The proposed HIPAA Security Rule changes, and what to do before they land

On January 6, 2025, the U.S. Department of Health and Human Services published a notice of proposed rulemaking to update the HIPAA Security Rule. It is the first substantial revision since 2013, and it reads like a list of the things the Office for Civil Rights has been penalizing organizations for not doing.

Whether or not the final rule lands exactly as proposed, the direction is clear. This article covers what the proposal changes, why “wait for the final rule” is the wrong plan, and the sequence we recommend to healthcare organizations and their business associates.

What the proposal changes

The current Security Rule separates “required” implementation specifications from “addressable” ones. Addressable never meant optional, but in practice it was treated that way. The proposed rule removes the distinction. Every specification becomes required, with narrow exceptions.

Beyond that, the proposal makes several controls explicit:

• Encryption of ePHI at rest and in transit, with limited exceptions.
• Multi-factor authentication for access to systems that handle ePHI.
• A technology asset inventory and network map that shows where ePHI lives and how it moves, reviewed at least annually.
• Risk analysis that is tied to that inventory, covers every relevant system, and documents specific remediation actions.
• Vulnerability scanning at least every six months and penetration testing at least annually.
• Restoration of critical electronic information systems within 72 hours of a loss.
• Written procedures for incident response and contingency planning, tested rather than filed.
• Annual compliance audits of the organization’s own Security Rule program.

The proposal also sets a compliance window of 240 days after the final rule’s effective date. That is roughly eight months to implement controls that, for many organizations, represent several years of deferred work.

Why waiting is a mistake

Three reasons.

OCR is already enforcing the current rule aggressively. The most common deficiency cited in enforcement actions is the failure to conduct an accurate and thorough risk analysis. That requirement exists today. An organization that has not done a real risk analysis is already out of compliance, final rule or not.

The proposed controls are what good security looks like anyway. Encryption, MFA, asset inventories, tested backups, and annual testing are the controls cyber insurers ask about, the controls that stop ransomware, and the controls any competent assessor would recommend. Doing them now protects the organization regardless of what the rule says.

Eight months is not long. Deploying encryption across every system that holds ePHI, rolling out MFA to every workforce member, building a real asset inventory, and establishing a tested 72-hour restoration capability is a program, not a project. Organizations that start when the rule is final will be choosing between rushed work and non-compliance.

The order we recommend

We have run healthcare security assessments for eight years. The organizations that get through this well do it in roughly this order.

1. Build the asset inventory and ePHI flow map

Everything else depends on knowing where ePHI is. That means systems, applications, devices, cloud services, backups, and the vendors that touch any of it. Most organizations discover ePHI in places nobody expected: shared drives, email archives, a legacy reporting server, a vendor portal.

2. Do a real risk analysis

Not a template. A risk analysis that references the inventory, identifies threats and vulnerabilities for each system, rates likelihood and impact, and produces a prioritized list of remediation actions with owners and dates. This is the document OCR asks for first, and it is the one most organizations cannot produce.

3. Close the high-impact gaps

In most environments that means MFA where it is missing, encryption of the systems and devices that hold the most ePHI, and a backup process that has actually been restored from. These three controls address the majority of real-world healthcare incidents.

4. Establish the recurring work

Semiannual vulnerability scanning, annual penetration testing, annual risk analysis refresh, and tested incident response and contingency plans. This is where a managed program earns its keep: the work has to happen every year, and it has to leave evidence.

5. Document as you go

A control that is not documented does not exist to an auditor. Policies, procedures, test results, remediation records, and training logs should accumulate as a byproduct of the work rather than being reconstructed before an audit.

What this costs

The cost of a thorough risk assessment depends on organization size, number of systems, scope, and the state of existing documentation, so get it scoped rather than guessing. Remediation costs vary widely. For context, OCR penalties for risk analysis failures have run from the hundreds of thousands of dollars into the millions, and that is before breach response costs.

Where to start

If you have not done a risk analysis in the past twelve months, or the one you have does not reference a system inventory, start there. Our HIPAA Security Rule readiness checklist maps every control in the current rule against the proposed changes with a self-assessment for each area. Sidechain’s HIPAA security services cover assessment, remediation, and ongoing management for covered entities and business associates.

This article is general information, not legal advice. Review specific requirements and deployments with your own counsel and compliance team.