Supporting material
This page has the tables and sources behind the briefing.
This page carries the supporting material for the briefing. It covers definitions, the timeline worked through, who has pushed back, the 2026 enforcement cases, the full requirement register, HHS's own cost assumptions, the hardest changes, every proposed vendor duty, what buyers already ask for, the vendor challenges and the 3, 6 and 12 month plans. Section numbers refer to the proposed rule unless marked "current." The proposal is not final, and any of it may change.
Definitions
These terms are used in the specific sense below.
| Term | Meaning in this briefing |
|---|---|
| Covered entity | A health plan, a health care clearinghouse or a health care provider that conducts certain transactions electronically, such as billing. HIPAA applies to them directly. |
| Business associate | A person or company that creates, receives, maintains or transmits protected health information for a covered entity, such as a software, cloud, billing, analytics or IT service provider. A business associate's own vendors that handle the same data are subcontractors, and are business associates too. |
| ePHI | Electronic protected health information, meaning protected health information (identifiable health information covered by HIPAA) that is held or sent electronically. |
| OCR | HHS's Office for Civil Rights, which enforces the HIPAA Privacy, Security and Breach Notification Rules. |
| Proposed rule (NPRM) | A notice of proposed rulemaking. It creates no new obligations. A final rule can differ from it and would set its own effective and compliance dates. |
| Unified Agenda | The federal government's twice-yearly calendar of planned regulations. Its dates are estimates. |
| Required and addressable | Under the current rule, an organization must assess whether each "addressable" specification is reasonable and appropriate and implement it if so. If not, it must document why and implement an equivalent measure when that is reasonable and appropriate. They were never optional. The proposal would make each specification apply, with listed exceptions. |
| Relevant electronic information system | A system that creates, receives, maintains or transmits ePHI, or that otherwise affects its confidentiality, integrity or availability (proposed 164.304). |
| Implement | As proposed, to put a safeguard into effect so that it is "in use, operational, and function[ing] as expected." |
| Contingency plan activation | Switching to backup, disaster recovery or emergency operations. As proposed, a business associate would tell the covered entity within 24 hours, whether or not there was a breach. |
| Qualified person | For penetration tests and the vendor analysis, a person with appropriate knowledge of and experience with generally accepted cybersecurity principles. The text does not require an outside firm or a particular credential. |
| Recognized security practices | Under Public Law 116-321 (2021), security practices HHS must consider when it enforces the Security Rule, if an organization can show they were in place for the previous 12 months. They can count in its favor but do not replace compliance with the rule. |
How the dates would work
The proposed rule sets its dates from the day a final rule is published (P). It would take effect at P plus 60 days, with general compliance due 180 days after the effective date (P plus 240 days). An existing business associate agreement that was in place and compliant before publication, and is not renewed or modified between the effective and compliance dates, would be treated as compliant until the earlier of its renewal after the compliance date or one year after the effective date. The table reads the agenda's July 2027 as the month of publication. The agenda date is a planning estimate, so that is an assumption.
| If published | Effective (plus 60 days) | Compliance (plus 180 more) | Latest date for existing BAAs (effective plus one year) |
|---|---|---|---|
| July 1, 2027 | August 30, 2027 | February 26, 2028 | August 30, 2028 |
| July 15, 2027 | September 13, 2027 | March 11, 2028 | September 13, 2028 |
| July 31, 2027 | September 29, 2027 | March 27, 2028 | September 29, 2028 |
The transition covers the contract and assurance terms (proposed 164.308(b) and 164.314(a)). It does not delay any safeguard. A business associate would still implement the revised controls by the general compliance date. The date has moved before. The September 2025 agenda projected May 2026, and the 2026 agenda moved the rule to long-term action with July 2027.
