Key Challenges in the Proposed HIPAA Security Rule Update
On March 6, 2026, a significant announcement was made regarding the potential overhaul of the HIPAA Security Rule, which has not seen substantial changes in over 20 years. As highlighted by Tom Walsh, this proposed update comes in response to the increasing threats posed by cybercriminals and the growing incidence of healthcare breaches. The proposed changes may be finalized as early as May 2026, although specific timelines remain uncertain. Nonetheless, the update introduces substantial new requirements that align with contemporary cybersecurity practices and established industry frameworks.
In January 2025, the U.S. Department of Health and Human Services’ Office for Civil Rights issued a Notice of Proposed Rulemaking aimed at strengthening the HIPAA Security Rule. This move reflects the urgent need for enhanced security measures in the healthcare sector. The contemplated modifications mark a shift from the previous flexible, risk-based compliance model to a more prescriptive framework, which could impose stricter mandates on healthcare organizations.
Key Challenges
The proposed updates focus on several critical areas that present significant challenges for healthcare entities:
-
Mandatory Implementation Specifications: One of the foremost changes involves the elimination of the distinction between “required” and “addressable” implementation specifications. This means that all organizations would be obliged to adhere to a more stringent set of requirements, significantly impacting how they interpret and apply HIPAA guidelines.
-
Revised Citation Practices: With the implementation of new citations necessitated by this overhaul, organizations will face the labor-intensive task of updating their control mappings. This change means many existing standards will be renumbered or reorganized, requiring comprehensive adjustments across systems and documentation.
-
Frequency of Reviews: The proposed update mandates that numerous safeguards must now be reviewed and tested at least annually. In some cases, the requirements will necessitate more frequent assessments, further emphasizing the need for continuous monitoring and evaluation of cybersecurity measures.
-
Asset Inventories and Network Maps: Organizations will be required to maintain detailed inventories of their technology assets and data flow maps. This includes thorough documentation of where Protected Health Information (PHI) is created, stored, processed, and transmitted, placing added responsibility on entities to track and secure sensitive information.
-
Formal Compliance Audits: The proposed changes introduce a requirement for documented audits to validate compliance with the Security Rule. This formalization of audit processes will compel organizations to develop more structured approaches for demonstrating adherence to security protocols.
-
Enhanced Risk Analysis: The update seeks to clarify expectations surrounding risk analysis and management. Organizations will need to refine their approaches to identifying and mitigating risks associated with PHI, aligning them with newly established standards.
-
Vulnerability Management: Under the proposed guidelines, organizations must conduct vulnerability scans every six months and undergo annual penetration testing performed by qualified personnel. These activities are critical for identifying and addressing potential security weaknesses.
-
Patch Management Timelines: The timelines for applying critical patches are also being revised. Organizations will be required to apply critical patches within 15 days and other updates within 30 days to ensure that systems remain secure against emerging threats.
-
Multifactor Authentication: The requirement for multifactor authentication for systems that handle PHI is another significant facet of the proposed changes. This enhancement aims to bolster access controls and reduce the risk of unauthorized access to sensitive information.
-
Timely Access Termination: Organizations must ensure that system access is terminated within one hour of employee termination, and within 24 hours for third-party systems. This swift action is crucial for minimizing the risk of data breaches following staff departures.
-
Business Associate Oversight: The updates will necessitate annual written verification and certification of technical safeguards from business associates, moving beyond merely having a signed business associate agreement. This change emphasizes a more stringent approach to managing third-party risks.
- Mandatory Encryption: Finally, the proposed update will include a firm requirement for the encryption of PHI both at rest and in transit. This measure is vital to safeguarding sensitive patient data against unauthorized access and breaches.
The Bottom Line
The envisioned revisions to the HIPAA Security Rule indicate a decisive shift toward standardized and enforceable cybersecurity controls that align with current best practices in the industry. The need for healthcare organizations to proactively assess their existing practices and address any gaps has never been more pressing. As the regulatory landscape evolves, entities must prepare themselves for a more structured and rigorous compliance environment, underscoring the importance of cybersecurity in safeguarding sensitive health information. The proactive measures organizations implement now could prove essential in navigating the complexities of the new requirements and mitigating the risks posed by cyber threats.