Flagship service

Risk MethodologyOne workshop, ready in less than a week. Puts risk in business terms your leadership can act on. Instant price estimateRisk assessment scope and price range in about 3 minutes.

Assess

Risk Assessment Gap Assessment Strategy & Maturity Skills & Capability Vulnerability Scanning

Build

Data Governance & Classification M365 Security Implementation Control Standards Policy Development BCP/DR Plans

Maintain

Vulnerability Management M365 Policy Management IR Tabletop Exercises

Lead

Fractional CISO Strategy & Planning Board Presentations
IndustryHigher EducationGLBA risk assessments, FERPA, research security and HECVAT. Incident reporting deadlines → Briefings and resources →
IndustryFinancial ServicesGLBA, FFIEC guidance and the move to NIST CSF 2.0. NYDFS Part 500 → NYDFS risk assessment brief → Briefings and resources →
IndustryTechnologySOC 2 readiness and real security, including Microsoft 365, Azure and AWS hardening. Briefings and resources →
IndustryHealthcareHIPAA risk analysis, HICP and HITRUST readiness. HIPAA Security Rule rewrite (2027) → HIPAA breaches and enforcement, Q3 2026 → Briefings and resources →
More industries
  • Nonprofits
  • Manufacturing
  • Government
  • Legal
Every other industry →
Briefing · November 2026Fewer HIPAA breach reports, far more people affected. What changed in the last 12 months?HIPAA breaches and OCR enforcement in the last 12 months. Briefing · November 2026The HIPAA Security Rule rewrite is projected for July 2027. What should you change before then?What to change before the HIPAA Security Rule rewrite lands. November 2026 · LatestAI agents just became an identity problemNIST, CISA and Australia's ASD: what it means for your risk. September 2026Good risk decisions start with good dataNYDFS, CISA and NIST guidance, and what it means for your risk.
In each update

New security guidance in plain language: what changed, what it means for your risk, and the questions to ask your team.

See the archive →Resources: briefs and guides →Roundup →Free guide: security for a business of one →
ApproachTeamUpdatesAll servicesInstant price estimate

Updates

Monthly2 editions November 2026 (latest) September 2026 Archive: all editions Resources: briefs and guides Roundup Free guide: cybersecurity for consultants and solo business owners
Briefings2 topics HIPAA breaches and enforcement, Q3 2026 The HIPAA Security Rule rewrite

Industries

Industry4 industries Higher Education Incident reporting deadlines Financial Services NYDFS Part 500 NYDFS risk assessment brief Technology Healthcare HIPAA Security Rule rewrite (2027) HIPAA breaches and enforcement, Q3 2026

Also nonprofits, manufacturing, government and legal. Every other industry

Services

Flagship serviceRisk Methodology Risk Methodology
Assess5 services Risk Assessment Gap Assessment Strategy & Maturity Skills & Capability Vulnerability Scanning
Build5 services Data Governance & Classification M365 Security Implementation Control Standards Policy Development BCP/DR Plans
Maintain3 services Vulnerability Management M365 Policy Management IR Tabletop Exercises
Lead3 services Fractional CISO Strategy & Planning Board Presentations
Book a consultation

Briefing

The HIPAA Security Rule rewrite

Share
Security updates by email

Get each update the day it's out.

A monthly digest of the stories that matter most, plus special reports when something needs a closer look. Every story ends with the questions to ask your team. Unsubscribe in one click.

We send a confirmation link first, so only you can add this address. Privacy

The HIPAA Security Rule rewrite is projected for July 2027. What should you change before then?

HHS proposed the first major rewrite of the HIPAA Security Rule in January 2025, and its regulatory calendar now projects final action for July 2027. The proposal describes what OCR expects a working security program to look like, and OCR is already enforcing the current rule's version of it, against software vendors and administrators as well as providers and health plans. Parts one to four cover what covered entities would have to improve, update, assess and change. Parts five and six cover what vendors and business associates would be asked to prove. It closes with short answers to three questions to settle before the work is funded. The proposal asks for evidence that safeguards are in place and working. By our reading of the register, much of that evidence, starting with the risk analysis and risk management plan, is already expected under today's rule.

Talk it through with usRead the briefing
Briefing one topic, six partsPublished November 2026Short answer 2 minutesFull detail when you need it

The short answer

The rule is still a proposal. Much of the work it describes is already required.

