HIPAA Security Rule Changes and Updates: An Ultimate Guide

The Department of Health and Human Services (the Department) published a notice of proposed rulemaking (NPRM) on January 6, 2025, that proposes the biggest HIPAA Security Rule changes and updates since 2013. The proposal is not final, and the current Security Rule remains in effect. The Office of Management and Budget (OMB) currently lists a Final Action date of July 2027, which is a target, not a deadline. A final rule would take effect 60 days after publication. Regulated entities would have 180 days after that effective date to comply. That gives most organizations 240 days from publication. This post breaks down the most significant changes from the administrative, physical, and technical sections. For a full mapping of the existing HIPAA Security Rule and NPRM updates, download the free crosswalk below.

“Addressable” Goes Away

The proposed rule would remove the distinction between “addressable” and “required” implementation specifications. Currently, organizations must implement addressable specifications considered reasonable for their environment. OCR’s enforcement experience suggests many treat “addressable” as optional. The Department says that reading is incorrect and weakens cybersecurity. Under the NPRM, every standard and implementation specification would be mandatory.

Written Documentation and Retention Requirements

Under the NPRM, documentation would become a heavily scrutinized engine of accountability. The types of required documentation would reflect a shift toward continuous security validation. Organizations would be required to maintain policies and procedures, alongside analyses and audits. Organizations would need to document real-time exceptions with justifications and compensating controls when deviating from established rules. Finally, the rule would require extensive reviews, tests, and operational logs to prove security controls are functioning as intended. The same six-year retention period would now cover far more documentation.

The NPRM would require organizations to maintain the following records:

Foundational Policies, Procedures, and Plans

• Risk Management Plan (e.g., POA&M and SSP)
• Patch Management Policies and Procedures
• Contingency & Disaster Recovery Plans
• Incident Response Plan & Playbooks
• Information System Activity Review Policies
• Workforce & Access Management Procedures
• Physical Security & Facility Access Plans
• Workstation & Device Controls

Inventories, Maps, and Baselines

• Technology Asset Inventory and Network Map
• Configuration Baselines & Software Allow-lists

Assessments, Analyses, and Audits

• Written Risk Analysis
• Criticality Analysis
• Annual Compliance Audit
• Third-Party Verifications & Agreements

Exceptions and Compensating Controls

• Patch and MFA Exceptions
• Patch and MFA Compensating Controls

Testing, Scanning, and Review Reports

• Vulnerability & Penetration Testing Reports
• Data & System Backup Restoration Records
• Configuration & Tool Reviews
• Physical Safeguards Reviews

Operational Logs and Tracking Records

• Incident Investigation & Root-Cause Records
• Audit Trails & System Logs
• Data Backup Logs
• Security Awareness Training Records
• Physical Maintenance Logs

For a closer look at how these requirements could change, explore our guide to HIPAA administrative safeguards

Proposed Continuous Monitoring Activities

The activities below are grouped by how often they would be required:

Real-Time and Continuous Monitoring (Ongoing)

• Audit Trail and System Log Monitoring. Continuous, real-time monitoring of system activity across all relevant systems. Automated alerting configured to notify security personnel of suspicious activity as it occurs.
• Backup Failure and Error Alerting. Real-time alerting to notify workforce members of backup errors, job failures, or data corruption.
• Threat Feed and Vulnerability Monitoring. Ongoing monitoring of authoritative threat intelligence sources. For example, Known Exploited Vulnerabilities (KEV) catalog and the National Vulnerability Database (NVD).
• Anti-Malware and Endpoint Detection. Continuous monitoring using signature- and heuristic-based anti-malware or EDR solutions.
• Ongoing Security Threat Reminders. Continuous distribution of educational notices alerting workforce members to emerging threats.
• Real-Time Exception Logging. Immediate documentation of patching and MFA exceptions and compensating controls.

Learn more about the proposed changes to HIPAA physical safeguards, including facility access, workstation security, and maintenance reviews.

Monthly Activities

• Data Backup Restoration Testing. Testing and documenting the effectiveness of data backups at least once a month. 

Semi-Annual Activities (Every 6 Months)

• Automated Vulnerability Scanning. Conduct technical vulnerability scans across all devices at least once every six months.
• System Backup and Recovery Control Reviews. Test and review backup and recovery controls across a sample of systems at least every six months.

