As of 12 October 2026, the HIPAA Security Rule update is still only a proposal. HHS published the proposed rule on 6 January 2025 and closed comments on 7 March 2025. No final rule has been published, and the most recent federal Regulatory Agenda moved it to “Long-Term Actions,” with final action projected for July 2027. The Security Rule you must comply with today is the one last amended in 2013. Most of what the proposal would require, such as encryption, MFA, asset inventories, tested backups and regular audits, is still worth building now, because it is what OCR already expects to see in a risk analysis. This page tracks the status with dates and sources, and we update it as the rulemaking moves.
1. Status Tracker, With Dates and Sources
| Date | Event | Source |
|---|---|---|
| 6 January 2025 | Notice of proposed rulemaking published: “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information” (90 FR 898, RIN 0945-AA22) | Federal Register |
| 6 February 2025 | Tribal consultation meeting held by OCR | NPRM “Dates” section |
| 7 March 2025 | Public comment period closed | Federal Register |
| Spring 2025 Unified Agenda | Listed at “Final Rule Stage,” final action projected for May 2026 | reginfo.gov (Spring 2025) |
| 2026 Unified Agenda (HHS agenda printed in the Federal Register on 14 August 2026) | Moved to “Long-Term Actions,” final action projected for July 2027 | reginfo.gov (current entry); HHS Regulatory Agenda, 91 FR 52992 |
| 12 October 2026 | No final rule published. The Security Rule text in eCFR (45 CFR 164.306, 164.308 and 164.312) still carries its 2013 amendment date and still uses “addressable” implementation specifications | eCFR, 45 CFR part 164 subpart C |
2. What Is Law Today vs What Is Proposed
The current Security Rule (45 CFR part 164, subpart C) already requires a risk analysis, risk management, audit controls, access controls, person or entity authentication, transmission security, a contingency plan with data backup and disaster recovery, and business associate agreements. What the proposal mostly does is turn flexible language into specific, testable requirements.
| Topic | Law today (2013 text) | Proposed (January 2025 NPRM) |
|---|---|---|
| Addressable specifications | Some specifications are “addressable”: implement if reasonable and appropriate, or document why not and use an equivalent | Distinction removed. All implementation specifications required, with specific limited exceptions |
| Encryption | Addressable (164.312(a)(2)(iv) and (e)(2)(ii)) | Encrypt all ePHI at rest and in transit, with documented exceptions |
| Multi-factor authentication | Not named. You must verify identity (164.312(d)) | MFA for access to relevant electronic information systems, and for privilege changes, with exceptions |
| Asset inventory and network map | Implied by an “accurate and thorough” risk analysis | Written inventory and network map showing how ePHI moves, reviewed at least every 12 months |
| Restoring systems | Disaster recovery plan required; no time limit | Written procedures to restore critical systems and data within 72 hours |
| Backups | Retrievable exact copies required; no frequency | Backups no more than 48 hours older than live data |
| Vulnerability scans | Not named | At least every 6 months, or more often if the risk analysis says so |
| Penetration tests | Not named | At least every 12 months, by a qualified person |
| Patching | Not named | Critical risks within 15 calendar days, high risks within 30, of a patch being available |
| Compliance audit | Periodic evaluation (164.308(a)(8)) | Documented audit against every standard at least every 12 months |
| Business associates | BAA with satisfactory assurances | Written verification at least every 12 months that the BA has deployed the technical safeguards, backed by a written analysis by a qualified person and a signed certification |
| Contingency plan activation | No notice requirement | BAs must tell the covered entity within 24 hours of activating their contingency plan |
| Workforce access changes | Termination procedures (addressable) | Notify other regulated entities within 24 hours when a workforce member’s access to their systems changes or ends |
All figures in the “Proposed” column come from the proposed regulation text in the NPRM. None of them is enforceable today.
3. The Proposed Changes, in Plain Terms
Fewer judgment calls
The biggest structural change is removing “addressable.” HHS says in the NPRM that regulated entities have often treated addressable specifications as optional, and that this was never the intent. If the proposal is finalized, the argument “we documented why encryption wasn’t reasonable” mostly goes away.
Writing things down, and keeping them current
The proposal asks for a lot of written material: the asset inventory and network map, a written risk analysis with specified contents, written policies for patching, access, segmentation and incident response, and a contingency plan with a criticality analysis. Most of it must be reviewed at least once every 12 months, and whenever the environment changes.
Specific technical controls
Encryption at rest and in transit, MFA, network segmentation, anti-malware, secure configuration baselines, the removal of extraneous software, and logging and monitoring of activity in systems that hold ePHI. The NPRM also asks for real-time monitoring and alerting on backups.
Testing that the controls work
Vulnerability scans every 6 months, penetration tests every 12 months, annual tests of the contingency plan and incident response plan, and an annual compliance audit.
Vendors have to prove it
Covered entities would need written annual verification from each business associate, not just a signed BAA. For a software vendor that is a business associate, this is the change most likely to show up in your customers’ procurement questionnaires.
What it would cost
HHS estimated first-year compliance costs of about $9 billion across regulated entities and health plan sponsors, and about $6 billion a year in years two to five. Those cost estimates generated many of the critical comments, and the rule’s scale is one plausible reason the timeline has slipped. HHS has not published its reasons for the delay.
