Skip to content
Let’s talk
GREY WING SECURITY
All field notes
Compliance (GRC)

The HIPAA Security Rule Update Slipped. Build It Anyway.

HHS pushed the HIPAA Security Rule update to July 2027. OCR still enforces today's rule. Eight safeguards to build now, and the evidence each leaves.

9 min read

The big HIPAA Security Rule update is late again. HHS published the proposal in January 2025. The Spring 2025 regulatory agenda said a final rule would come in May 2026. It did not. The 2026 agenda moved it to "Long-Term Actions" and now lists July 2027. That date is a plan, not a deadline. Law firm Clark Hill reads the move as a sign that HHS does not expect a final rule within 12 months.

Some teams will read this as a reprieve. We think that is a mistake.

Our view, from the readiness side: build the core of the proposal now. It may not pass as written, and the case holds either way. Today's rule is enforced today. Most of the proposal is plain good security. And health care customers will ask their vendors for evidence long before any final rule kicks in.

What the proposal would change

HHS's fact sheet lists the changes. Here are the big ones.

  • Make every rule item required. The "addressable" label would go away, with a few exceptions.
  • Keep a written list of tech assets and a network map of how ePHI moves. Update both at least every 12 months and after changes that affect ePHI.
  • Require multi-factor authentication (MFA). Require encryption of ePHI at rest and in transit. Both have a few exceptions.
  • Write procedures to restore critical systems and data within 72 hours.
  • Scan for weak spots at least every six months. Run a pen test at least once a year.
  • Tell certain partners within 24 hours when a staff member's access to their ePHI changes or ends.
  • Run a compliance audit at least every 12 months.
  • Have each business associate confirm in writing, at least every 12 months, that it has the required technical safeguards in place. That confirmation would rest on a written analysis by someone with security expertise, certified as accurate by a person who can act for the business associate.

That last item matters most if you sell software to health care. You would be the one writing that confirmation.

What OCR enforces right now

The current rule is not on hold. The Federal Register notice says HHS does not expect to change most existing duties much. One duty sits at the center of current enforcement: the risk analysis. The rule calls for "an accurate and thorough assessment" of risks to ePHI. It is marked "Required."

OCR runs a Risk Analysis Initiative around that one line. Two 2026 cases show how it plays out.

  • In March 2026, OCR settled with MMG Fusion, a Maryland software company and business associate. OCR found three potential violations. It had disclosed the PHI of about 15 million people. It had not done an accurate and thorough risk analysis. And it had not told its customers about the breach. MMG paid $10,000, with OCR noting its financial condition, and agreed to a corrective action plan that OCR will monitor for three years.
  • In April 2026, OCR settled four ransomware cases for a total of $1,165,000. All four had failed to do an accurate and thorough risk analysis. One of the four was a business associate. HHS said this brought the initiative to 13 completed investigations.

Look past the dollar amounts. What stands out is the multi-year corrective action plan, and the same missing document showing up again and again.

A word on the numbers

HHS estimated the proposal would cost about $9 billion in year one. After that, it put the cost at about $6 billion a year for four more years. Look at the inputs before you lean on that. The cost table assumes about 2 hours for the yearly compliance audit. It assumes 1.5 hours to set up MFA, and 3 hours for a pen test. Anyone who has scoped a real pen test will discount those figures.

The pushback has its own bias. The EHR Association is a trade group. It says the work for a single EHR maker would top 12,700 hours. Its members would carry that cost, so treat it as one side's estimate. HHS's model also borrows breach cost figures from IBM and Ponemon. Those are vendor surveys.

So we do not plan around any of these totals. We plan around the controls.

The no-regret list

Each item is either required today or likely to matter under any final rule. Each names the evidence it leaves behind. "Evidence" here means a dated record you can show a customer or a regulator later.

1. Map where ePHI lives

List every system, vendor, and data store that creates, receives, keeps, or sends ePHI. Draw how it flows in and out. OCR's own advice in its settlement notices starts here. Your risk analysis cannot be thorough if this list is wrong.

Evidence: the asset inventory, the data-flow map, and the date of the last update.