Annual Activities (At Least Every 12 Months)

• Penetration Testing. Conduct simulated cyberattacks across relevant environments at least once every 12 months.
• Comprehensive Risk Analysis. Review and update the written enterprise risk analysis.
• Technology Asset Inventory and Network Map Review. Update the asset inventory and the network data-flow map.
• Full Compliance Audit. Assess compliance against every standard and implementation specification across the HIPAA Security Rule.
• Business Associate Technical Verifications. Obtain written technical verification certifying that business associates have deployed required technical safeguards.
• Security Incident Response Plan Testing. Review, update, and test (e.g., via tabletop exercises) the incident response plan.
• Security Awareness Workforce Training. Deliver updated cybersecurity training to all active workforce members.
• MFA Control and Exception Reviews. Test the operational efficacy of MFA controls and review exceptions and compensating controls.
• Configuration Management Control Reviews. Review and test the effectiveness of system baselines, software allow-lists, and port restrictions.
• Vulnerability Scanning Process Reviews. Review and test the configuration, coverage, and effectiveness of vulnerability scanning tools.
• Patch Management Policy Review. Review and update written patch management policies, procedures, and prioritization metrics.
• Physical Safeguards Maintenance and Facility Reviews. Review and test physical security controls for every facility housing relevant systems.

Event-Driven and Time-Bound Operational Windows

• 1-Hour Window. Complete revocation of access to ePHI, systems, and facilities upon workforce member termination.
• 24-Hour Window. Deliver written notification to external entities when modifying or terminating a user’s access to shared ePHI systems.
• 48-Hour Window. Maximum allowable data backups age relative to live production systems (Recovery Point Objective).
• 72-Hour Window. Maximum recovery time objective (RTO) to restore critical systems and data.
• 15-Calendar-Day Window. Mandatory deadline to apply patches, configuration updates, or compensating controls for critical risks.
• 30-Calendar-Day Window. 
  
  • Mandatory deadline to apply patches, configuration updates, or compensating controls for high risks.
  • Mandatory deadline to provide role-based security training to new workforce members or to retrain personnel following material policy modifications.

Asset Inventory, Network Map, and a Written Risk Analysis

Organizations would need a written technology inventory and a network map. The inventory would be required to include each asset’s version, accountable owner, and location. The network map would need to show how ePHI moves through their systems. These would feed a written risk analysis, which would follow an eight-step process. For many, the inventory and network map would likely be the biggest lift, since the rest of the process depends on them.

Organizations can use our free HIPAA Security Risk Assessment Checklist to evaluate their current safeguards and identify potential compliance gaps.

Mandatory MFA and Encryption

The proposed rule would require multi-factor authentication on all technology assets and for any action that would change a user’s privileges. Organizations could deploy MFA in different ways based on the risk each asset poses. Limited exceptions would apply for assets incapable of supporting MFA, emergencies, and authorized medical devices. Each exception would need to be documented and backed by compensating controls.

The proposed rule would also require encryption of ePHI at rest and in transit, consistent with prevailing standards. Organizations would be expected to update their solutions as those standards evolve. Encryption would follow a similar exception model to MFA, with limited exceptions for assets that cannot support encryption, emergencies, certain FDA-authorized medical devices, and individuals who request their ePHI unencrypted after being told of the risks. Exceptions would need to be documented in real time and backed by compensating controls. The Security Official would be required to approve most of them and review them at least every 12 months.

Our breakdown of the proposed HIPAA technical safeguards explains these requirements in greater detail.

Vulnerability Management and Patching

Regulated entities would be required to establish written policies to identify, prioritize, and remediate vulnerabilities. Remediation would need to occur within standardized windows once a patch or mitigation is available. These windows include 15 calendar days for critical risks and 30 calendar days for high risks. Organizations would be required to document exceptions in real time and deploy compensating controls within those standardized windows.

The technical Vulnerability Management standard would operationalize this administrative framework. Entities would be required to conduct vulnerability scans across all assets at least every six months. Qualified offensive security professionals would need to conduct penetration tests at least every 12 months. Entities would also need to continuously monitor vulnerability feeds (e.g., CISA KEV or NIST NVD). These technical mechanisms would provide the empirical data required to execute timely patches.

Network Segmentation, Configuration Hardening, and Real-time Monitoring

The proposed changes would introduce an explicit technical specification for network segmentation. Regulated entities would be required to divide relevant systems into distinct operational enclaves, subnets, or micro-segments. Segmentation would establish strict boundary protections and controlled communication flows between systems storing ePHI. A new technical Configuration Management standard would enforce system hardening and least functionality. Organizations would need to establish secure baselines, disable unused physical and logical network ports, and remove unnecessary software. The proposal would also elevate anti-malware protection to its own technical standard. The Information System Activity Review standard would require structured review cadences across event logs. The overhauled Audit Trails and System Log Controls technical standard would require real-time monitoring and automated alerting. Continuous technical telemetry should catch data backup failures as they happen.

