Reading the Proposed HIPAA Security Rule as a Program Plan

On January 6, 2025, the Department of Health and Human Services published a notice of proposed rulemaking to update the HIPAA Security Rule, the first substantive revision in more than a decade. Comments are due March 7. The proposal may change before it’s finalized, and a change of administration adds uncertainty about timing. Waiting for certainty is still a poor plan. Almost everything in the proposal reflects practices that healthcare security teams already recognize as necessary, and many have struggled to fund.

This paper reads the proposal the way a security leader would: as a description of the program regulators expect, and as an opportunity to make the case for work that was already overdue.

What the proposal changes

The current rule divides implementation specifications into “required” and “addressable”. Addressable never meant optional, but in practice it often became a reason to document an alternative and move on. The proposal removes that distinction for most specifications and adds specific expectations. Among the most significant:

Each line is reasonable on its own. Together they describe a mature program, and most organizations will find gaps in several areas at once.

Start with the inventory, because everything else depends on it

The asset inventory and network map look like administrative requirements. They’re the foundation for every other line in the table. You can’t show encryption coverage, MFA coverage, segmentation, or a 72-hour recovery capability without knowing which systems hold ePHI and how data flows between them.

In healthcare, that inventory is difficult for reasons that have nothing to do with effort:

• Clinical and medical devices are often managed by biomedical engineering, outside IT’s tools.
• Departmental systems and research environments grew up with their own administrators.
• Cloud and SaaS applications holding ePHI may have been bought by business units.
• Data flows through integration engines, interfaces and file transfers that nobody has drawn in years.

A practical approach is to build the inventory from evidence that already exists rather than from a fresh survey: configuration management data, network flow logs, identity provider application lists, procurement and contract records, and the business associate agreement register. Gaps between those sources show where to look next.

Sequencing the work

Not everything can happen at once, and the proposal doesn’t require it to. Here’s a defensible order for most organizations.

Phase 1: Know what you have (first two quarters)

• Build the asset inventory and data-flow map to a usable level of detail. Aim for complete coverage of systems holding ePHI before perfect detail on any one system.
• Refresh the risk analysis using that inventory, so it identifies threats and vulnerabilities by asset rather than in general terms.
• Inventory business associates and confirm which ones handle ePHI on which systems.

Phase 2: Close the high-exposure gaps (quarters two to four)

• Extend MFA to every remote access path and every administrative account first, then to remaining ePHI systems.
• Confirm encryption in transit across interfaces and integrations, which is often weaker than encryption at rest.
• Establish the six-month scanning cadence and schedule the first annual penetration test, scoped from the inventory.

Phase 3: Prove recovery (in parallel, starting early)

The 72-hour restoration requirement deserves early attention because it can’t be met on paper. It depends on knowing which systems are critical, having backups attackers can’t reach, and having practiced restoring them. Ransomware incidents in healthcare have shown how long recovery takes when restoration was never rehearsed at scale.

Run a restoration exercise for one critical clinical system end to end. Measure the actual time. That number will shape the recovery budget more convincingly than any policy document.

Phase 4: Make it repeatable

The annual compliance audit and inventory review turn the program into a cycle. Treat the first cycle’s outputs as the baseline you measure against, and keep the evidence organized so the second cycle takes less effort than the first.

Business associates: plan for verification at scale

The proposed annual written verification of business associates’ technical safeguards will be one of the more demanding operational changes. Large health systems have hundreds of business associates, and many smaller vendors have never been asked for evidence of specific controls.

Some steps that help:

• Tier business associates by the volume and sensitivity of ePHI they handle and by how they connect to your environment.
• Define the verification you need for each tier. A certification report may be enough for some vendors; others may need targeted evidence of MFA, encryption and recovery capability.
• Update contract language now so that verification and 24-hour contingency notification are contractual obligations when renewals come up.

Business associates should expect the same questions from every covered entity they serve. Preparing a standard evidence package now will save considerable effort later.

Using the comment period well

Organizations can submit comments on cost, feasibility and timelines. Even if you don’t comment, the period is a good time to:

1. Estimate the gap between your program and the proposal, area by area.
2. Put rough costs and durations against closing each gap.
3. Present leadership with a phased plan that’s worth doing regardless of the final text.

That last point matters. Inventory, MFA, encryption, tested recovery and vendor verification reduce the risk of the incidents that have disrupted patient care in recent years. They’re worth funding on their own merits, and the proposed rule gives security leaders a timely reason to ask.

A note on readiness versus assurance

Preparing for a requirement and demonstrating compliance with it are different activities. Readiness work identifies gaps, prioritizes remediation and organizes evidence. Formal compliance determinations rest with the organization, its auditors and regulators. Keeping those roles clear helps everyone involved understand what each assessment can and can’t tell them.

• HIPAA
• Healthcare
• Compliance Readiness
• Asset Inventory
• Encryption