Where the healthcare cybersecurity HIPAA update stands

The Department of Health and Human Services (HHS) published the proposed rule in the Federal Register on January 6, 2025, with comments due March 7, 2025. In mid-2026 the federal regulatory agenda moved the final action date to July 2027 and listed the rule as a long-term action, meaning no action is expected within the next 12 months.

If the rule is finalized as proposed, it would take effect 60 days after publication, with compliance required 180 days after that. Treat July 2027 as a target, not a promise: it has moved before.

There is a budget reason not to wait either. Most of the work the proposed rule describes, from encryption to annual penetration testing, has to be funded before it can be done. If the final rule lands on schedule, the compliance window would fall inside a budget cycle you are planning now.

What the proposed Security Rule would require

According to the HHS fact sheet on the proposed rule, the biggest changes for IT teams would:

• Remove the distinction between “required” and “addressable” implementation specifications, making all of them required with limited exceptions.
• Require encryption of electronic protected health information (ePHI) at rest and in transit, with limited exceptions.
• Require multifactor authentication, with limited exceptions.
• Require a technology asset inventory and a network map, reviewed at least once every 12 months and whenever something changes.
• Require written procedures to restore certain systems and data within 72 hours.
• Require vulnerability scanning at least every six months and penetration testing at least once every 12 months.
• Require a compliance audit at least once every 12 months.
• Require business associates to verify their technical safeguards at least once every 12 months, and to notify covered entities no later than 24 hours after activating their contingency plans.

For a provider with one site and a modern stack, much of this is documentation. For a provider with a dozen clinics, each with its own network history, it is an inventory and remediation project.

What OCR is enforcing right now

The current Security Rule already requires an accurate and thorough risk analysis, and OCR is using it. In a June 18, 2026 settlement with a health plan, OCR described the case as its 20th ransomware enforcement action and the 14th in its Risk Analysis Initiative. “Effective cybersecurity starts with Security Rule compliance, ensuring that Security Rule provisions are implemented before a cyberattack occurs,” said OCR Director Paula M. Stannard in the HHS announcement.

The practical reading: if a breach happens before the new rule is final, your risk analysis is the first document OCR will ask for.

Four moves for your IT team before the rule is final

1. Rebuild your asset inventory and network map

You cannot do a credible risk analysis on systems you have not listed. Inventory every device, application and connection that touches ePHI, location by location, and draw the network map the proposed rule describes. Multi-location providers usually find clinics that were connected quickly during an acquisition and never documented. Record an owner for every asset and the date it was last reviewed. Both answer questions an auditor will ask, and both keep the inventory from going stale the month after you finish it.

2. Close the MFA and encryption gaps, site by site

Under the current rule, many organizations documented MFA and encryption as “addressable” and moved on. The proposed rule would make them required. List every system where ePHI is stored or accessed without MFA, and every place it sits unencrypted, and put a date next to each one.

3. Test a 72-hour restore

Pick a clinical or practice management system and restore it to a test environment. If it takes longer than 72 hours, you have found your next budget line before a regulator or an attacker finds it for you.

4. Review your business associates

Your vendors’ controls are part of your exposure. Ask key business associates how they protect your ePHI today and how quickly they would tell you if they activated a contingency plan. Their answers show you which contracts need updating whether or not the rule changes. Start with the vendors that host or back up clinical data, since their outage becomes your outage.

What this actually buys you

Done now, these four moves give your board and your compliance officer a documented answer to the question OCR asks first, and they turn the final rule into a checklist instead of a scramble.

IT Management Corporation™ (ITMC) works with California healthcare providers on cybersecurity strategy, compliance posture and the multi-location networks underneath them. If you are weighing outside help to carry the work, start with the four questions your managed IT RFP should ask.