4. If It Is Finalized: How the Compliance Clock Would Run
Under the proposal, a final rule would take effect 60 days after publication, and regulated entities would have the standard 180 days after the effective date to comply (45 CFR 160.105). That is about eight months from publication to enforcement. HHS also proposed a longer transition period for updating existing business associate agreements (proposed 45 CFR 164.318).
If HHS meets its July 2027 projection, which is not guaranteed, compliance would fall in early 2028. The final rule could set different periods. Eight months is short for a full asset inventory, MFA everywhere and a first penetration test, which is the practical reason to start now.
5. What Developers Should Implement Now Anyway
Every item below is either already required, or is the most defensible way to meet a requirement that already exists. OCR has kept enforcing the current rule throughout: its Risk Analysis Initiative settlements in 2026 have turned on missing or inadequate risk analyses, not on the proposed rule.
| Build now | Current requirement it supports | Proposed requirement it gets ahead of |
|---|---|---|
| AES-256 at rest, TLS 1.2+ in transit, everywhere ePHI lives (database, files, backups, queues, logs) | 164.312(a)(2)(iv), (e)(2)(ii); breach safe harbor for encrypted data | Mandatory encryption |
| MFA for staff and admin access, and for privilege changes | 164.312(d) authentication | MFA |
| Append-only audit log of every read, write and export of PHI | 164.312(b) audit controls (required) | Activity logging and review |
| Role-based access and automatic session timeout | 164.312(a)(1), (a)(2)(iii) | Access management, workforce access changes |
| Asset inventory and data-flow diagram generated from your infrastructure code | 164.308(a)(1)(ii)(A) risk analysis | Written inventory and network map |
| Automated, tested backups with a measured restore time | 164.308(a)(7) contingency plan | 72-hour restore, 48-hour backup age |
| Dependency and vulnerability scanning in CI, plus a patch SLA | 164.308(a)(1)(ii)(B) risk management | 6-month scans, 15/30-day patching |
| Separate production, staging and analytics environments | 164.308(a)(4) access management | Network segmentation |
| An annual written self-audit against the Security Rule | 164.308(a)(8) evaluation | Annual compliance audit |
Our guides cover the details: PHI encryption requirements, what to capture in an audit log, and the full HIPAA checklist for app developers. Our free HIPAA compliance checker scores an app against the current rule, and the HIPAA overview explains what each safeguard means.
VertiComply generates healthcare apps (web plus native iOS and Android) with encryption, audit logging, role-based access and session timeouts built in on every plan, which covers several rows of the table above at the application layer. It does not cover the organizational items: your risk analysis, penetration tests, policies and audits are still yours to do. We sign a BAA on request on all paid plans (pricing), not on the free plan, and we do not hold a SOC 2 or HITRUST attestation.
This tracker summarizes a proposed federal rule for general information and is not legal advice.
6. What to Watch for Next
- The next Unified Agenda. Check the reginfo.gov entry for RIN 0945-AA22. A move back to “Final Rule Stage” would be the first sign that publication is close.
- OMB review. A final rule of this size goes to OMB’s Office of Information and Regulatory Affairs before publication. It appears on reginfo.gov’s list of rules under review.
- The Federal Register. The final rule, if it comes, will be published there and will set the effective and compliance dates.
- OCR enforcement. Settlements under the current rule show what OCR expects in the meantime. Our HIPAA violations and penalties guide explains the penalty tiers.
Frequently Asked Questions
Has the HIPAA Security Rule update been finalized?
No. As of 12 October 2026, the rule HHS proposed on 6 January 2025 has not been finalized. The current Unified Agenda lists it as a long-term action with final action projected for July 2027, and the Security Rule in force is the 2013 version.
When will the new HIPAA Security Rule take effect?
Nobody can say yet. If HHS finalizes it, the proposal says it would take effect 60 days after publication, with compliance 180 days after that. The current projection for final action is July 2027, which would put compliance in early 2028, but the date has already slipped once and could change again.
Is MFA required by HIPAA in 2026?
Not by name. The current Security Rule requires you to verify that a person seeking access to ePHI is who they claim to be, and leaves the method to your risk analysis. MFA is the usual way to meet that, and the proposed rule would make it mandatory with limited exceptions.
Is encryption mandatory under HIPAA today?
Encryption is currently an addressable implementation specification, so you must implement it or document why it is not reasonable and use an equivalent measure. In practice that documentation is very hard to defend, and encrypted data that is lost may not count as a reportable breach. The proposed rule would make encryption at rest and in transit mandatory.
Should I wait for the final rule before changing my security program?
No. Most of the proposed requirements are the specific form of obligations that already exist, such as risk analysis, access control, audit controls and contingency planning, and OCR is enforcing those now. If the rule is finalized as proposed, compliance would come about eight months after publication, which is not long for an organization starting from scratch.
Last reviewed 12 October 2026. Status checked against the Federal Register, eCFR and the reginfo.gov entry for RIN 0945-AA22. We will update this tracker when the rule moves. Nothing here is legal advice.