BY MIKE WILDSMITH:

Managing Consultant at Avertium


The HIPAA Security Rule Notice of Proposed Rulemaking (NPRM) takes a stronger, more prescriptive approach to cybersecurity in healthcare. If finalized, it will prompt healthcare providers, health plans, clearinghouses, and their business associates to significantly enhance documentation, controls, threat detection, and response capacity related to ePHI. Although it could entail increased costs and operational complexity, the ultimate goal is to fortify patient data protection and healthcare system resilience.

Avertium recommends gaining an early understanding of the changes and how they will affect your organization, as well as beginning to integrate new policies and procedures into your HIPAA compliance program today. Let’s take a deeper look at what the NPRM is and what it means for your HIPAA compliance program.

 

what is the hipaa security rule notice of proposed rulemaking?

The Department of Health and Human Services (HHS) reported a sharp rise in cybersecurity incidents, with breaches more than doubling from 2018 to 2023 and affecting more than 1000% more individuals. Clearly, the current Security Rule hasn't kept pace with technology, compliance trends, or escalating threats. These shortcomings underscore vulnerabilities in healthcare systems, as the OCR identified recurring “common deficiencies” during investigations that require targeted fixes.

Proposed on December 27, 2024, by the Office for Civil Rights (OCR) within HHS and published in the Federal Register on January 6, 2025, the HIPAA Security Rule Notice of Proposed Rulemaking is a landmark proposal that aims to modernize HIPAA's security standards for electronic protected health information (ePHI) for the first time in more than a decade.

The Office for Civil Rights (OCR) is currently reviewing more than 2,800 comments submitted by various stakeholders during the public comment period. The target date for finalizing the rule is May 2026, according to OCR’s regulatory agenda. If the rule is finalized as proposed, entities will have approximately 240 days to achieve compliance.

 

key proposed changes

HIPAA Security Rule NPRM ushers in a new era of healthcare cybersecurity and compliance, signaling a decisive shift toward mandatory, prescriptive standards that will transform how organizations protect patient data and ensure regulatory resilience.

 Unified “Required” Standard: All implementation specifications would become mandatory, eliminating the “addressable” vs. “required” flexibility and allowing few exceptions.

 Documentation Requirements: Regulated entities must formalize and maintain written policies, procedures, plans, and analyses covering each Security Rule domain.

 Tech Asset Inventory & Data Flow Mapping: Annual inventories of hardware, software, and media handling ePHI are required, coupled with a network map tracking ePHI movement. Updates are necessary when systems change or ePHI data flows change.

  Enhanced Risk Assessment: The NPRM specifies more detailed risk analysis steps—identifying threats, vulnerabilities, documenting controls, assessing likelihood and impacts—making the process more prescriptive. This includes required vulnerability scanning every six months at a minimum, and annual network penetration testing.

 Incident Response & Recovery: Organizations must formalize incident response plans, restore critical systems within 72 hours, prioritize and document system recovery of critical systems, and conduct annual compliance audits of all implemented technical controls.

 Technical Controls: Mandatory encryption of ePHI at rest and in transit (subject to narrow exceptions), required multi-factor authentication, regular vulnerability scans, penetration tests, and backup controls.

 

impacts on healtcare organizations

Operational Impact

The operational impact of the HIPAA Security Rule NPRM is significant, marking a shift from flexible to prescriptive standards that require much tighter controls. Organizations will need to overhaul their documentation processes, conduct annual audits, establish clear incident recovery timelines, and enforce technical protocols such as multi-factor authentication (MFA), encryption, vulnerability scans, and penetration testing.

Financial & Resource Burden

Financially, the burden is substantial, with estimated compliance costs ranging from $9 to $9.3 billion in the first year alone. This has led industry groups, including CHIME and NHCA, to urge rescinding the NPRM due to the high costs and the strain it would place on providers, particularly smaller organizations.

For many healthcare organizations, the financial and resource burden of these requirements will be notable. Increased spending on cybersecurity tools, compliance audits, and workforce training will be necessary, while staffing needs may also rise to address more rigorous documentation and technical mandates. Smaller practices, in particular, may need to seek external support or shared solutions to meet the heightened standards efficiently.

Risk Management & Patient Trust

From a risk management perspective, strengthening cybersecurity measures is expected to reduce data breaches and protect sensitive patient health information (PHI) from misuse throughout a patient’s life. Enhanced incident response capabilities, such as the requirement to restore critical systems within 72 hours, are designed to limit disruptions in care, thereby supporting patient safety and trust.

Strategic & Competitive Advantage

Strategically, organizations that proactively align with the NPRM’s framework can demonstrate robust risk management and resilience, potentially gaining a competitive edge. The process of creating required documentation, network maps, and inventories will also lay the groundwork for more advanced cybersecurity programs in the future.

 

what healthcare entities should do now

Proactively understanding and preparing for the coming changes is key to seamlessly integrating these new practices into your operations. Here’s what you can do today to ready yourself:

  • Analyze the NPRM closely and review how it differs from current HIPAA Security Rule compliance.
  • Understand where you stand today by taking stock of existing policies, perform asset inventories, map ePHI flow, and evaluate readiness for incident recovery and technical controls.
  • Budget for change: Compliance will require investment in staff, cybersecurity tools, audits, and training programs.

