Where the rule stands
The Security Rule you're required to follow today was written in 2003 and lightly amended in 2013. In January 2025 HHS proposed replacing most of its implementation specifications with firmer, more prescriptive ones. The healthcare industry filed thousands of comments, many objecting to the cost. Then an administration change, a regulatory freeze and a long review cycle followed.
- 6 January 2025Proposed rule published in the Federal Register.
- 7 March 2025Comment period closes.
- October 2026No final rule. The 2003 rule applies in full.
- July 2027Target date for final action in the latest Unified Agenda. A target, not a promise.
Two things are true at once. Nothing on this page is enforceable yet. And almost everything on this page is what OCR already expects to find when it investigates you under the current rule, because "reasonable and appropriate" has drifted toward these controls for years.
What would change, in one table
| Area | Current rule (2003) | Proposed rule (2025) |
|---|---|---|
| Addressable specifications | 22 addressable, 14 required | All required, with narrow written exceptions |
| Risk analysis | Required, no interval stated | Written, with specified contents, reviewed at least every 12 months |
| Asset inventory and network map | Not named | Required, updated at least annually and after changes |
| Encryption | Addressable | Required at rest and in transit, limited exceptions |
| Multi-factor authentication | Not named | Required, limited exceptions |
| Patching | Not named | Critical within 15 days, high within 30, of identification |
| Vulnerability scans and pen tests | Not named | Scans at least every 6 months, penetration test at least annually |
| Backups and recovery | Backup and recovery plans required | Restore critical systems within 72 hours; backups tested monthly |
| Network segmentation, anti-malware | Not named | Required |
| Workforce access changes | Termination procedures, addressable | Terminate within 1 hour; notify other regulated entities within 24 hours |
| Business associates | Written contract | Written verification of each BA's safeguards every 12 months, by a subject-matter expert |
| Compliance audit | Periodic evaluation | Formal audit at least every 12 months |
| Group health plans | Plan documents require sponsor safeguards | Plan documents must also require sponsor's Security Rule compliance and 24-hour notice of contingency activation |
None of this is law yet. All of it is what "reasonable and appropriate" already looks like to an investigator.Your engineer
Which changes would hit a small practice hardest?
Tick the ones you've already done.
What the proposed rule would still ask of you
8 of the eight to go: MFA, encryption, the asset inventory and network map, an annual risk analysis review, monthly restore tests, scanning and a pen test, written vendor verification, same-day access removal. Start with MFA and encryption, because they're also what stops the breach.
What HHS estimated it would cost
HHS's own regulatory impact analysis put first-year compliance costs across the industry at roughly $9 billion, and about $6 billion a year after that, spread over several hundred thousand regulated entities. Hospital and physician associations argued the figures were low. For a small practice the realistic additions are MFA licences, encryption you probably already own, a scanning tool, an annual test, and the time to keep the inventory and documents current. See what HIPAA costs a small practice.
Why waiting is the expensive option
- OCR already enforces most of it. The risk analysis, access termination, encryption decisions and activity review are the findings in nearly every 2025 and 2026 settlement, under the current rule.
- Cyber insurers already require it. MFA, EDR and tested backups are now standard application questions.
- The controls are the same either way. A program built to the proposal needs no rework if the rule is finalized, and loses nothing if it isn't.
With AccuSights: the platform's assessment already carries the proposed requirements alongside the current ones, so you can see both gaps on one screen. The endpoint agent supplies the device inventory and encryption status the proposal would require, and your engineer closes the rest.