Healthcare Security · October 24, 2026

The HIPAA Security Rule update: what’s delayed and what OCR enforces today

Status checked October 22, 2026. We'll update this post when the rulemaking moves.

If you run a health-tech company, you've probably seen headlines about a "new HIPAA Security Rule" with mandatory MFA, encryption, and annual penetration tests. Some vendors talk about it as if it's already law. It isn't. Here's where it actually stands, what the Office for Civil Rights (OCR) enforces right now, and why the smart move is to build most of the proposal anyway.

Where the rulemaking stands

  • December 27, 2024: HHS issued a notice of proposed rulemaking (NPRM) to overhaul the Security Rule.
  • January 6, 2025: the NPRM was published in the Federal Register (90 FR 898, RIN 0945-AA22).
  • March 7, 2025: the public comment period closed.
  • Now: the federal Unified Agenda on reginfo.gov lists the rule under "Long-Term Actions," with final action projected for July 2027. A search of the Federal Register for this RIN shows only the January 2025 proposed rule. No final rule has been published.

Two cautions about that July 2027 date. The Unified Agenda is a planning document, so projected dates can move, and this one already has: the Spring 2025 agenda listed the rule at the final rule stage. And "long-term action" doesn't mean withdrawn. HHS could still finalize it as proposed, narrow it, or re-propose it.

The proposal itself says a final rule would take effect 60 days after publication, with a compliance date after that. Under HIPAA's general rule, entities usually get 180 days after the effective date to comply, though a final rule could set different periods.

Bottom line: the Security Rule in force today is the existing rule in 45 CFR Part 164, Subpart C. HHS said it plainly in its NPRM fact sheet: while the rulemaking is under way, the current Security Rule remains in effect.

What the proposal would change

If finalized as proposed, the NPRM would, among other things:

  • Remove the distinction between "required" and "addressable" implementation specifications, making nearly all of them required.
  • Require written documentation of all Security Rule policies, procedures, plans, and analyses.
  • Require a technology asset inventory and a network map showing how ePHI moves, updated at least every 12 months and when things change.
  • Make risk analysis requirements far more specific.
  • Require encryption of ePHI at rest and in transit, and multi-factor authentication, each with limited exceptions.
  • Require vulnerability scanning at least every six months and penetration testing at least every 12 months.
  • Require network segmentation and separate controls for backup and recovery.
  • Require written procedures to restore certain systems and data within 72 hours.
  • Require a Security Rule compliance audit at least every 12 months.
  • Require business associates to verify to covered entities, at least every 12 months, that they've deployed required technical safeguards, through a written analysis by a subject-matter expert and a written certification.
  • Require business associates to notify covered entities within 24 hours of activating their contingency plans.

That last group matters most for health-tech vendors. If it's finalized in anything like this form, your health plan and provider customers will be asking you for annual written verification.

What OCR enforces today

The current Security Rule applies directly to you

If you create, receive, maintain, or transmit PHI for a health plan or provider, you're a business associate. HHS states that business associates are directly liable for complying with the Security Rule. That includes the administrative, physical, and technical safeguards and the documentation requirements, plus breach notification to the covered entity.

Risk analysis is the enforcement priority

OCR's enforcement record keeps returning to one finding: no accurate and thorough risk analysis. OCR runs a Risk Analysis Initiative focused on exactly this requirement. Recent examples from HHS's own announcements:

  • March 5, 2026: OCR settled with MMG Fusion, a software company acting as a business associate, after a breach HHS says involved PHI of about 15 million individuals. OCR's findings included failing to conduct an accurate and thorough risk analysis and failing to notify affected covered entities. HHS called it the 12th enforcement action in the Risk Analysis Initiative.
  • April 23, 2026: OCR announced four ransomware settlements totaling $1,165,000, with corrective action plans monitored for two years. HHS said these brought it to 19 completed ransomware investigations and 13 completed Risk Analysis Initiative investigations.
  • HHS's list of resolution agreements shows further 2026 actions, including ransomware and phishing cases, through September 2026.

The corrective action plans look similar from case to case: do an accurate and thorough risk analysis, build and implement a risk management plan, write and maintain policies and procedures, and train the workforce.

Recognized security practices can help

A 2021 amendment to the HITECH Act (Public Law 116-321) requires HHS to consider whether an organization had "recognized security practices" in place for the previous 12 months when deciding fines, audit outcomes, and remedies. Examples include the NIST Cybersecurity Framework and the Health Industry Cybersecurity Practices developed under the Cybersecurity Act of 2015. Having them in place, and being able to prove it, is a practical mitigating factor.

What to build now

Most of the proposal reflects practices OCR already expects to see in a sound risk analysis, and practices health plans already ask for in vendor reviews. Building them now isn't wasted effort.

Do now, because the current rule and OCR expect it

  1. A real risk analysis. Written, organization-wide, tied to your actual systems and data flows, and refreshed when things change. NIST SP 800-66 Revision 2 is HHS-aligned guidance on implementing the Security Rule, and the HHS/ONC Security Risk Assessment Tool can help smaller teams.
  2. A risk management plan that shows what you decided to fix, by when, and who owns it.
  3. Current policies and procedures that match how you actually operate.
  4. Workforce training with records.
  5. Subcontractor BAAs with any vendor that touches PHI on your behalf.

Do now, because buyers already ask and the proposal points there

  1. An asset inventory and a data-flow diagram for ePHI.
  2. MFA and encryption everywhere PHI lives or moves.
  3. Regular vulnerability scanning and an annual penetration test, with remediation evidence.
  4. Tested backups and a written restore procedure, including priorities for which systems come back first.
  5. A written, tested incident response plan.

Watch for

  • The next Unified Agenda entry for RIN 0945-AA22. A move back to the final rule stage would signal publication is getting closer.
  • Publication in the Federal Register, which will set the effective and compliance dates.
  • Changes to customer contracts and BAAs that start asking for annual verification even before a final rule.

How KN Cyber helps

We help health-tech companies run HIPAA risk analyses, build the security program OCR and health plans expect, and produce the evidence buyers ask for, including penetration tests of web apps, APIs, mobile apps, cloud, and networks. For teams without a security leader, a fractional CISO can own the program end to end. See Healthcare and health-tech security, Fractional CISO, and Product security and penetration testing. Pricing is scoped to your organization's size and needs.

Want a clear read on where your program stands against the current rule and the proposal? Book a consultation.

This post is general information, not legal advice. Talk to counsel about your specific obligations.

Sources

Accessed October 22, 2026.

← All insights