currently require data backup, disaster recovery, and emergency mode operations plans but do not specify restoration timeframes.Summary of the HIPAA Security Rule – HHS Security Rule – Contingency Planning Overview
• The 72‑hour benchmark reflects expectations for critical healthcare operations continuity under increasingly frequent ransomware attacks.HIPAA Security Rule NPRM – HHS HHS Regulatory Initiatives – Rationale for Security Rule NPRM

Compliance Challenges

Even before finalization, organizations face significant challenges preparing for and aligning with the NPRM. These challenges are illustrated by enforcement actions and industry analyses.

1. Legacy systems and incomplete asset inventories

• Many healthcare organizations struggle to maintain complete, accurate asset inventories, especially for legacy medical devices, shadow IT, and hybrid environments.Federal Register NPRM Text – Asset Inventory HIPAA Security Rule NPRM Fact Sheet – HHS
• Industry reports note that hospitals often lack visibility into all network-connected devices, making network mapping and segmentation difficult.NCVHS Recommendations – Visibility Challenges HIPAA Security Rule Update – MyWorkDrive Analysis
• This visibility gap complicates accurate risk analysis, vulnerability management, and contingency planning under the NPRM.Summary of the HIPAA Security Rule – HHS HIPAA Updates – HIPAA Changes in 2026

2. Implementing MFA across heterogeneous user populations

• Healthcare organizations must deploy MFA for clinicians, administrative staff, remote users, and third parties accessing ePHI, often across multiple EHRs, VPNs, and legacy applications.HIPAA Security Rule NPRM Fact Sheet – MFA HIPAA Updates – MFA Requirement
• OCR’s enforcement history already underscores the risk of weak authentication controls; for example, OCR’s Banner Health settlement highlighted “failure to implement an authentication process to safeguard its electronic protected health information.”OCR Cybersecurity Newsletter June 2023 – Banner Health Example Summary of the HIPAA Security Rule – Authentication
• MFA implementation must balance usability and clinician workflow, particularly in emergency settings, which is a recurring challenge in healthcare cybersecurity.NCVHS Recommendations – Usability & Security HIPAA Security Rule Update – MyWorkDrive

3. Mandatory encryption for all ePHI

• Encrypting all ePHI at rest and in transit across multiple systems, endpoints, and data flows is technically and operationally demanding, especially for legacy devices and workflows.HIPAA Security Rule NPRM Fact Sheet – Encryption HIPAA Updates – Encryption Requirement
• Current HIPAA allows risk‑based exceptions; moving to mandatory encryption may require substantial system upgrades and re‑architecting.Summary of the HIPAA Security Rule – Addressable Encryption Security Rule – Technical Safeguards
• Industry analyses note cost, performance, and vendor compatibility

Recent developments

• 2026-07-13 — HHS moved the proposed HIPAA Security Rule amendments to the Long-Term Actions agenda, with July 2027 now listed as the anticipated timeframe for final action. This is the clearest recent signal that the rulemaking has been delayed rather than finalized. (source)
• 2026-07-10 — A legal update reports that OCR pushed finalization of the HIPAA Security Rule amendments from May 2026 to July 2027. The article frames this as a significant regulatory delay for healthcare organizations waiting on cybersecurity compliance requirements. (source)
• 2026-07-09 — This industry update says OCR had targeted May 2026 for final action, but that date passed without a final rule and no new timeline was confirmed at the time of publication. It reinforces that the proposed rule remained unresolved in early July 2026. (source)
• 2026-07-08 — The HIPAA Journal reported that the final rule had been pushed back a year, with July 2027 shown as the new due date for final action. The piece also notes the original proposed rule was issued in late 2024 and published in January 2025. (source)
• 2026-07-06 — Holland & Knight reported that the HIPAA Security Rule amendments were now projected for July 2027. The update indicates OCR had not released a final rule and that the regulatory timeline had shifted materially. (source)
• 2026-06-29 — BankInfoSecurity reported that HHS received nearly 5,000 public comments, many of them negative, on the proposed rule. The article also said more than 100 hospital systems and provider organizations signed a letter urging HHS to withdraw the update, reflecting substantial industry resistance. (source)
• 2026-06-11 — This industry commentary says OCR was still reviewing the 4,700-plus public comments from the proposed rule. It also argues the proposal would significantly raise the compliance floor by making many safeguards mandatory rather than addressable. (source)
• 2026-05-28 — This compliance-focused update explains that the rule was still in proposed status as of late May 2026. It notes that if finalized as proposed, compliance would be required 180 days after publication in the Federal Register. (source)
• 2026-04-29 — A healthcare association update said OCR was expected to announce significant changes in May 2026, including encryption and multi-factor authentication requirements. The article also described added operational requirements such as an inventory of systems handling patient data and procedures to restore critical systems within 72 hours. (source)
• 2026-04-19 — This cybersecurity industry update described the proposal as requiring encryption of ePHI, multi-factor authentication, and written recovery procedures for critical systems within 72 hours. It also stated that, as of August 2026, the current HIPAA Security Rule remained in effect while the proposal awaited final action. (source)

Related regulations

• NIST AI Risk Management Framework (AI RMF 1.0) — United States, Active, effective 2023-01-26
• Blueprint for an AI Bill of Rights — United States, Active
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Cybersecurity Maturity Model Certification — United States, Phased, effective 2025-11-10
• SEC Cybersecurity Disclosure Rules — United States, Active, effective 2023-12-18
• Executive Order 14365 - Ensuring a National Policy Framework for Artificial Intelligence — United States, Active, effective 2025-12-11
• TAKE IT DOWN Act — United States, Active, effective 2026-05-19
• SEC Regulation S-P Amendments (Customer Data Incident Response) — United States, Active, effective 2026-06-03

Put it into practice

• Generate the policy: HIPAA policy generator (generatepolicy.com)
• Buy the policy pack: HIPAA Complete Bundle (cyberpolicy.shop)
• Build it yourself: HIPAA Readiness Accelerator (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates