The proposed HIPAA Security Rule rewrite: encryption, MFA and 72-hour recovery, and still a proposal as of September 2026

What it says#

On December 27, 2024 the HHS Office for Civil Rights announced, and on January 6, 2025 published at 90 FR 898, a notice of proposed rulemaking to modify the Security Standards for the Protection of Electronic Protected Health Information, the HIPAA Security Rule at 45 CFR part 164, subpart C. HHS calls it the first update to the Security Rule since 2013. The summary says the proposals "would increase the cybersecurity for ePHI by revising the Security Rule to address: changes in the environment in which health care is provided; significant increases in breaches and cyberattacks; common deficiencies the Office for Civil Rights has observed in investigations into Security Rule compliance by covered entities and their business associates (collectively, 'regulated entities'); other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and court decisions that affect enforcement of the Security Rule." Comments were due March 7, 2025, a Tribal consultation was held February 6, 2025, and the docket is HHS-OCR-0945-AA22.

The structural change is at 45 CFR 164.306(c). Since 2003 the rule has sorted implementation specifications into "required" and "addressable," and the Department writes that regulated entities have misread addressable as optional. The proposal collapses the two: it would "remove the distinction between 'addressable' and 'required' implementation specifications" and "require regulated entities to comply with both the standards and implementation specifications." It also adds definitions, among them multi-factor authentication, technology asset, vulnerability, risk and threat.

Under administrative safeguards, a regulated entity would keep "an accurate and thorough written technology asset inventory and a network map" of every system and asset that may affect ePHI, reviewed at least once every 12 months and whenever the environment changes; written patch management policies; workforce security procedures that require notice to another regulated entity "no later than 24 hours" after a workforce member's access is changed or terminated; contingency plans with written procedures "to restore both its critical relevant electronic information systems and data within 72 hours of the loss"; incident response plans tested at least once every 12 months; a new compliance audit standard at 164.308(a)(14) requiring an audit of compliance with every standard and implementation specification "at least once every 12 months"; and written verification from business associates about their technical safeguards, reviewed at least once every 12 months.

Under technical safeguards, the proposed regulatory text would require unique user identification, separate identities for administrative privileges, automatic logoff, lockout after failed log-in attempts and network segmentation; encryption of "all electronic protected health information at rest and in transit" using prevailing cryptographic standards, with documented exceptions; configuration management including anti-malware protection, removal of extraneous software and disabling unused network ports; audit trail and log controls; and multi-factor authentication deployed "to all technology assets in the covered entity's or business associate's relevant electronic information systems" and for any change to a user's privileges, again with exceptions. A vulnerability management standard would require automated vulnerability scans "at least once every six months," monitoring of authoritative sources, penetration testing by a qualified person "at least once every 12 months," and patching of a critical risk within 15 calendar days once a fix is available. Backup controls would be tested at least once every six months.

The compliance date would be the standard one in 45 CFR 160.105, 180 days after a final rule's effective date, itself 60 days after publication, with a transition period for business associate contracts. HHS estimated first-year costs of "approximately $9 billion" and about $6 billion a year for years two through five, spread across 1,822,600 regulated entities, and calculated that the rule would pay for itself if it reduced the number of individuals affected by breaches by 7 to 16 percent. The announcement's own numbers explain the urgency: large breaches reported to OCR rose 102 percent from 2018 to 2023, the number of individuals affected rose 1,002 percent, and more than 167 million individuals were affected in 2023.

Who it applies to#

If finalized, the same entities the Security Rule already reaches. The NPRM restates the statute: the Administrative Simplification provisions apply to "health plans, health care clearinghouses, and health care providers who transmit information electronically in connection with a transaction for which HHS has adopted a standard," and the HITECH Act extends the Security Rule's safeguards and documentation requirements to business associates, "making those business associates subject to civil and criminal liability." A dental office that submits electronic claims or eligibility checks is a covered entity; its practice management vendor, cloud imaging host, e-mail provider under a business associate agreement, IT contractor and billing service are business associates with their own direct obligations.

What is new for a small practice is the specificity. The rule in force lets an office decide that encryption or MFA is not "reasonable and appropriate" and document why. The proposal removes that choice for most cases and attaches numbers: 72 hours, 24 hours, 15 days, six months, 12 months. It would also expect the office to have a written map of every device that touches patient data, which most practices with a sensor, a pan, a router and a cloud backup have never drawn.

What changed#

Nothing binding has changed. The proposal has not been finalized, withdrawn or reopened. A search of the Federal Register for RIN 0945-AA22 returns only the January 6, 2025 proposed rule and a Unified Agenda listing; searches for "HIPAA Security Rule" documents published since January 2025 return no HHS final rule. The Spring 2025 Unified Agenda carried the rule at the final rule stage with final action projected for May 2026; the 2026 edition moves it to long-term actions with final action projected for July 2027. HHS's own page on the proposal, last reviewed December 27, 2024, says: "While the Department is undertaking this rulemaking, the current Security Rule remains in effect." That is the status as of September 13, 2026, and this page will be updated if a final rule or a withdrawal appears.

What has changed is the record the proposal builds. The NPRM's own heading says compliance with the current rule "is inconsistent"; it finds that "many regulated entities have been slow to strengthen their security measures," that they "continue to rely on legacy systems and software that are unsupported by manufacturers" (73 percent of respondents to a 2021 survey of health care cybersecurity professionals reported legacy operating systems), and that "many regulated entities fail to invest adequate resources in cybersecurity." Those findings describe what OCR looks for under the rule in force today, whatever happens to the proposal.

Where the source is#

The proposed rule was read in the govinfo edition of the Federal Register for January 6, 2025 (FR Doc. 2024-30983, 90 FR 898 through 1022), which is the canonical link above. The absence of a later final rule rests on Federal Register API searches by RIN and by title run on the check date, and on the Unified Agenda entry for RIN 0945-AA22 on reginfo.gov, which records the projected final action dates. HHS's page on the NPRM at hhs.gov refused automated requests from this environment (HTTP 403 to both fetch methods); the sentence quoted from it was read in a September 3, 2026 archived copy of the page, whose content date is December 27, 2024. The docket on regulations.gov, HHS-OCR-0945-AA22 as the NPRM names it, was not opened.