Where the rulemaking stands

HHS published a proposed rule to update the HIPAA Security Rule in January 2025. It was widely expected to be finalized in 2026, with a May 2026 target at one stage. Law-firm and trade reporting based on the mid-2026 regulatory agenda now describes final action as projected for July 2027, with the item moved from the final-rule stage to long-term actions. Agency timetables are not binding, so the date could shift again.

Crucially, the existing Security Rule remains fully in effect and enforceable until any final rule replaces it. The Privacy Rule is a separate track.

Some websites claim the update has already been finalized. The agenda and law-firm reporting contradict that, so treat those claims with suspicion.

What the proposal signals

The proposal would remove the long-standing distinction between required and addressable safeguards, making most controls mandatory. It describes expectations such as maintaining a technology asset inventory and network map, encrypting electronic health information in transit and at rest with limited exceptions, multi-factor authentication, regular vulnerability scanning and penetration testing, and tested plans to restore systems within a short window after an incident.

Whether each item survives in the final rule is uncertain. But they track where enforcement and customer expectations already are. The Office for Civil Rights has been pressing on risk analysis, and healthcare buyers increasingly ask for these controls in security reviews.

Encryption and MFA

Protect data in transit and at rest and require strong authentication for access to health information systems.

Inventory and recovery

Know every system that touches ePHI and prove you can restore it within a defined window.

A practical plan

Treat the proposed controls as a roadmap you can execute in stages. Start with an accurate asset inventory and a current, documented risk analysis, since both underpin everything else. Then close gaps in encryption, authentication, scanning, and recovery testing, in order of risk.

Doing this now means a final rule, whenever it arrives, becomes a gap check rather than a program. It also makes the sales conversation easier.

Building health-tech and unsure of your security gaps? Talk to us about a HIPAA-oriented security review.

Key takeaways

  • The HIPAA Security Rule overhaul, proposed in January 2025, is reportedly projected for final action in July 2027.
  • The current rule remains fully in effect and enforceable.
  • The proposal points to asset inventory, encryption, MFA, scanning and testing, and recovery planning.
  • Build those controls now in order of risk; a final rule then becomes a gap check.
This is general information, not legal advice. It reflects agency-agenda reporting and law-firm summaries as of October 2026; check the Federal Register and HHS for current status.