 

WHAT YOU CAN DO TO PREPARE

Healthcare companies can start preparing for the proposed HIPAA Security Rule changes by taking a proactive, structured approach. First, conduct a gap analysis comparing current security practices to the NPRM requirements, focusing on areas like encryption, multi-factor authentication, and incident response. Building a comprehensive asset inventory and mapping ePHI data flows will be critical, as these are new mandatory elements.

Organizations should also update or create written policies and procedures for all security standards, ensuring they are well-documented and auditable. Strengthening risk management programs by performing detailed risk assessments and implementing mitigation strategies will help meet the more prescriptive requirements. Additionally, companies should invest in technical safeguards such as vulnerability scanning, penetration testing, and secure backup systems.

Preparing an incident response plan that includes restoring critical systems within 72 hours and conducting annual drills will be essential. Finally, budgeting for compliance costs and training staff on new security protocols will ensure readiness and minimize disruption when the rule is finalized.

 

Here’s a HIPAA Security Rule NPRM Compliance Checklist you can use as a starting point:

✅ Governance & Documentation

  • Develop and maintain written policies and procedures for all Security Rule standards.
  • Document risk analysis and risk management plans.
  • Keep records of all compliance activities for audit purposes.

✅ Risk Analysis & Management

  • Perform a comprehensive risk assessment annually:
    • Identify threats and vulnerabilities.
    • Assess likelihood and impact.
    • Document mitigation strategies.
  • Update risk analysis whenever systems or processes change.

✅ Asset Inventory & Data Flow

  • Maintain an annual inventory of:
    • Hardware, software, and media handling ePHI.
  • Create and update network/data flow maps showing ePHI movement.

✅ Access Controls

  • Implement multi-factor authentication (MFA) for all systems accessing ePHI.
  • Enforce role-based access and least privilege principles.

✅ Technical Safeguards

  • Encrypt ePHI at rest and in transit (with limited exceptions).
  • Implement network segmentation.
  • Conduct regular vulnerability scans at least every six months and penetration testing at least once every 12 months.
  • Ensure secure backup and restoration processes.

✅ Incident Response & Recovery

  • Develop a formal incident response plan.
  • Ensure the ability to restore critical systems within 72 hours.
  • Conduct annual incident response drills.

✅ Training & Awareness

  • Provide annual security training for workforce members.
  • Document training completion and updates.

✅ Auditing & Monitoring

  • Perform annual compliance audits.
  • Monitor system activity logs for anomalies.

Here’s a Compliance Roadmap for Preparing for the HIPAA Security Rule NPRM:

Phase 1: Immediate Assessment (0–30 Days)

  • Conduct a Gap Analysis: Compare current security practices against NPRM requirements.
  • Identify High-Risk Areas: Encryption, MFA, incident response, and documentation gaps.
  • Engage Leadership: Secure executive buy-in and allocate budget for compliance.

Phase 2: Planning & Policy Development (30–90 Days)

  • Update Policies & Procedures: Draft written documentation for all Security Rule standards.
  • Create Asset Inventory: Catalog hardware, software, and media handling ePHI.
  • Map ePHI Data Flows: Document how ePHI moves across systems and networks.
  • Develop Incident Response and Contingency Plans: Include 72-hour recovery objectives and escalation paths.

Phase 3: Technical Implementation (90–180 Days)

  • Enable Multi-Factor Authentication (MFA): Apply to all systems accessing ePHI.
  • Encrypt ePHI at Rest & In Transit: Implement encryption protocols across platforms.
  • Set Up Vulnerability Management: Schedule regular scans and annual penetration tests.
  • Secure Backup & Restoration: Ensure systems can be restored within 72 hours and that processes are formally documented.

Phase 4: Workforce Training & Testing (180–210 Days)

  • Conduct Security Awareness Training: Educate staff on new policies and technical safeguards.
  • Run Incident Response Drills: Test recovery plans and refine based on results.
  • Perform Internal Audit: Validate compliance progress and identify remaining gaps.

Phase 5: Final Compliance & Continuous Monitoring (210–240 Days)

  • Complete Full Compliance Audit: Ensure all NPRM requirements are met.
  • Implement Continuous Monitoring: Track system activity, update inventories, and review risk assessments annually.
  • Prepare for OCR Review: Maintain documentation and evidence of compliance readiness.

 

HOW AVERTIUM CAN HELP

Avertium’s HIPAA Certification Program (HCP) helps organizations operationalize HIPAA requirements, moving beyond one-off compliance audits to a continuous, proactive approach. The program delivers:

  • Continuous Policy Updates: Ensures that your organization’s policies are always aligned with the latest HIPAA and HITRUST mandates.
  • Ongoing Staff Training: Regular training sessions to keep your team up to date on compliance requirements and best practices.
  • Technical Control Alignment: Regularly updates and aligns technical controls with evolving patient privacy mandates, ensuring that your security measures keep pace with regulatory changes.

Achieve and maintain compliance with integrated independent risk assessments, remediation guidance, and Trustmark certification that validates adherence to HIPAA Privacy, Security, and Breach Notification Rules while offering ongoing support and quarterly updates to ensure continuous compliance.

 

 

Related Resource:

 
Compliance HIPAA Certification HIPAA Compliance HIPAA data governance HIPAA Rules HIPAA Regulations Blog