Start with what the current rule already requires and OCR is enforcing. That means an accurate and thorough risk analysis covering all electronic protected health information (ePHI), a risk management plan that reduces the risks it finds, contingency plans, and business associate agreements with every vendor that acts as a business associate. An up-to-date inventory of the systems that hold ePHI is the practical starting point for the risk analysis. Keep the proposal's new deadlines (15 and 30 day patching, one hour access removal, 72 hour recovery, annual vendor verification) as readiness targets until a final rule sets them. Parts one to four are written for covered entities, parts five and six for vendors and the covered entities that buy from them. The notes page holds the full requirement register, the timeline math, HHS's own cost assumptions, the pushback, the vendor tables and every source.

  1. 01When the new rule could take effectFinal action projected for July 2027. Compliance about eight months after a final rule is publishedDiscussRegulation
  2. 02What OCR is enforcing todayRisk analysis first and vendors are targets tooAct nowEnforcement
  3. 03What to improve, update, assess and changeA register of the proposal and a 3, 6 and 12 month planDiscussReadiness
  4. 04The changes that take the longestMFA, encryption, segmentation, logging, patch deadlines and 72 hour recoveryDiscussTechnical controls
  5. 05What covered entities will ask of vendorsAnnual written verification, a signed certification and a 24 hour noticeDiscussVendor risk
  6. 06What vendors should start on nowOne evidence package your customers can rely onDiscussFor vendors
  7. ?The three questions a skeptical CISO will askShort answers, ready before they come upBefore you are asked

Regulation

When the new rule could take effect.

The rewrite is still a proposal. Its projected date has already moved once, and the proposed compliance period starts only when a final rule is published.

What it is

HHS's Office for Civil Rights (OCR), which enforces HIPAA, published the proposed rule on January 6, 2025, and comments closed on March 7, 2025. It would apply to covered entities (health plans, health care clearinghouses and health care providers that conduct certain transactions electronically) and to business associates, the vendors and service providers that create, receive, maintain or transmit electronic protected health information (ePHI) on their behalf. The federal regulatory calendar published in July 2026, the Unified Agenda, moved it to "long-term action" with final action projected for July 2027; the previous calendar, from September 2025, said May 2026. Those dates are HHS planning estimates and can move again. As proposed, a final rule would take effect 60 days after publication, and compliance would be due 180 days after that, 240 days after publication in total. Existing business associate agreements could get extra time. An agreement in place before a final rule is published, compliant with the current rule and not renewed or changed between the effective date and the compliance date could stay in use until the earlier of its next renewal or one year after the effective date. The extra time would cover updating the contract terms only. The safeguards themselves would still be due on the general compliance date. If a final rule were published in mid-July 2027, the general compliance date would fall in March 2028. OCR Director Paula Stannard told TechTarget in 2026 that OCR has not decided which proposals, if any, will be finalized.

What's the risk

The final text may differ from the proposal. In February 2025, seven health care groups, among them CHIME, MGMA, the Association of American Medical Colleges and the Federation of American Hospitals, wrote to the President and the HHS Secretary that the proposal "should be rescinded immediately," and called HHS's own cost estimate of about $9 billion in the first year "a woefully inadequate estimate." The American Hospital Association asked HHS to withdraw it in February 2026 and called the 72 hour recovery requirement arbitrary. Waiting for the final text carries its own risk, because the current Security Rule stays in force and OCR is enforcing it now (part two). The attacks the proposal is written for keep growing: in the 12 months to September 2026, hacking and IT incidents were behind 84 percent of the large breaches reported to HHS and 98.5 percent of the people affected, and January to September 2026 has the highest hacking share on record, 85.7 percent (our analysis of the HHS breach portal). These figures use the fields every report has. OCR writes its description of a breach only when it closes the case, so about two thirds of 2026 reports have none yet, and the attack method behind most recent hacking reports is not public. HHS's own preamble says that regulated entities "should already have" encrypted ePHI "in most circumstances" under the current rule. The practical risk is spending the next year on proposal-only details while the current-rule basics, the ones OCR investigates after a breach, stay unfinished.