Who has pushed back and on what
Positions we read in the original (the organizations' own letters, or the published interview) are marked as read. Others were seen in search results and coverage and should be read in the original before being quoted.
| Who | When | Position | Status |
|---|---|---|---|
| CHIME, American Health Care Association, Association of American Medical Colleges, Federation of American Hospitals, Health Innovation Alliance, MGMA, National Center for Assisted Living (joint letter to the President and the HHS Secretary) | February 17, 2025 | The proposal "should be rescinded immediately"; HHS's $9 billion first-year estimate is "a woefully inadequate estimate"; the timeline is unreasonable; the proposal does not address P.L. 116-321 on recognized security practices | Read |
| MGMA (comment letter) | March 7, 2025 | "We urge you to withdraw it in its entirety"; too burdensome for medical groups | Read |
| American Hospital Association (response to an HHS request for information) | February 23, 2026 | Urges HHS to withdraw the proposed rule; calls the 72 hour restoration timeframe arbitrary and infeasible in complex cyberattacks | Read |
| AMA, HSCC, AAFP and HIMSS | 2025 | Reported in coverage to have asked for changes to the proposal; we have not yet read their statements in the original | Seen in search results |
| OCR Director Paula Stannard (TechTarget interview) | 2026 | OCR has not decided which proposals, if any, will be finalized; "There's a very high cost of doing nothing"; organizations "treat addressable as optional and just don't do it" | Read |
Our reading is that compliance periods, flexibility for smaller organizations, the recovery deadline, the evidence burden and the exceptions are the provisions most likely to change. That is an inference from the comments. HHS has not said so.
The 2026 enforcement cases
All 12 HIPAA enforcement actions OCR announced in 2026 through November 7, by announcement date. Each links to its HHS announcement. The briefing's count of 13 covers the 12 months to November 7, which adds Concentra (December 16, 2025, $112,500, right of access).
| Announced | Organization | Type | Amount | What OCR cited |
|---|---|---|---|---|
| February 19, 2026 | Top of the World Ranch Treatment Center | Covered entity, provider (substance use treatment) | $103,000 and a two-year corrective action plan | Risk analysis, after phishing |
| March 5, 2026 | MMG Fusion (12th Risk Analysis Initiative action) | Business associate, dental practice software | $10,000 (reduced for financial condition) and a three-year corrective action plan | No accurate and thorough risk analysis; impermissible disclosure of PHI for about 15 million people after a December 2020 intrusion; failure to notify covered entity customers |
| April 23, 2026 | Axia Women's Health | Covered entity, provider | $320,000 and a two-year corrective action plan | Risk analysis, after ransomware |
| April 23, 2026 | Assured Imaging | Covered entity, provider | $375,000 and a two-year corrective action plan | Risk analysis, impermissible disclosure and late notice to individuals, after ransomware |
| April 23, 2026 | Consociate Health | Business associate, third party administrator | $225,000 and a two-year corrective action plan | Risk analysis, after ransomware that followed phishing |
| April 23, 2026 | Star Group Health Benefits Plan | Covered entity, health plan | $245,000 and a two-year corrective action plan | Risk analysis and impermissible disclosure, after ransomware |
| June 18, 2026 | Spencer Gifts benefit plans | Covered entity, health plan | $450,000 and a two-year corrective action plan | Risk analysis; policies and procedures, after ransomware |
| July 2026 (agreement dated July 29; no press release found) | OSF Healthcare System | Covered entity, provider | $552,250 and a two-year corrective action plan | Risk analysis, impermissible disclosure, late notice to individuals and to HHS, after ransomware |
| August 27, 2026 | Azul Vision | Covered entity, provider | $50,000 and a two-year corrective action plan | Right of access (timely access to records) |
| September 17, 2026 | Ambry Genetics | Covered entity, provider (genetic testing) | $700,000 and a two-year corrective action plan | Risk analysis, termination of access and unique user identification, after phishing |
| October 8, 2026 | Shen Smiles | Covered entity, provider (dental) | $140,000 (penalty proposed, then settled) | Right of access; no right of access policies; failure to safeguard records |
| October 29, 2026 | Lehigh Valley Health Network | Covered entity, provider (health system) | $800,000 and a three-year corrective action plan | Risk analysis, information system activity review, impermissible disclosure, late notice to individuals and to HHS, after ransomware affecting 248,359 people |
Ten of the 12 cite the risk analysis, seven followed ransomware and two were right of access cases. Every action except Shen Smiles came with a corrective action plan. Our quarterly HIPAA breach and enforcement briefing has every action since 2018 and the HHS breach portal figures, and is updated each quarter.
