The HIPAA Security Rule update would require multifactor authentication, encryption, and tested 72-hour recovery for every organization that handles patient data. Our healthcare clients have run on those safeguards for a decade. The rule isn’t final yet, but the standard it describes has been around for years.
If you lead a growing practice or clinic group in the Southeast, the real question isn’t whether these controls are coming. It’s whether you already have them. Below is where the rule stands as of October 2026, what it would require, and how to check your own setup before a regulator or an insurer does it for you.
Is the HIPAA Security Rule Update Final?
No. As of October 2026, the HIPAA Security Rule update is still a proposed rule. The U.S. Department of Health and Human Services published it in the Federal Register on January 6, 2025, and the comment period closed that March with 4,747 public comments.
The federal regulatory agenda now lists the rule as a long-term action with a target final date of July 2027. That date is an estimate, not a deadline. The agency could finish sooner, later, change the rule, or drop it.
If the rule is finalized as proposed, it would take effect 60 days after publication, and organizations would have 180 days after that to comply. Using the July 2027 target, that puts realistic compliance around early 2028. That’s about 16 months from now, which is less time than most practices need to budget, plan, and roll out changes across several locations.
What Would the HIPAA Security Rule Update Require?
The proposal turns flexible guidance into firm requirements. The biggest change is removing the difference between “required” and “addressable” safeguards, so nearly every protection becomes mandatory. Here is what that means in practice, based on the HHS fact sheet.
| Area | Today | Proposed |
|---|---|---|
| Multifactor authentication | Not named in the rule | Required, with limited exceptions |
| Encryption | “Addressable” | Required for patient data at rest and in transit |
| Disaster recovery | Plan required | Written procedures to restore key systems and data within 72 hours |
| Asset inventory and network map | Not specified | Written inventory and data map, updated at least yearly |
| Vulnerability scanning | Not specified | At least every 6 months |
| Penetration testing | Not specified | At least every 12 months |
| Compliance audit | Not specified | At least every 12 months |
| Business associates | Signed agreement | Yearly written proof their safeguards are in place |
| Access removal | Not time-bound | Notify within 24 hours when access changes or ends |
One point that trips up a lot of coverage: the 72-hour figure is a restoration target. It is not a deadline for reporting an incident to the government.
Why Does This Feel Like Old News?
Because most of it is. Federal agencies have recommended nearly every control in this proposal for close to ten years. The rule is catching up to the guidance, not inventing anything new.
- 2016: HHS guidance on ransomware told healthcare organizations to make frequent copies of their data, test that they could restore them, and keep those copies off the main network. (HHS ransomware fact sheet)
- 2017: The National Institute of Standards and Technology made multifactor authentication the standard for any system with moderate risk. (NIST SP 800-63B)
- 2018: HHS and industry partners published ten core security practices for healthcare, including multifactor authentication, device encryption, and asset tracking. (Health Industry Cybersecurity Practices)
- 2024: HHS released healthcare cybersecurity performance goals that labeled multifactor authentication, asset inventory, and security testing as essential.
Our team built those practices into the ProSafeIT playbook long before anyone proposed writing them into law. Every healthcare client gets the same proven setup: multifactor sign-in, encrypted devices, tested disaster recovery, and a documented inventory of what’s on the network. That consistency is the point. When the rule changes, our clients don’t have to scramble, because the work is already done.
Does the Delay Mean You Can Wait?
No. The current Security Rule is fully in force, and the HHS Office for Civil Rights is enforcing it. Its Risk Analysis Initiative has produced a steady run of settlements this year, mostly against organizations that never completed a thorough risk analysis.
In February 2026, for example, a treatment center agreed to pay $103,000 after a phishing attack exposed patient data. (Hunton Andrews Kurth summary) None of those cases needed the new rule. The old one was enough.
Cyber insurance is moving the same direction. Many carriers now ask for proof of multifactor authentication, tested disaster recovery, and a written incident response plan before they renew a policy. If your answers are vague, your premium or your coverage pays for it.
Waiting for the final rule also squeezes your timeline. Rolling out encryption, a full asset inventory, and recovery testing across several clinics takes months, not weeks. Starting in 2027 means doing it under pressure.
What Should You Ask Your Technology Partner to Prove?
Under the proposal, you would need yearly written proof that the companies handling your patient data have their safeguards in place. Start asking now. A strong technology partner can answer these questions with documents, not promises:
- Is multifactor authentication turned on for every account that can reach patient data, including email and remote access?
- Are laptops, phones, and servers encrypted, and can you show me the report?
- When did you last restore our systems from a disaster recovery copy, and how long did it take?
- Can you hand me a current inventory of every device and system on our network, plus a map of where patient data moves?
- How often do you scan for vulnerabilities, and what happened to the last findings?
- When someone leaves, how fast is their access removed, and is that logged?
It also helps to know who owns what. Your technology partner should cover sign-ins, devices, the network, disaster recovery, scanning, and documentation. Your electronic health record company secures its own application under its own agreement with you. Clear lines mean nothing falls through the gap between them.
For a deeper look at how a healthcare operations team can organize this work, see The IT Playbook for Healthcare Managers.
What Should You Do Before the Rule Is Final?
Treat the proposal as a checklist, not a forecast. Walk through the table above, mark which items you can prove today, and put the gaps in your 2027 budget. If you’re already mapping next year, our 2027 business technology roadmap can help you sequence the work.
We’ve helped healthcare organizations across the Southeast run on these safeguards for years. If you want a second set of eyes on where you stand, we’ll walk through it with you.