What's the impact

  • Treat July 2027 as a planning date. The calendar date has moved once already. Plan the work so it holds up if the date moves again, and adjust when a final rule is published.
  • Fund the current rule's requirements first. A complete risk analysis, a working risk management plan and contingency plans for backup and recovery are required today, so that spending is sound whatever the final rule says.
  • Expect customer contracts to move before the rule does. Nothing stops a buyer from writing the proposal's vendor terms into a contract today. Part five covers what those terms look like.
  • Show the board what is required now and what is only proposed. Keeping the two lists apart helps the board fund current duties without committing to details that may change.

Questions to ask your team

  • Which of our current security projects would we need anyway under today's Security Rule, and which depend on the proposal?
  • When was our HIPAA risk analysis last updated, and does it cover every system that stores, processes or touches ePHI?
  • Who is tracking the rulemaking, and what will we change in our plan when a final rule is published?

Go deeper: the timeline worked through and who has pushed back on what.

How we help

Strategy & Planning → Board Presentations → Fractional CISO →

Enforcement

What OCR is enforcing today.

OCR's 2026 cases center on the current rule's risk analysis requirement, and one of them is against a software vendor.

What it is

OCR's Risk Analysis Initiative focuses investigations on whether an organization has done an accurate and thorough risk analysis, the written assessment of risks to all the ePHI it creates, receives, maintains or transmits. On March 5, 2026, OCR announced the initiative's 12th action, against MMG Fusion, a company that provides software to dental practices and acts as a business associate. OCR's investigation concerned a December 2020 incident in which an attacker accessed MMG's systems and patient information for about 15 million people was disclosed. According to OCR's announcement, its investigation found that MMG had not done an accurate and thorough risk analysis, had not prevented the impermissible disclosure, and had not notified its covered entity customers of the breach. MMG paid $10,000, an amount OCR set after considering the company's financial condition, agreed to a corrective action plan monitored for three years, and admitted no wrongdoing. On April 23, 2026, OCR announced four settlements after ransomware attacks, $1.165 million in total. Axia Women's Health paid $320,000, Assured Imaging $375,000 and Star Group Health Benefits Plan $245,000. Consociate Health, a third party administrator acting as a business associate, paid $225,000. In each case OCR cited the risk analysis requirement. On October 29, 2026, OCR announced an $800,000 settlement with Lehigh Valley Health Network after a ransomware attack affecting 248,359 people. OCR cited the risk analysis, the failure to regularly review information system activity such as audit logs, an impermissible disclosure, and late notice to individuals and to HHS. In the 12 months to November 7, 2026, OCR announced 13 HIPAA enforcement actions, about half as many as in the 12 months before. Ten of the 13 cite the risk analysis, and seven followed ransomware (every action, side by side). In an interview with TechTarget, OCR's director said of the current rule's addressable specifications: "We find that they treat addressable as optional and just don't do it."

What's the risk

These cases were brought under the rule in force today. MMG's payment was small, but its settlement also brings three years of OCR monitoring under a corrective action plan, required submissions and a public record that customers and buyers can read. The MMG case also shows that a business associate is directly accountable to OCR, and that failing to tell customers about a breach is a separate finding. Under the current rule, a business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 days after discovering it, and contracts can set shorter periods. A 2021 law, P.L. 116-321, requires HHS to consider whether an organization had recognized security practices in place for the previous 12 months when it decides Security Rule fines, whether to end an audit early and favorably, and the remedies in an agreement. Practices that were in place and documented can count in the organization's favor, though they do not replace compliance with the rule.

What's the impact

  • A current risk analysis is the first thing to have ready. It is the requirement OCR cited in every case above. It has to cover all ePHI, including vendors, backups and systems that only touch the data.
  • Show what you fixed as well as what you found. A risk analysis that sits in a folder does not show that risks were reduced. Keep a risk management plan with owners, dates and closures.
  • Vendors answer to OCR directly. A software company or administrator that handles ePHI for a customer can face its own investigation, settlement and monitoring.
  • Customer breach notification needs a tested process. Know who notifies which customer, how fast your contracts require it, and test that path before an incident.

Questions to ask your team

  • If OCR asked for our risk analysis tomorrow, would it cover every system and vendor that handles ePHI, and does it reflect the changes we have made since it was written?
  • Which findings from our last risk analysis are still open, and who owns each one?
  • If one of our vendors had a breach, how quickly does our contract require them to tell us, and have we ever tested it?