The full requirement register
The work types are Improve (strengthen what exists), Update (rewrite documents), Assess (analyze or test) and Change (a control or process that may not exist yet). Effort is our planning judgment for a mid-size organization with an established but uneven program. It is not based on a survey. "Twelve months" means at least once every 12 months, and in many sections also after a relevant change, whichever comes first.
| Area | Proposed section | Key requirement and deadline | Work | Effort | Already expected today? |
|---|---|---|---|---|---|
| Scope and definitions | 160.103, 164.304 | Systems that "otherwise affect" ePHI are in scope; "implement" means in use and working | Assess, update | Medium | Largely; comprehensive scope already supports today's risk analysis |
| Required and addressable | 164.306(c) | Each specification applies, with listed exceptions | Assess, update | Medium | Addressable already requires assessment and a documented decision |
| Asset inventory and network map | 164.308(a)(1) | "Accurate and thorough written inventory and a network map"; asset, version, owner, location; how ePHI enters, moves and leaves; 12 months and after changes | Improve, assess | High | Yes, HHS says an accurate risk analysis already requires it |
| Risk analysis | 164.308(a)(2) | Written, with threats, vulnerabilities, likelihood, impact, risk levels and the risk of each business associate; 12 months | Improve, assess | High | Yes, the requirement in OCR's 2026 cases |
| Evaluation before changes | 164.308(a)(3) | Written evaluation before a major operational or environmental change | Change | Medium | Partly; current evaluation follows changes |
| Patch management | 164.308(a)(4) | Critical risk patches within 15 calendar days, high risk within 30; exceptions only in the listed circumstances, documented in real time with compensating controls | Improve, change | High | New deadlines |
| Risk management plan | 164.308(a)(5) | Written, prioritized, implemented "in a timely manner"; 12 months | Improve, update | Medium to high | Yes |
| Sanctions | 164.308(a)(6) | Apply and document sanctions; review policy every 12 months | Update | Low to medium | Yes |
| Activity review | 164.308(a)(7) | Written retention and review of logs and records; test every 12 months | Improve, update | High | Yes, regular review already required |
| Security official | 164.308(a)(8) | Named in writing, responsible for policies and technical controls | Update | Low | Yes |
| Workforce access and termination | 164.308(a)(9) | Access ends no later than one hour after employment or an arrangement ends; notify other regulated entities of relevant changes within 24 hours | Change | High | Termination procedures yes; the deadlines are new |
| Information access management | 164.308(a)(10) | Access procedures for users and technology assets; MFA and segmentation policies | Improve, change | High | Partly |
| Training | 164.308(a)(11) | Everyone by the compliance date, then every 12 months; new staff within 30 days of first access; within 30 days of a material policy change | Improve, update | Medium | Yes, with new deadlines |
| Incident response | 164.308(a)(12) | Written plans, root cause remediation, records; test every 12 months | Improve, assess | Medium to high | Yes, testing is more explicit |
| Contingency planning | 164.308(a)(13) | Criticality analysis; procedures to restore critical relevant systems and data within 72 hours of their loss; test every 12 months | Change, assess | High | Backup and recovery yes; 72 hours is new |
| Compliance audit | 164.308(a)(14) | Audit against each standard every 12 months; no outside auditor required | Assess | Medium to high | New |
| Business associate verification | 164.308(b) | Written analysis and signed certification, before ePHI is shared and every 12 months | Change | High | New |
| Business associate agreements | 164.314(a) | Add contingency activation notice within 24 hours; flow terms to subcontractors | Update | Medium | Incident and breach reporting yes; activation notice new |
| Facility, workstation and device controls | 164.310 | Written procedures per facility; sanitization to "current standards"; review every 12 months | Improve, update | Medium | Yes |
| Access controls | 164.312(a) | Unique IDs for users and assets; separate administrator identities; lockouts; segmentation | Improve, change | High | Partly |
| Encryption | 164.312(b) | "All electronic protected health information at rest and in transit," with listed exceptions | Change | High | HHS says "should already have done so in most circumstances" |
| Configuration management | 164.312(c) | Secure baselines, anti-malware, remove extra software, disable unused ports | Improve, change | High | Partly |
| Audit logs | 164.312(d) | Record "in real-time all activity" in relevant systems; alert on suspicious activity | Improve, change | High | Audit controls yes; real time breadth is new |
| MFA | 164.312(f) | Across technology assets in relevant systems, and for privilege changes; listed exceptions | Change | High | New breadth |
| Vulnerability scans | 164.312(h) | "At least once every six months," or more often per the risk analysis | Improve | Medium to high | New floor |
| Penetration testing | 164.312(h) | "At least once every 12 months" by a qualified person | Assess | Medium to high | New |
| Data backup | 164.312(i) | Copies "no more than 48 hours older"; real-time failure alerts; sample restores "at least monthly" | Improve, assess | High | Backups yes; the deadlines are new |
| System backup | 164.312(j) | Back up relevant systems; test every six months | Improve, assess | High | Partly |
| Documentation | 164.316 | Each action, activity and assessment in writing; review every 12 months; keep six years | Update, change | Medium to high | Six year retention yes |
HHS's own cost assumptions
The regulatory impact analysis estimates first-year costs of about $9 billion and about $6 billion a year after that, across about 1.8 million regulated entities (about 820,000 covered entities and 1 million business associates) and about 740,000 group health plan sponsors. Its first-year table (Table 6) assumes these hours per organization, on top of the compliance HHS assumes already exists.
