The HIPAA Security Rule update: what the January 2025 proposal would change, and where it stands

Where the HIPAA Security Rule update stands

The proposed HIPAA Security Rule update has not become law. The Department of Health and Human Services (HHS) announced a notice of proposed rulemaking on 27 December 2024 and published it in the Federal Register on 6 January 2025 as "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information" (90 FR 898, RIN 0945-AA22, docket HHS-OCR-2024-0020). The public comment period ended on 7 March 2025.

HHS says on its own page for the proposal that the current Security Rule remains in effect while the rulemaking continues. A search of the Federal Register on 29 September 2026 found no final rule, no withdrawal and no extension of the comment period for this rule. The federal regulatory agenda has moved its expectation back: the Spring 2025 edition placed the rule at the final rule stage, while the latest edition lists it among long-term actions.

Agenda dates are the Department's forecasts. The only event that creates new obligations is a final rule published in the Federal Register, and that rule would set its own effective and compliance dates.

What the proposal would change, against the current rule

The proposal keeps the Security Rule's three families of safeguards, administrative, physical and technical, but removes much of the flexibility the 2003 rule gave to regulated entities. The HHS fact sheet summarises the main changes; the table sets each against what the rule requires today. Several proposals carry limited exceptions, which the final text would define.

The fact sheet also lists network segmentation, anti-malware protection, separate controls for backup and recovery, and obligations for sponsors of group health plans.

What it would mean for business associates

Service providers feel the proposal twice: once as regulated entities in their own right, and again through their customers. Two proposals are aimed squarely at the supply chain. Business associates' safeguards would be verified at least every 12 months through a written analysis by a subject-matter expert, and a business associate would tell the covered entity within 24 hours of activating its contingency plan.

For a contact centre, billing company or cloud platform serving US healthcare clients, that points to a yearly evidence request that is more formal than today's due diligence questionnaire, and to incident and continuity procedures that start a notification clock. It also means the flow-down clauses in your own agreements with subcontractors may need revisiting. Business associate agreements: what to sign and what to issue covers the agreements themselves.

How to prepare without treating a proposal as law

Preparing does not mean implementing every proposed item tomorrow. It means building a programme that meets the rule in force, records accurately where it stands against the proposal, and closes the gaps that make sense now.

Meet the current rule first

The risk analysis remains the foundation under both texts. If yours is missing, generic or out of date, fix that before anything else; The Security Rule risk analysis: how to conduct one sets out the method.

Document every addressable decision

Where you decided today that encryption, automatic logoff or another addressable specification was not reasonable and appropriate, the record of that reasoning and the alternative you chose is a current requirement. It is also the list of items most exposed if the distinction disappears.

Add the proposal to the gap analysis

Record each proposed item as met, partly met or not met, with an owner and an estimate of effort. That turns an uncertain rulemaking into a costed plan, and it lets you answer a customer's question about readiness with evidence instead of reassurance.

Prioritise what counts twice

When OCR enforces the Security Rule, the law requires it to consider whether recognised security practices were in place for the previous 12 months. Many proposed items, such as multi-factor authentication, encryption and tested restoration, are practices that strengthen the programme now as well as later. NIST SP 800-66 Revision 2 (February 2024) maps the current Security Rule to NIST cybersecurity controls and is a useful reference while you work.

What goes wrong with the proposed update

• Claiming compliance with a rule that does not exist. Telling a customer you meet "the new HIPAA Security Rule" misstates the law; say you meet the current rule and show where you stand against the proposal.
• Waiting for the final rule. The current rule is enforced today, and the gaps it exposes are usually the same gaps the proposal targets.
• Treating the proposed text as final. A final rule, if published, may differ from the proposal; plan against it, but keep the plan easy to revise.
• Rewriting every policy. Most programmes need targeted changes to the risk analysis, access, encryption, testing and continuity documents, not a new document set; HIPAA documentation: what you need and what you do not explains the minimum.
• Accepting a "certificate" for the new rule. HHS recognises no private HIPAA certification under the current rule, and a proposal cannot be certified against either.

The proposed Security Rule update: questions buyers ask