The HIPAA Security Rule update: what the 2025 proposal would require

HHS proposed the first full rewrite of the HIPAA Security Rule since 2013 on January 6, 2025: mandatory encryption of all electronic protected health information (ePHI), mandatory multi-factor authentication (MFA), and the end of the rule's "addressable" safeguards that regulated entities could previously choose not to implement. It is still only a proposal. The government's own regulatory agenda, last updated in December 2025, now targets July 2027 for a final rule, pushed back from an earlier May 2026 target, and classifies the whole rulemaking as a "Long-Term Action."

What did HHS actually propose?

The notice of proposed rulemaking (NPRM) would amend the Security Rule at 45 CFR Parts 160 and 164, the regulation under HIPAA and the HITECH Act that sets technical, administrative and physical safeguards for ePHI. HHS's own stated reasons are changes in how health care is delivered, a rise in breaches and cyberattacks, the compliance gaps its Office for Civil Rights (OCR) has found during investigations, and court decisions affecting enforcement.

The docket (HHS-OCR-2024-0020) drew 4,747 public comments before the window closed; the proposal has not moved since.

Would the proposal end "addressable" safeguards?

Yes. Today's Security Rule sorts each implementation specification as "required" or "addressable," and an addressable specification can be skipped if a regulated entity documents why it isn't reasonable and appropriate. The proposal removes that choice: an entity would have to implement each specification, or implement a documented, equally protective alternative — simply deciding not to act would no longer be an option.

Would encryption become mandatory?

Yes, with limited exceptions. Encrypting ePHI is currently addressable; a new proposed implementation specification at 45 CFR 164.312(b)(2) would require a regulated entity to encrypt all ePHI it maintains and all ePHI it transmits, at rest and in transit. HHS proposes exceptions only for specific, documented circumstances, among them a device that cannot support encryption without replacement and emergencies in which encryption is genuinely infeasible.

Would multi-factor authentication become mandatory?

Yes. The NPRM adds a formal definition of multi-factor authentication and a new specific requirement at proposed 45 CFR 164.312(f)(2)(ii)(A) to deploy MFA across every technology asset in an entity's relevant electronic information systems. A second part of the same proposal, at 164.312(f)(2)(ii)(B), would require MFA specifically for any action that changes a user's privileges in a way that could affect the confidentiality, integrity or availability of ePHI. As with encryption, HHS proposes narrow exceptions, including for legacy devices that cannot support MFA and certain FDA-regulated devices.

What are the proposal's 24-hour and 72-hour deadlines — are either a breach-notification clock?

No. Neither new deadline in the NPRM is a breach-notification requirement, a distinction some secondary coverage of the proposal has blurred. The 24-hour deadlines cover internal and contractual notice: a regulated entity would have to tell any other regulated entity that shares access to the same systems within 24 hours of changing or terminating a workforce member's access, and a business associate would have to report the activation of its own contingency plan to the covered entity within 24 hours, a change the NPRM states explicitly "would not alter the business associate's breach reporting obligations under the Breach Notification Rule." The 72-hour deadline is a disaster-recovery requirement: a regulated entity would have to restore its critical relevant electronic information systems and data within 72 hours of a loss, as part of its contingency plan, not notify anyone of a breach within that window.

What else does the proposal add?

A new standard would require every regulated entity to keep a written, accurate technology asset inventory and a network map of how ePHI moves through its systems, replacing the current, less specific "security management process" standard. A separate new technical-safeguards standard would require vulnerability scanning, monitoring of authoritative threat sources such as CISA alerts, and penetration testing at least once every 12 months, with patching required within a reasonable time after a vulnerability is found. HHS also proposes a wholly new standard for compliance audits: a regulated entity would have to perform and document, at least once every 12 months, its own audit of compliance with every standard and implementation specification in the Security Rule. And a business associate would have to give its covered entity written verification that it has deployed the required technical safeguards, renewed on an ongoing basis.

Is it final yet, and when would it take effect?

No. As of this page's review, no final rule has been published in the Federal Register; the government's own Unified Agenda lists only the January 2025 NPRM and a future, not-yet-reached "Final Action" date. That target has already slipped once, from May 2026 in the Spring 2025 edition of the agenda to July 2027 in the Fall 2025 edition, and the rulemaking is now coded as a long-term, not near-term, action. If HHS does finalize the rule, its own text sets an effective date 60 days after publication, with regulated entities generally given 180 days from that effective date to come into compliance.

How should a security leader at a covered entity or business associate use this now?

Treat the NPRM as a reliable preview of direction, not a deadline. The specific dates in this proposal (60 days to effective, 180 days to compliance) only start running once a final rule publishes, and the government's own timetable now puts that well into 2027 at the earliest. The substance is unlikely to soften much given OCR's stated reasons for proposing it, so an organization that has not yet encrypted all ePHI at rest and in transit, deployed MFA everywhere, built a real technology asset inventory and network map, or started regular vulnerability scanning and penetration testing is behind where this rule would put it, regardless of when or whether it is finalized exactly as proposed. The clearest near-term step is auditing current practice against the specific proposed citations above, since OCR's existing enforcement already treats several of them as the kind of safeguard a "reasonable and appropriate" risk analysis should flag today.

Where it appears on Daily CISO

The federal cybersecurity executive orders guide covers the parallel federal deadlines for agencies and contractors, and the security glossary defines the underlying terms this proposal touches, including encryption and multi-factor authentication.