Go deeper: the 2026 cases, side by side.

How we help

Risk Assessment → Risk Methodology → Policy Development → IR Tabletop Exercises →

Readiness

What to improve, update, assess and change.

For a covered entity, the proposal turns general expectations into named documents, frequencies and tests.

What it is

The proposal would end the current split between "required" and "addressable" specifications, so each would apply, with limited, documented exceptions. It would define the systems in scope as those that create, receive, maintain or transmit ePHI or that "otherwise affect" its confidentiality, integrity or availability, which brings in identity services, interfaces and supporting infrastructure. Safeguards would count as implemented only when they are "in use, operational, and function as expected," so a policy or a purchase alone would not count. New or expanded documents include a written technology asset inventory and network map showing how ePHI moves, a written risk analysis with named components (including the risk from each business associate), a written evaluation before major changes, a written risk management plan, and an annual compliance audit against every standard. Most of these are reviewed at least every 12 months, and documentation is kept for six years. We sort the work into four kinds. Improve means a capability exists and needs strengthening, such as the inventory or risk analysis. Update means documents to rewrite, such as policies, training and agreements. Assess means analysis or testing to perform, such as the audit, penetration tests and recovery tests. Change means a control or process that may not exist yet, such as one hour access removal or annual vendor verification. The full register, item by item, is on the notes page.

What's the risk

HHS's cost analysis assumes much of this work is already done. Its first-year table allows, per regulated entity, about 2 hours for the annual compliance audit, 1.5 hours for MFA, 4.5 hours for network segmentation, 3 hours for penetration testing and 3.5 hours for policy updates. Those are incremental estimates on top of the compliance HHS assumes already exists. For a mid-size hospital or physician group with many applications, sites, interfaces and vendors, the hours depend on how complete the current inventory and risk analysis are. The joint letter from seven health care groups called HHS's total estimate "a woefully inadequate estimate." The second risk is sequencing. An incomplete inventory weakens every later step, because the risk analysis, the audit and the vendor review all start from the list of what is in scope.

What's the impact

  • In the next three months, bring the inventory and risk analysis up to date, with owners and dates for what remains. Confirm the security official and an executive sponsor, map where ePHI lives and moves, update the risk analysis, and open a remediation register with owners, dates and interim controls.
  • By six months, put the priority controls in place and test them. Expand MFA and separate administrator accounts, set patch ownership and exceptions, run scans and a scoped penetration test, run a real restore test, and inventory every business associate agreement with its renewal date.
  • By twelve months, run the first internal audit. Audit each standard separately from the risk analysis, close findings, keep monthly restore evidence, and replace assumptions with the final text if a rule is published.
  • Have the security official report to the board on scope coverage, serious open risks, overdue remediation, control test results and recovery performance. Tracked over time, they help the board judge whether the program is reducing the risks it found.

Questions to ask your team

  • Do we have one inventory of the systems, devices and vendors that handle ePHI, with an owner for each, or several partial lists?
  • How many items in our risk management plan were closed in the last twelve months, and how many are overdue?
  • Which of the register's "change" items, such as one hour access removal, would we be unable to meet today?

Go deeper: the full requirement register, HHS's own cost assumptions and the 3, 6 and 12 month plans.

How we help

Gap Assessment → Risk Assessment → Policy Development → Board Presentations →

Technical controls

The changes that take the longest.

A handful of proposed controls involve clinical systems, legacy devices and outside vendors, so they need the most lead time.

What it is

As proposed, organizations would deploy multifactor authentication (MFA, which requires at least two different kinds of proof of identity, such as a password and a code from a phone) across the technology assets in their relevant systems, and for actions that change user privileges. They would encrypt "all electronic protected health information at rest and in transit." They would keep administrator identities separate from everyday user accounts, segment networks, keep secure configuration baselines, and record "in real-time all activity" in relevant systems with alerts for suspicious activity. Patching would get deadlines of 15 calendar days for critical risks and 30 for high risks, once a patch is available. Vulnerability scans would run at least every six months and penetration tests at least every 12 months, by a "qualified person," who does not have to be an outside firm. Access would end no later than one hour after employment or another arrangement ends. Backups of ePHI would be no more than 48 hours older than the live data, with failures alerted in real time and a sample restore tested at least monthly. Written procedures would restore "critical relevant electronic information systems and data within 72 hours of the loss." Several of these controls carry their own limited exceptions, for example for unsupported technology with a migration plan, certain FDA-authorized medical devices and emergencies. The conditions differ by control, and the proposal asks for each exception to be documented with compensating controls.

