What HIPAA's Proposed 2025 Security Rule Update Means for Your Practice

Where the rule stands

The proposal came from the HHS Office for Civil Rights as a Notice of Proposed Rulemaking, and it would be the first major rewrite of the Security Rule since 2013. The comment period closed on March 7, 2025 with more than 4,000 comments. As of October 2026 nothing has been finalized, and the federal regulatory agenda now lists it as a long-term action, with July 2027 as the target for a final rule.

We point that out because a good deal of vendor marketing has described these requirements as if they already apply. They don’t, and if someone is selling you urgency on that basis, the urgency is manufactured.

What’s worth taking seriously is the direction. The proposal spells out what regulators now consider the baseline.

What the proposal would change

The end of “addressable”

This is the biggest change. Today the Security Rule marks some specifications “addressable,” meaning a practice can document why an alternative is reasonable given its size and circumstances. The proposal would make essentially everything mandatory.

Smaller practices lean on that flexibility more than they realize. If the rule is finalized as proposed, the “we documented why this wasn’t reasonable for a practice our size” position largely goes away.

MFA everywhere

Multi-factor authentication (MFA) would be required on every system that touches electronic patient information. There’d be no exceptions for convenience, and none for the physician who finds it irritating.

Encryption at rest and in transit

Encryption is addressable today and would become required. In practice that means full-disk encryption on every laptop and workstation, encrypted backups, and encrypted connections for anything carrying patient information.

Asset inventory and network map

You’d need an up-to-date inventory of the systems that hold patient information and a map of how data moves between them, reviewed at least once a year. Most practices are further from this one than any other. Very few can produce a current inventory.

Regular technical testing

The proposal calls for vulnerability scans every six months and a penetration test every year.

Network segmentation

Systems would be separated so that a compromise in one area can’t move freely into the systems holding patient information. If your medical devices and imaging equipment share one flat network with the reception computers, that’s a real change to how the network is built.

72-hour restoration

Critical systems and data would have to be restored within 72 hours of an incident. That turns backups from a box you tick into something you’ve tested, with a clock running.

Written incident response plans

You’d need written procedures for a security incident, with defined roles, and you’d need to test them before you need them.

What to do now

We wouldn’t treat a proposed rule as if it were final. But most of these items lower your risk today, and they’re already expected under the current rule or by your cyber insurer.

Worth doing whatever the final rule says

• Turn on MFA, starting with email and remote access. It costs little and closes the most common way in.
• Restore something from your backups and write down the date. Knowing the backup job ran tells you nothing about whether the restore will work.
• Use full-disk encryption on every laptop and portable device. Losing an unencrypted laptop with patient data on it is usually a reportable breach. Losing an encrypted one generally isn’t.
• Build the asset inventory. It’s tedious, and everything else on this list depends on it.
• Put medical devices on their own network segment, away from general office systems. Imaging equipment and other connected devices are often the least-patched machines on a medical network. Dental offices feel this most; our page on IT support for dental offices covers the imaging side.

What can wait for the final rule

A formal program of scans every six months and yearly penetration tests, and a documented 72-hour recovery objective, can reasonably wait until the final rule is published. They cost real money, and the final requirements may differ from the proposal.

Start with knowing where patient information lives

The current Security Rule already requires a written review of where patient information lives and what could go wrong, along with access controls, activity logs and workforce training. The finding that keeps coming up in OCR enforcement actions is a practice that never did that review accurately and thoroughly, under a rule that has applied since 2005.

If your practice doesn’t have a current one, that’s the gap worth closing this quarter. The proposed rule is a 2027 question at the earliest. A missing review is a problem today. Our HIPAA checklist for medical practices walks through it, along with the other 14 items the current rule asks for.

Check the status yourself

Regulatory timelines move. Before you act, check the HHS Office for Civil Rights website and the federal regulatory agenda entry (RIN 0945-AA22) for the current status, rather than relying on any article, this one included.

Before you pick someone to help with this, see the questions worth asking an IT provider. And if you’d like a second opinion on what, if anything, your practice should do now, book a free IT check-in. You can also read about our IT support for medical practices.

This article is general information, not legal advice. For questions about your practice’s specific obligations, talk to your attorney or compliance advisor.