| Activity | Who | Hours assumed per organization, first year |
|---|---|---|
| Annual compliance audit | Each regulated entity | 2 |
| Verifying its own technical safeguards for customers | Each business associate | 2 |
| Obtaining business associate verification | Each covered entity | 0.5 |
| Obtaining subcontractor verification | Each business associate | 0.083 (about five minutes) |
| MFA | Each regulated entity | 1.5 |
| Network segmentation | Each regulated entity | 4.5 |
| Penetration testing | Each regulated entity | 3 |
| Contingency activation notice | Each business associate | 0.5 |
| Updating policies and procedures | Each regulated entity | 3.5 |
| Revising business associate agreements | Each regulated entity | 1 |
The figures are national averages for incremental work. HHS also said it could not reliably estimate the cost of compensating controls for legacy devices. Budget from your own counts of applications, sites, interfaces, vendors and the controls you can show working.
The hardest changes to make
- The inventory and ePHI map (164.308(a)(1) and (a)(2)). The information sits with IT, clinical engineering, departments and vendors. An incomplete scope weakens every later step.
- Broad MFA and separate administrator access (164.312(a) and (f)). Legacy applications, shared clinical workstations and vendor remote access need integration work and sometimes replacement.
- Encryption and its exceptions (164.312(b)). Finding every unprotected copy, interface and export, managing keys, and governing device exceptions with migration plans.
- Network segmentation (164.308(a)(10) and 164.312(a)). Requires understanding clinical traffic and testing changes without disrupting care.
- Real-time logging across relevant systems (164.312(d)). Some systems cannot produce the data, and collection, storage and staffed alerting are recurring costs.
- Patch deadlines with defensible exceptions (164.308(a)(4)). Vendor approval, clinical validation and maintenance windows all compete with 15 and 30 days.
- Proven recovery (164.308(a)(13), 164.312(i) and (j)). Recovering connected services within 72 hours means identity, infrastructure, interfaces and vendors recovering together.
- Annual vendor verification used in risk decisions (164.308(b)). Vendor evidence is uneven, and reading it, following up and deciding takes sustained capacity.
