HHS HIPAA Security Rule Update (2025 NPRM) Guide: What the Proposed Changes Mean and Their Status

The HIPAA Security Rule was written for the healthcare IT of 2003, and HHS has proposed the biggest rewrite since then, but nearly two years later the proposal is still not final. On 6 January 2025 the HHS Office for Civil Rights (OCR) published a notice of proposed rulemaking (90 FR 898) that would make almost every safeguard mandatory, and require multi-factor authentication, encryption, an asset inventory and network map, and restoration of critical systems within 72 hours. This guide explains what the proposal would require, its status as checked on 24 October 2026, and what security, compliance and identity teams at covered entities and business associates should do while they wait. It covers the proposed changes only; for the rule in force today see the HIPAA Security Rule Guide.

Key takeaways

• It is still a proposal. As of 24 October 2026 no final rule has been published, the only Federal Register document under RIN 0945-AA22 is the January 2025 NPRM, and HHS states the current Security Rule remains in effect.
• The timetable has slipped. The Spring 2025 Unified Agenda listed the rule at final rule stage with a May 2026 target; the latest agenda moved it to Long-Term Actions with a final action date of July 2027.
• Addressable would become required. The NPRM would remove the distinction between required and addressable implementation specifications, with limited exceptions, and require written documentation of everything.
• The proposed controls are good practice anyway. MFA, encryption, asset inventory, six-monthly vulnerability scans, annual penetration tests, segmentation and tested backups would reduce real risk whether or not the rule is finalised, and the current rule's risk analysis already points towards most of them.
• Non-human identities are in scope by implication. Asset inventory, access change notices and MFA would reach service accounts, API integrations and AI agents that touch ePHI, which most HIPAA programmes do not inventory today.

Scope: who and what is covered

The proposal amends 45 CFR parts 160 and 164, so its scope is the same as the existing Security Rule.

• Covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct standard electronic transactions.
• Business associates: organisations that create, receive, maintain or transmit ePHI on behalf of a covered entity, including cloud, billing, IT support and software providers, and their subcontractors. The NPRM adds direct obligations on them, such as annual verification of technical safeguards and 24-hour notice of contingency plan activation.
• Group health plans: the NPRM would require plan documents to carry certain Security Rule requirements.
• What is protected: electronic protected health information (ePHI) and, under the proposal, the technology assets and relevant electronic information systems that create, receive, maintain or transmit it. The proposed inventory and network map make the scope of systems explicit rather than implied.

The NPRM does not change who is a covered entity. State health privacy laws and the FTC Health Breach Notification Rule sit outside it; see the Health Data Privacy Beyond HIPAA Guide (My Health My Data).

Key obligations

HHS lists the proposed changes in its NPRM fact sheet. The table groups them and compares each with the current rule.

HHS describes most changes as making existing obligations explicit and more detailed rather than creating new duties. The NPRM states that the current reasonable-and-appropriate analysis would no longer apply to encryption, which would be expressly required. Several details, such as the precise exceptions for MFA and encryption, are set out in the proposed regulatory text and could change in a final rule, so treat the summaries above as the direction of travel.

Timeline and current status

Long-Term Actions means HHS does not expect to act within the next 12 months, and agenda dates are targets rather than commitments. Commentators have suggested HHS may finalise only part of the proposal; that is speculation, and nothing official says which parts would survive. If a final rule is published, the NPRM proposed an effective date 60 days after publication and a compliance date 180 days after the effective date, with a transition period (proposed 45 CFR 164.318) for updating business associate agreements. Those periods could change in the final rule. Check the Federal Register and HHS OCR pages before relying on any date in this guide.

Enforcement and penalties

Until a final rule takes effect, OCR enforces the current Security Rule, and nothing in the NPRM is enforceable. Enforcement mechanics would not change under the proposal.

• Civil money penalties: 45 CFR 160.404 sets four culpability tiers, from violations the entity did not know about and could not have known with reasonable diligence, through reasonable cause, to willful neglect corrected within 30 days and willful neglect not corrected. The statutory amounts are adjusted for inflation each year in 45 CFR part 102, so check the current figures there rather than quoting the base amounts.
• Annual caps: penalties are capped per calendar year for identical violations, which is why OCR settlements often cite several distinct provisions.
• Risk analysis is the usual finding: a missing or inadequate risk analysis under the current 45 CFR 164.308(a)(1) is among the most common findings in OCR resolutions. The NPRM's detailed risk analysis content would make the expected standard clearer.
• Recognised security practices: under a 2021 amendment to the HITECH Act, OCR must consider whether an entity had recognised security practices (such as the NIST CSF or the HHS 405(d) Health Industry Cybersecurity Practices) in place for the previous 12 months when deciding penalties and audit outcomes. Implementing the NPRM controls now is a good way to build that record.

Breach notification is a separate rule (45 CFR 164.400 to 414) and is not changed by this NPRM. See the Data Breach Notification Checklist.

What it means for AI agents and non-human identities

The NPRM preamble names artificial intelligence among new technologies that bring increased risks and vulnerabilities to ePHI, and says regulated entities must be prepared to identify, mitigate and remediate them. It does not create AI-specific provisions. The practical effect comes through the general requirements, which apply to any software or account that touches ePHI.