What's the risk

Breach reports show where the affected data sat. In the 12 months to September 2026, the data was on a network server in 546 of the 778 large breaches reported to HHS and in email in 159 (our breach portal analysis). These controls also touch systems the organization does not fully control. Clinical applications and devices often depend on a vendor to approve patches, support MFA or allow encryption. Flat clinical networks are hard to segment without disrupting care. Some systems cannot produce the logs real-time monitoring needs. The recovery requirement is the most contested. The AHA called 72 hours arbitrary and infeasible in complex cyberattacks, although the proposed text applies the 72 hours to systems and data the organization has classified as critical, with other systems restored by priority. Restoring connected clinical services, with identity, interfaces and vendor dependencies, is a much bigger test than restoring files.

What's the impact

  • Start with MFA and separate administrator accounts. They make stolen passwords harder to use and limit what an attacker can reach with one account, and that protection is worth having whatever the final rule says.
  • Make patch deadlines a term in vendor contracts. A 15 day deadline cannot be met if a clinical vendor takes 60 days to approve a patch. Ask vendors now how fast they certify critical fixes.
  • Test a real restore of a critical service. Pick one clinical service, restore it with its identity and interface dependencies, and time it. The result tells you how far you are from 72 hours.
  • Keep an exceptions register for devices and legacy systems. List each system that cannot support MFA or encryption, why, the compensating controls, and the replacement date.

Questions to ask your team

  • Where do we still allow access to ePHI with only a password, including vendor remote access and internal clinical applications?
  • For our three most critical clinical systems, when did we last restore one end to end, and how long did it take?
  • How many of our critical patches last quarter were installed within 15 days, and what held up the rest?

Go deeper: the full requirement register and the eight hardest changes and why each is hard.

How we help

Vulnerability Management → BCP / DR Plans → M365 Security Implementation → Vulnerability Scanning →

Vendor risk

What covered entities will ask of vendors.

The proposal would add written verification of a vendor's safeguards, before it handles ePHI and at least every year after, to the business associate agreement a covered entity already signs.

What it is

Today a business associate agreement (BAA) is the contract in which a vendor promises to protect ePHI. As proposed, before a business associate handles ePHI, and at least once every 12 months after that, the covered entity would obtain written verification that the vendor has deployed every technical safeguard in the rule. The verification has two parts: "a written analysis" of the vendor's relevant systems by a person with appropriate knowledge of and experience with generally accepted cybersecurity principles, and "a written certification that the analysis has been performed and is accurate" by a person with authority to act for the vendor. The text does not require an outside auditor or a particular credential. The covered entity would then use that verification in its own risk analysis of "entering into or continuing" the relationship. The BAA would add a duty to report activation of the vendor's contingency plan (switching to backup or disaster operations) "in no case later than 24 hours after activation," separate from breach notification. Vendors would verify their own subcontractors the same way. Some buyers already publish this kind of list. Hospital for Special Surgery's vendor page asks, depending on the vendor's type, for a SOC 2 Type II report and other evaluations (ISO 27001, HITRUST, NIST frameworks), network and web application penetration testing, vulnerability scanning, audit logging, encryption at rest and in transit, disaster recovery and incident response procedures with reporting thresholds, and MFA.

What's the risk

Business associates are involved in a growing share of large breaches. HIPAA Journal's analysis of the HHS breach portal, as reported in October 2026, found business associates involved in 43 percent of large health care breaches in the first half of 2026, up from an average of 20 percent between 2009 and 2017. That figure counts every breach a business associate was involved in, whoever reported it, so it is a different measure from the portal's own reporter field. By the portal's own vendor flag, a business associate was involved in about 39 percent of the reports for the same half year. Over the 12 months to September 2026, reports with the flag were about a third of all large breaches but covered two thirds of the people affected, or about 42 percent without the largest, Conduent's 62.2 million (our breach portal analysis). The proposed verification asks whether this vendor has deployed each required technical safeguard. A SOC 2 report is useful evidence, but its scope, period, exceptions and customer responsibilities have to be read against the safeguards, and it may not show items like monthly restore tests or six month scans. HHS's cost table allows about half an hour per covered entity to obtain the verification. Collecting it from dozens or hundreds of vendors, reading it, following up and deciding whether to continue a relationship takes sustained effort from security and procurement.