Backups, Recovery, and Incident Response

The NPRM would elevate data backup and recovery and information systems backup and recovery to technical standards. Regulated entities would be required to maintain retrievable copies of ePHI no more than 48 hours older than the production data. Backups would also need to capture operating systems, software configurations, and supporting infrastructure. Technical mechanisms should record all successes, failures, and alerts. The proposed Contingency Plan standard would focus on structured recovery and business continuity. The criticality analysis would rank systems and assets to establish a restoration priority. The disaster recovery specification would set a binding recovery time objective of 72 hours. The Security Incident Procedures would formalize a five-stage incident response lifecycle and reporting protocols. The proposal would require retaining investigation files, forensics, mitigation records, and root-cause analyses for at least six years.

Tighter Workforce and Access Timelines

The Workforce Security standard would replace general access guidelines with aggressive, enforceable operational timelines. Organizations would be required to maintain structured clearance procedures, but the most dramatic shift targets offboarding. Regulated entities would need to revoke a user’s access within one hour of employment or contractual termination. This mandate would cover login credentials, access badges and physical access codes. Organizations would need to notify other regulated entities of access terminations or permission changes within 24 hours.

The Security Awareness Training standard would replace vague periodic reminders with fixed educational deadlines. All workforce members would need to receive cybersecurity training at least once every 12 months. New hires would need to receive role-based training within 30 days of accessing relevant systems. Material updates to security policies and procedures would trigger updates to training within 30 days. Ongoing education should cover modern threats like phishing, malicious attachments, and social engineering. All training would need to be documented.

Greater Accountability

The compliance audit standard would require documenting an assessment at least every 12 months. This review could be conducted either internally or by an independent third party. The Business Associate standard would require obtaining annual written verification that each business associate has deployed all required safeguards. This review would need to be performed by a qualified professional. While regulated entities may designate a business associate to serve as their Security Official or execute specific security activities, the NPRM proposes that accountability cannot be outsourced. Regulated entities would remain liable for compliance with the HIPAA Security Rule.

How to Prepare for HIPAA Security Rule Changes and Updates

The Office of Management and Budget currently lists July 2027 as a final action date. The 240-day compliance window may not be enough time to overhaul enterprise-wide policies and procedures. To get ahead of the curve, organizations should begin laying the groundwork today. Here is where you should focus your immediate efforts:

• Prioritize Your Asset Inventory and Network Map. The risk management framework hinges on having an accurate inventory and a map of how ePHI moves through your environment. Start here, since the proposed eight-step risk analysis depends on both.
• Audit Your Operational Timelines. The NPRM would introduce rigid, enforceable deadlines that could break manual processes. Review your current capabilities against the proposed timelines. Identify the gaps in your workflows now and look for opportunities to automate these processes.
• Budget for Technical Safeguards. Many organizations would likely need to invest in upgraded technical controls. Begin evaluating your budget to accommodate enterprise-wide multi-factor authentication (MFA), automated vulnerability scanners, endpoint detection and response (EDR) solutions, and centralized log monitoring platforms that can provide the required real-time alerting. Integrate tools with a GRC platform to establish a body of evidence that demonstrates compliance.
• Start the Conversation with Business Associates. The days of relying on a static, signed Business Associate Agreement (BAA) and simply trusting a vendor's word may be ending. Start discussing the proposed "written verification" requirements with your key third-party vendors today. Establish a mutual framework for verifying that partners are deploying proposed safeguards.

A centralized HIPAA compliance platform can help organizations manage policies, assign compliance tasks, document risks, and track employee training.

Conclusion

The proposed changes represent a fundamental shift in how the Department views healthcare cybersecurity. By eliminating "addressable" loopholes, mandating strict operational timelines, requiring enterprise-wide MFA, and forcing organizations to empirically validate their security posture, the NPRM would force accountability into every layer of the healthcare supply chain. While the final rule remains to be seen, the direction of the proposal appears clear: check-the-box compliance would no longer be acceptable. The expectation is a living, breathing, and fully documented risk management program. Organizations that wait may find themselves scrambling to meet the compliance window.