• Inventory: a technology asset inventory and ePHI map would have to include integration accounts, interface engines, API clients, RPA bots and AI agents that read or write ePHI. Most healthcare organisations have no list of these. See the Service Account Inventory Template.
• MFA and its exceptions: MFA cannot be applied to a service account in the human sense. Expect to document workload authentication (certificates, short-lived tokens, managed identities) as the control, and to justify any exception. See the Service Account Security Guide.
• 24-hour access changes: the proposed notice applies to workforce members, but the same discipline should apply to API keys and tokens issued to vendors and agents: revoke them when the integration or project ends.
• Business associate verification: AI scribes, coding assistants and analytics vendors that handle ePHI are business associates. Annual verification of their technical safeguards would need to cover how their agents authenticate to your systems and how they store tokens.
• Audit and monitoring: agent actions on ePHI need attributable logs (which agent, on whose behalf, which record). See the Identity Governance for AI Agents Guide.

The Change Healthcare breach in February 2024 started with a stolen credential on a Citrix remote-access portal that did not require MFA, and UnitedHealth later put the number of people affected at 192.7 million. It is the clearest illustration of why the NPRM makes MFA and asset inventory explicit, and of how a single remote access path can reach a whole sector. For healthcare identity patterns more broadly, see the Healthcare Identity Security Guide.

Compliance steps

A sensible plan treats the NPRM as a target state and the current rule as the legal floor. The steps below are ordered so that each one is useful even if the final rule differs.

1. Run a gap assessment against the NPRM fact sheet. For each of the proposed changes, record current state, owner and effort. Separate items where the current rule already expects action through risk analysis (for example encryption you previously documented as not reasonable) from genuinely new items (asset inventory and network map, 72-hour restoration, annual compliance audit).
2. Build the technology asset inventory and ePHI map. Include systems, medical devices, cloud services, integrations and non-human accounts. This feeds the risk analysis and is the foundation for everything else.
3. Refresh the risk analysis. Use the inventory and map, identify threats and vulnerabilities, and rate risk levels in writing.
4. Close identity gaps first. Enforce MFA on remote access, email, administrative access and EHR access from outside the network, starting with internet-facing portals. Pilot with one department, measure help desk impact, and keep a documented break-glass route for clinical emergencies. See the MFA Guide.
5. Encrypt at rest and in transit. Prioritise laptops, mobile devices, backups, databases and interfaces still using unencrypted protocols. See the Encryption Guide.
6. Set up vulnerability scanning and penetration testing. Scan at least every six months, test at least every 12 months, and record remediation. See the Penetration Testing Guide.
7. Prove 72-hour restoration. Perform a criticality analysis, protect backups with separate controls, and run a timed restore of one critical system. If it takes longer than 72 hours, that is your gap. See the Backup Security and Immutable Backup Guide.
8. Update business associate management. Identify which BAAs would need amendment, and start collecting annual written safeguard verifications from the most critical BAs.
9. Write the incident response plan and test it. Include reporting procedures and a schedule for testing and revision.
10. Track the rulemaking. Assign an owner to watch the Federal Register and Unified Agenda, and re-plan when a final rule appears, since the compliance window proposed was only 180 days after the effective date.

Decision guidance by organisation size

Measuring progress

• MFA coverage: percentage of users and remote access paths with ePHI access protected by MFA.
• Inventory completeness: percentage of ePHI systems and non-human accounts in the inventory with an owner.
• Encryption coverage: percentage of ePHI data stores and interfaces encrypted at rest and in transit.
• Restore time: measured time to restore each critical system in the last test, against the 72-hour target.
• Vulnerability age: median days to remediate critical findings from scans.
• BA verification: percentage of critical business associates with a current written safeguard verification.

Framework mapping

Common failure patterns

• Waiting for the final rule: pausing work because the rule slipped to 2027 leaves the same gaps that attackers use today, and a 180-day compliance window is short for MFA and encryption across a health system.
• Treating addressable as optional today: under the current rule an addressable specification still needs a documented decision. "Not implemented" without a reason is already a finding.
• Remote access without MFA: the Change Healthcare portal shows the cost.
• Inventories that list only servers: integrations, interface engines, service accounts and AI tools are left out, so they never get reviewed.
• Backups that cannot meet 72 hours: backups exist but have never been restored at scale, or share credentials with production and are encrypted by the same ransomware.

Practitioner checklist

• Confirm the current status of RIN 0945-AA22 on the Federal Register and reginfo.gov each quarter.
• Keep complying with the current Security Rule and document all addressable decisions.
• Complete a gap assessment against the NPRM fact sheet with owners and dates.
• Build a technology asset inventory and ePHI network map including non-human accounts and AI tools.
• Enforce MFA on all remote access and internet-facing portals that reach ePHI.
• Encrypt ePHI at rest and in transit and record any exceptions with compensating controls.
• Schedule six-monthly vulnerability scans and an annual penetration test.
• Run a timed restore of a critical system and compare it with 72 hours.
• Start annual written safeguard verification for critical business associates.
• Write, test and revise the incident response plan.

Standards and references

• Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (90 FR 898)
• HHS: HIPAA Security Rule NPRM Fact Sheet
• HHS: HIPAA Security Rule Notice of Proposed Rulemaking
• OIRA reginfo.gov: Unified Agenda entry for RIN 0945-AA22
• eCFR: 45 CFR 160.404 Amount of a civil money penalty
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5
• Davis Wright Tremaine: HHS Updates HIPAA Rulemaking Timeframes

Related NHI Mgmt Group resources: HIPAA Security Rule Guide · Healthcare Identity Security Guide · Data Breach Notification Checklist · Health Data Privacy Beyond HIPAA Guide (My Health My Data). This guide summarises the HHS proposed amendments to the HIPAA Security Rule and their status as of 24 October 2026 and is not legal advice.