The HIPAA Security Rule Is Getting Its Biggest Overhaul in 20 Years. Here's What's Actually Changing.

If you're in health tech, you've probably heard that the HIPAA Security Rule update got pushed back again. The latest timeline puts the final rule at July 2027. Before that, there's a 60-day public comment period that hasn't started yet.

Some companies are treating this delay as permission to wait. That's a mistake.

The current HIPAA Security Rule was last meaningfully updated in 2013. The proposed overhaul, which HHS published in late 2024, is the most significant revision since the rule was written. Here's what's in it:

Encryption everywhere. The proposed rule eliminates the "addressable" designation for encryption. Under the current rule, encryption is technically optional if you document why you didn't implement it. Under the new rule, encryption of ePHI at rest and in transit would be required. No more risk acceptance workarounds.

Mandatory MFA. Multi-factor authentication would be required for all systems that access ePHI. This is already a best practice, but a lot of health tech companies still have gaps, particularly around internal tools, staging environments, and admin accounts.

72-hour notification to business associates. Covered entities would need to notify business associates within 72 hours of activating their contingency plan. This tightens the communication loop during incidents significantly.

Annual compliance audits. The proposed rule requires annual security audits, not just periodic risk assessments. There's a difference. A risk assessment identifies threats and vulnerabilities. An audit evaluates whether your controls are actually working.

Technology asset inventory. You'd need to maintain a current inventory of all technology assets that create, receive, maintain, or transmit ePHI, and create a network map showing how ePHI moves through your environment.

Patch management timelines. Critical vulnerabilities would need to be patched within 15 days. High-severity within 30 days. This is more aggressive than what most companies are doing today.

The final rule might land in July 2027. Or it might slip again. But here's the thing: almost everything in this proposed update reflects what enterprise buyers, cyber insurers, and auditors are already asking for.

If you're going through HITRUST certification, you're already covering most of this. If you're selling into health systems or pharma, your security questionnaires already ask about encryption, MFA, and patching timelines. The rule is catching up to market expectations, not getting ahead of them.

Companies that wait for the rule to be finalized before acting are going to find themselves scrambling to implement changes that their competitors already have in place. And in health tech, where security posture directly affects sales cycles, that's a competitive disadvantage.

Audit your encryption posture. Are you encrypting ePHI at rest in every database, backup, and file store? Are there gaps in your staging or development environments where real data might exist?

Close your MFA gaps. Not just for production systems. Admin panels, CI/CD pipelines, cloud consoles, and internal tools that touch patient data all need MFA.

Get your asset inventory current. If you can't produce a complete list of systems that handle ePHI, start there. You can't protect what you can't find.

Review your patch management timeline. Can you actually patch critical vulnerabilities in 15 days? If not, figure out what's slowing you down and fix the process.

Consider a gap assessment. Compare your current controls against the proposed rule requirements. Identify what you're already doing, what needs work, and what needs to be built from scratch. This is easier to do now, without deadline pressure, than it will be in 2027.