If your practice handles patient records, you’ve probably heard that the HIPAA Security Rule is getting its first major overhaul in more than a decade. The proposed HIPAA Security Rule changes would turn many of today’s “recommended” safeguards into firm requirements, and they would spell out exactly how often certain security checks have to happen. The rule isn’t final yet, but most of what it asks for is simply good security practice, so the smartest move for a medical, dental, or eye care office is to start closing the gaps now rather than scrambling later.
Where the proposed rule stands today
The U.S. Department of Health and Human Services (HHS) issued its proposal at the end of December 2024, and it was formally published in the Federal Register on January 6, 2025. The public comment period closed on March 7, 2025, after thousands of comments came in from providers, vendors, and industry groups.
HHS originally aimed to finalize the rule in 2026, but that target slipped. The federal regulatory agenda now points to July 2027 for a final rule, and the final version may differ from the proposal. Under the proposal, a final rule would take effect 60 days after publication, with compliance required 180 days after that. In other words, once the final rule lands, practices would have roughly eight months to be ready.
The biggest proposed HIPAA Security Rule changes
The headline change is that HHS proposes to remove the distinction between “required” and “addressable” safeguards. Today, practices can document why an addressable item isn’t reasonable for them and use an alternative. Under the proposal, nearly all safeguards would become mandatory, with only narrow, documented exceptions. Other notable proposals include:
- Written documentation of all security policies, procedures, plans, and analyses.
- A technology asset inventory and a network map showing how electronic patient information moves through your systems, reviewed at least once every 12 months and whenever something changes.
- Multi-factor authentication for access to systems containing electronic protected health information (ePHI), with limited exceptions.
- Encryption of ePHI both at rest and in transit, again with limited exceptions.
- Vulnerability scanning at least every six months and penetration testing at least once a year.
- Network segmentation, anti-malware protection, and backup and recovery controls, plus written procedures to restore certain critical systems within 72 hours.
- An annual compliance audit and a regularly updated risk analysis.
- Stronger business associate oversight, including written verification at least once a year that vendors handling patient data have the required safeguards in place, and notice within 24 hours when a vendor activates its contingency plan.
Why waiting for the final rule is risky
It’s tempting to hold off until HHS publishes the final version. The problem is that several of these items take real time to put in place. Building an accurate asset inventory and network map, rolling out multi-factor authentication to every user, and confirming that backups can actually restore your practice management and imaging systems are projects measured in weeks or months, not days.
There’s also a practical reason to act now: ransomware and email-based attacks against healthcare offices aren’t waiting for a rule change. Multi-factor authentication, encryption, tested backups, and regular vulnerability scans protect your patients and your schedule today, whatever the final rule ends up saying.
A practical checklist to start on now
Most small practices can make meaningful progress with a handful of focused steps:
- Inventory your technology. List every computer, server, network device, cloud service, and medical device that stores or touches patient data.
- Map your network. Document how data flows between your EHR, imaging equipment, billing systems, and outside vendors.
- Turn on multi-factor authentication for email, remote access, and any system with patient records.
- Confirm encryption on laptops, servers, backups, and email.
- Test a restore. Don’t just confirm backups are running. Make sure you can actually bring a critical system back quickly.
- Schedule vulnerability scans and plan for an annual penetration test.
- Review your business associate agreements and ask key vendors how they protect your data.
- Update your risk analysis and written policies so they reflect how your office actually works today.
A managed IT provider can take much of this off your plate, from inventory and monitoring to scanning and documentation. Our cybersecurity solutions are built to help small offices put these safeguards in place and keep them current.
What this means for your practice
Whether the final rule arrives in 2027 or later, the direction is clear: regulators expect healthcare offices to treat cybersecurity as a documented, routinely tested part of operations, not a one-time project. Practices that start now will be ready to meet the deadline when it comes, and better protected in the meantime. This article is general information, not legal advice. Your compliance officer or attorney can help you interpret how the final rule applies to your organization.
We work with medical practices, dental offices, and eye care practices across New Jersey to build security programs that hold up to HIPAA scrutiny. If you’d like help getting ahead of the proposed HIPAA Security Rule changes, contact us or call 732-808-0577 to talk with our team about cybersecurity for your practice.
Need hands-on help with this? See our Cybersecurity Solutions →