HHS published its first major proposed update to the HIPAA Security Rule in more than a decade. If the NPRM finalises as drafted, “addressable” effectively disappears, MFA and encryption become required, and the Security Rule picks up a 72-hour recovery target. If it does not finalise soon, insurers and buyers will expect the controls anyway. Here is what is in it, where it stands, and what to do now.
What HHS proposed, and when
The Notice of Proposed Rulemaking (NPRM) was issued on 27 December 2024 and published in the Federal Register on 6 January 2025 at 90 FR 898. The comment period closed on 7 March 2025. It is the first substantive update to the Security Rule since the 2013 HITECH changes.
The federal regulatory agenda for RIN 0945-AA22 now lists the final rule under Long-Term Actions with a final-action target of July 2027 and no legal deadline. It had earlier been targeted for May 2026. (Source: reginfo.gov, RIN 0945-AA22.)
The current Security Rule remains fully in effect until a final rule is published. (Source: HHS Security Rule page.)
The biggest proposed changes
Six changes together carry most of the operational impact.
Multi-factor authentication required. MFA for every system that accesses ePHI, with phishing-resistant options emphasised. In the current rule, authentication is addressable; in the NPRM it is required.
Encryption at rest and in transit required. Both move from addressable to required. The documented-rationale escape hatch under §164.306(d) narrows to a tightly scoped set of exceptions, with written approval from the Security Officer.
Technology asset inventory and network map. An authoritative inventory of all systems, devices, and services that create, receive, maintain, or transmit ePHI — maintained and reviewed at least every 12 months. A dated network map accompanies it.
72-hour recovery requirement. Critical electronic information systems must be restorable within 72 hours of an incident, with tested evidence that the target can be met.
Annual compliance audit. A full annual audit of the Security Rule program, in addition to the existing periodic evaluation under §164.308(a)(8).
Removal of the “addressable” vs “required” distinction. Every implementation specification becomes required. The §164.306(d) rationale path disappears for everything except a very small set of specified exceptions.
Other proposed changes include annual verification of business associates’ technical safeguards, written incident response plans with tabletop exercises, patch-management requirements with defined timelines, and expanded workforce training content.
Where the rule stands right now
In short: proposed, not final. The federal agenda has moved the final-rule target from mid-2026 to July 2027. The current Security Rule continues to apply, and OCR continues to enforce it — the four Risk Analysis Initiative settlements in April 2026 and the Ambry Genetics phishing settlement in September 2026 all cited current-rule violations.
The practical consequence for buyers and compliance teams: everything in the NPRM is forecast, but the forecast now has a visible shape. Nothing in it is radical by 2026 security standards. The question is whether a program adopts the forecast as its baseline, or waits for the final rule and remediates under pressure.
What still applies today
The current Security Rule is unchanged. That means:
- The §164.306(d) addressable/required distinction is in force.
- Encryption remains addressable (though, in practice, “reasonable and appropriate” for almost every organisation on cloud infrastructure).
- Authentication is addressable.
- The §164.308(a)(7) contingency plan standard applies, but there is no explicit 72-hour target.
- There is no asset inventory or network map requirement, though both are implicit in a defensible risk analysis.
The current rule’s enforcement is also unchanged. OCR’s 2026 cases keep citing missing or inadequate risk analyses, missing termination evidence, and missing BAAs. Those are not NPRM items — they are findings on the current rule, and they will not go away when a new rule arrives.
What to do now anyway
Six moves make sense whether the final rule lands in 2027 or 2029.
1. Treat encryption at rest as required. If you are on major cloud infrastructure, encryption at rest is a configuration setting rather than a project. Capture the state per asset and move the §164.306(d) rationale from “we considered it” to “it is implemented”.
2. Require phishing-resistant MFA for every ePHI-adjacent identity. Not just admins. The 2026 OCR phishing cases involved workforce accounts, not just privileged ones.
3. Stand up the asset inventory, with the network map alongside it. The inventory is not optional in a defensible risk analysis today. Doing it formally now makes you ready for the final rule and makes your current risk analysis stronger.
4. Test the 72-hour restore target. Even without a formal rule, document a dated test. If you cannot meet the target, the gap is a known risk with an owner — not a surprise during an incident.
5. Run the annual compliance audit now. Call it what you want — annual review, periodic evaluation, internal audit — but produce the artefact once a year, dated, with findings and remediation.
6. Capture the current §164.306(d) rationales under version control. When the “addressable” path narrows, your documentation becomes evidence that your past decisions were deliberate rather than default.
For the full plain-language walk through the current Security Rule, see our HIPAA Security Rule guide — the “Proposed Security Rule changes (NPRM)” section tracks this in reference form. For how we handle both current and proposed rule tracking in the platform, see Security Rule Controls.
The bottom line
The NPRM does not say anything a mature security program will find surprising. It formalises what cyber insurers, enterprise buyers, and OCR settlement patterns already treat as the real baseline. The organisations that will have the easiest time with a final rule are the ones who stopped waiting for it.
If you want to know where you stand against both the current rule and the proposed one, our free HIPAA readiness assessment scores both. Twenty-four questions, about eight minutes, no call required.