Every proposed vendor duty by section
| Duty | Section | What it says |
|---|---|---|
| Verification before sharing ePHI | 164.308(b)(1) | The covered entity obtains satisfactory assurances and verifies that the business associate has deployed the technical safeguards |
| Annual written verification | 164.308(b)(2)(ii) | "At least once every 12 months," through both a written analysis of the vendor's relevant systems against each technical safeguard by a person with appropriate knowledge and experience, and a written certification of the analysis by a person authorized to act for the vendor |
| Use in the customer's risk analysis | 164.308(a)(2) | The covered entity assesses the risk of "entering into or continuing" each business associate relationship, based on the verification |
| Contingency activation notice | 164.314(a)(2)(i)(D) | Report activation of the contingency plan "without unreasonable delay, and in no case later than 24 hours after activation" |
| Security incident and breach reporting | 164.314(a)(2)(i)(C); current 164.410 | Report security incidents, including breaches. Current breach notice: without unreasonable delay and no later than 60 days after discovery |
| Workforce access changes | 164.308(a)(9) | Notify the other regulated entity of relevant authorization changes or terminations as soon as possible, no later than 24 hours |
| Subcontractors | 164.308(b), 164.314(a)(2)(iii) | The business associate obtains assurances and verification from its own subcontractors; the covered entity does not have to verify them directly |
| Delegated security work | 164.308(b)(3) | A business associate may serve as the designated security official; the delegating organization remains liable for compliance |
| All other safeguards | 164.302, 164.308, 164.310, 164.312, 164.316 | Apply to business associates as to covered entities, including the inventory, risk analysis, patch deadlines, MFA, encryption, logging, scans, penetration tests, backups, 72 hour recovery, the annual audit and documentation |
| Transition for existing agreements | 164.318 | Existing compliant agreements, not renewed or modified between the effective and compliance dates, are treated as compliant until renewal after the compliance date or one year after the effective date, whichever is earlier |
What buyers already ask for
Hospital for Special Surgery publishes its vendor security expectations, which vary by vendor type and are described as "not all-inclusive." They include a SOC 2 Type II report; cybersecurity evaluations such as ISO 27001, HIPAA, HITRUST, NIST CSF or NIST 800-53; network and web application penetration testing; vulnerability scanning; audit logging and SIEM integration; encryption at rest (AES 256) and in transit (TLS 1.2 or later); disaster recovery and business continuity procedures; incident response procedures with defined reporting thresholds; and single sign-on, MFA and role-based access. We also saw 2025 and 2026 industry guidance in search results (MGMA's cybersecurity playbook and Health Sector Coordinating Council model contract terms and supply chain guides) and have not yet read it in the original, so we do not describe its recommendations here. Under the proposal, a buyer would add the safeguard-by-safeguard analysis, the signed certification, the 24 hour activation notice and evidence that the vendor verifies its own subcontractors.
Why a SOC 2 report is not enough on its own
A SOC 2 report describes controls against the AICPA's trust services criteria for a defined system and period. The proposed verification asks whether the vendor has deployed each technical safeguard in 164.312. To use a SOC 2 report as part of that answer, read its scope (which systems and services), its period, its exceptions, its carve-outs for subcontractors and its list of controls the customer must operate, then fill the gaps against specific requirements such as six month scans, annual penetration tests, 48 hour backups, monthly restore tests and MFA coverage. Treat a HITRUST certification, an ISO 27001 certificate or a penetration test letter the same way, and ask for the assessment or test detail behind it, since the certificate or letter alone may not show scope, exceptions or what the customer must operate. None is designated in the proposal as a substitute for the analysis and certification.
The vendor challenges ranked by difficulty
This ranking is our assessment of implementation difficulty. It is not based on an industry study.
| Rank | Challenge | Why it is hard | Vendors most exposed |
|---|---|---|---|
| 1 | Complete evidence an authorized person will certify | Policies and reports have to connect to deployed controls, tests, exceptions and fixes, and an authorized person certifies the analysis as accurate | Smaller software companies, AI startups, billing companies, dental and specialty software |
| 2 | Proving recovery and meeting notice deadlines | A successful backup job does not prove an application, its identity service, keys and interfaces come back; 24 hour notices need current contacts and after-hours escalation | Managed service providers, billing platforms, practice and clinical software serving many customers |
| 3 | Retrofitting older products | MFA, encryption, segmentation, separate administrator identities and 15 and 30 day patching can need engineering work and customer rollouts | On-premises and specialty software, managed service providers, older SaaS platforms |
| 4 | Subcontractor chains | Evidence is needed from the hosting, support and processing providers that handle ePHI as subcontractors, which can include AI model and API providers, and their commitments may be weaker than what customers ask | AI tools, SaaS platforms, billing processors, managed service providers |
| 5 | Questionnaire overload | Customer requests can arrive in different formats and on different schedules, drawing on staff who also handle remediation | Any vendor with many health care customers, smaller vendors most |
| 6 | Shared, multi-tenant platforms | Showing tenant isolation, privileged support access and customer-specific recovery without exposing other customers; a clear split of which controls the customer configures | Large SaaS and cloud providers, managed service providers |
Multi-tenancy is not prohibited. A vendor would need to show reasonable and appropriate segmentation, authorized access and controls that work.
The 3, 6 and 12 month plans
Work periods count from November 2026. The proposal sets no compliance dates until a final rule is published. Each step also supports the current rule.