2. Write a real risk analysis

Name the threats and weak spots for each system on the map. Rate each risk by how likely it is and how bad it would be. Then write a risk management plan that says what you will fix and by when. A generic template with your logo on it is not a risk analysis.

Evidence: the dated analysis, the plan, and proof that items on the plan closed.

3. Document every "addressable" decision

"Addressable" never meant you can skip it. HHS's own FAQ is clear. If the measure is reasonable for you, you must do it. If not, you use an equivalent measure if one is reasonable. Either way, you write the choice down. Encryption is in this group today. The proposal would make it required, with a few exceptions. If you skipped it somewhere, you need a written reason. If you cannot write one, turn encryption on.

Evidence: a written decision for each addressable item, tied to the risk analysis.

4. Turn on MFA everywhere ePHI is reachable

Start with email, single sign-on, cloud consoles, admin panels, and remote access. Today's rule requires you to verify who is signing in, but it does not name MFA. The proposal would require it. Phishing keeps showing up in OCR cases. One of the four April settlements began with a phishing attack. MFA is the cheapest fix on this list.

Evidence: the sign-in policy, plus a list of any gaps. Each gap needs an owner and a reason.

5. Prove you can restore in 72 hours

Today's rule already requires a backup plan and a disaster recovery plan. Testing those plans and ranking systems by criticality are addressable today. The proposal would add a 72-hour clock. Rank your systems by how critical they are, then run a real restore of the top ones and time it.

Evidence: the criticality ranking, the restore test record, and the time it took.

6. Make offboarding fast and logged

Remove access as soon as someone leaves or changes roles. The proposal would set a one-hour limit when someone leaves. If a customer gave your staff access to their systems, tell them promptly. The proposal would require that within 24 hours.

Evidence: offboarding tickets, with times that match when access was removed.

7. Scan, test, and fix on a schedule

Run vulnerability scans at least twice a year, and pen test the systems that touch ePHI once a year. Track findings to closure. Today's rule asks for periodic evaluation with no set schedule. These intervals come from the proposal.

Evidence: scan reports, the pen test report, and the tickets that fixed what they found.

8. Get ready for the verification ask

If you are a business associate, assume health care customers will ask you to confirm your safeguards in writing every year. Build one evidence pack now and keep it current. We run GRC and security questionnaires for growing teams. We draft the answers and keep the evidence current, and your team signs off. Your team signs the confirmation. We help build the evidence behind it.

Evidence: the current pack, its owner, and the date it was last refreshed.

Illustrative math

Illustrative example, not client data. Say you are a software vendor with 30 health care customers. Under the proposal, each would have to get written confirmation of your safeguards from you once a year. Assume each answer takes 8 hours if you start from scratch. That is 240 hours a year. If you keep one current evidence pack, most of that work happens once, and each answer is a review and a signature. Your numbers will differ. The shape will not.

A practical operating model

You do not need all eight items this month. Do it in three passes.

  • This month: turn on MFA for email, single sign-on, and admin access. Make offboarding same-day. Start the asset list.
  • This quarter: finish the data-flow map. Write the risk analysis and plan. Log every addressable choice. Run one timed restore.
  • Before July 2027: scans and a pen test on schedule, a tested incident response plan, and a customer-ready evidence pack.

Review the inventory and the risk analysis at least once a year, and after any big change. Keep the required documentation for six years from when it was created or last in effect, as the current rule requires.

What we do and do not do

There is no official HIPAA certification. HHS says it does not endorse or recognize private "certifications," and they do not shield anyone from a finding. We help you build and evidence your HIPAA Security Rule safeguards and get ready for assessments and customer reviews. We don't certify HIPAA compliance, and we sign a BAA whenever our work touches PHI. OCR decides compliance, not us and not any badge. For the questionnaire side, see our post on questionnaires before the audit.

If you want help getting your HIPAA evidence in order before the next customer asks, Let’s talk.

Sources

Not sure where to start?

Tell us about your systems and deadline. We’ll reply within one business day.

Let’s talkGet the vendor review checklist

Keep reading

More on compliance (GRC)

All field notes