For covered entities
| By | Work and output |
|---|---|
| February 2027 (3 months) | Confirm the security official and an executive sponsor. Reconcile the inventories and map where ePHI lives and moves, including vendors. Complete or repair the organization-wide risk analysis. Open a remediation register with owners, dates, funding decisions and interim controls. Fix urgent gaps in authentication, exposed systems, backups and access removal as they are found. |
| May 2027 (6 months) | Expand MFA and separate administrator accounts. Set patch ownership, risk ratings and an exceptions process. Close inventory and logging gaps. Run scans and a scoped penetration test. Restore a sample of data and recover one critical service end to end. List every business associate agreement with its renewal date, contacts and the evidence held. |
| November 2027 (12 months) | Complete the major segmentation and recovery work planned for this period, and record owners, interim controls and target dates for what remains. Keep monthly restore evidence and recurring vulnerability remediation. Refresh the risk analysis. Audit each standard separately from the risk analysis and close findings. If a final rule is published, replace assumptions with its text, dates and transition rules. |
For vendors and business associates
| By | Work and output |
|---|---|
| February 2027 (3 months) | Complete or update the risk analysis and risk management plan. Map production, backups, support access and subcontractors. Fix serious access, encryption and backup gaps. Review current BAAs and notice duties, keep customer contacts current, and set up an escalation path that can send notices while an investigation continues. Open a gap register against the proposed safeguards. |
| May 2027 (6 months) | Run an incident and contingency exercise that includes customer notice. Demonstrate recovery of critical systems and monthly sample restores. Set measurable patching, scanning and penetration testing cycles. Assemble a reusable evidence package covering report scopes, open findings, a mapping to each safeguard and a responsibility matrix. Obtain missing subcontractor assurances. |
| November 2027 (12 months) | Complete an internal audit and a dry run of the written analysis and certification. Resolve the highest priority architectural gaps and schedule a yearly refresh of the evidence package. Prepare contract language and track renewals. Adjust to any final text. |
Open questions and what to watch
- The next Unified Agenda and any sign that HHS will finalize, narrow, split or withdraw the proposal.
- Whether a final rule keeps the 72 hour recovery requirement, the annual vendor verification and the end of the required and addressable split.
- Whether the compliance period and the transition for existing agreements change.
- OCR's next enforcement actions under the Risk Analysis Initiative and any widening to risk management.
- How buyers' vendor questionnaires and contract templates change at 2027 renewals.
Sources
Sources for this briefing. We opened every item except those marked "seen in search results", which should be read in the original before being quoted.
Rulemaking
- HHS OCR, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898, January 6, 2025 (rule text, preamble and regulatory impact analysis, Table 6)
- HHS, HIPAA Security Rule proposed rule page
- McDermott Will & Emery, Final action on HIPAA Security Rule modifications now projected for July 2027, July 16, 2026
- Unified Agenda entry, RIN 0945-AA22
Comments and positions
- Joint letter requesting rescission of the proposed HIPAA Security Rule, February 17, 2025
- MGMA, comment letter, March 7, 2025
- American Hospital Association, response to HHS request for information, February 23, 2026
- TechTarget, OCR director defends HIPAA updates, 2026
- CHIME, comments on the proposed rule (seen in search results)
- HSCC, Senate HELP Committee testimony, July 9, 2025 (seen in search results)
Enforcement and breach data
- HHS, OCR settlement with MMG Fusion, March 5, 2026
- HIPAA Journal, MMG Fusion settlement, March 2026
- HHS, OCR settles four ransomware investigations, April 23, 2026
- Insurance Business, health care data breaches hit record pace as vendor risk surges, October 23, 2026 (reports HIPAA Journal's 43 percent figure)
- HIPAA Journal, H1 2026 health care data breach report
- HHS OCR breach portal
Buyer requirements and guidance
- Hospital for Special Surgery, vendor management
- MGMA, Cybersecurity Playbook 2025 (seen in search results)
- Health Sector Coordinating Council, MC2 model contract language, version 2, November 2025 (seen in search results)
- HHS, guidance on HIPAA and cloud computing
Briefings summarize public sources in our own words and link to the originals. They are for awareness and are not legal or compliance advice. The proposed rule is not final. If you want to know how any of this applies to your organization, ask us.