What's the impact

  • Tier vendors by what they can reach and how critical they are. A vendor hosting the EHR or holding backups needs a deeper review than one that sees a mailing list. Spend review time accordingly.
  • Update the BAA template at the next renewal. Add security incident and contingency activation notice, named contacts, recovery commitments and access to evidence, so the terms are in place before any rule requires them.
  • Ask for evidence mapped to each safeguard. Request the report or certificate plus a mapping to each technical safeguard and the vendor's open findings.
  • Decide in advance what happens when a vendor cannot show it. Options include a remediation plan with dates, added contract terms, compensating controls on your side, or replacing the vendor. Record the decision in the risk analysis.

Questions to ask your team

  • Which of our vendors hold or can reach ePHI, and which of them would stop patient care if they went down?
  • For our ten most critical vendors, what evidence of their safeguards do we hold today, and how old is it?
  • Does our BAA template require notice when a vendor switches to its disaster plan, or only when there is a breach?

Go deeper: every proposed vendor duty, by section, what buyers already ask for and why a SOC 2 report is not enough on its own.

How we help

Control Standards → Risk Assessment → Policy Development → Fractional CISO →

For vendors

What vendors should start on now.

For software companies, cloud and IT service providers, billing companies and other business associates, the proposal applies the same safeguards as for a hospital, and adds evidence that a customer will review every year.

What it is

Every safeguard in parts three and four would apply to business associates as it does to covered entities: the inventory and network map, the risk analysis, 15 and 30 day patching, MFA, encryption, logging, scans and penetration tests, 48 hour backups with monthly restore tests, 72 hour recovery of critical systems, the annual audit and six years of documentation. Business associate status depends on what a company does with ePHI on a customer's behalf, so dental and specialty software, practice management, analytics, AI tools, billing and managed IT providers can all be business associates. On top of that, a vendor would produce the annual written analysis and the signed certification for each customer that asks, give notice within 24 hours when it activates its contingency plan, notify customers within 24 hours when a workforce member's access to their ePHI or systems is changed or terminated, and collect the same verification from its own subcontractors, such as hosting and AI model providers. HHS's cost table allows about 2 hours per business associate a year to verify its technical safeguards, and HHS reasoned in the preamble that business associates should already comply or need "only modest improvement."

What's the risk

Vendors are already reporting and being investigated under today's rule. In the 12 months to September 2026, business associates filed 118 large breach reports to HHS themselves, and two of OCR's 13 enforcement actions in the 12 months to November 7 were against vendors, MMG Fusion and Consociate Health. Both cite the risk analysis, and MMG's also cites the failure to notify customers. In our assessment, the hardest part for many vendors will be producing evidence complete enough for a named person to certify as accurate. Next come proving recovery and running the 24 hour notices outside business hours, retrofitting MFA, encryption and patch deadlines into older products, and collecting evidence from subcontractors whose own commitments may be weaker than what customers ask for. Questionnaires from many customers, each in its own format and on its own renewal calendar, compete for the same staff who do the remediation. Multi-tenant platforms have to show isolation, privileged support access and customer-specific recovery without exposing other customers. We expect smaller software companies, specialty and dental software vendors, AI startups, managed service providers and billing companies to feel this most, because a small security team would carry the evidence, the questionnaires and the remediation at once. MMG Fusion's case points to two current-rule gaps for vendors to check first, the risk analysis and the process for telling customers about a breach.

What's the impact

  • In three months, do the risk analysis and fix customer notification. Map production, backups, support access and subcontractors, open a gap register against the proposed safeguards, and test that you can reach every customer's contact within hours.
  • By six months, build one evidence package you can reuse. Combine your SOC 2 or other report with a mapping to each safeguard, recent test results, open findings and a responsibility matrix showing which controls the customer configures.
  • By twelve months, run a dry run of the annual verification. Have a qualified person write the analysis, have an executive review it as if signing, and fix what they will not sign.
  • Give buyers a current evidence package mapped to the proposed safeguards, so their reviewers can see coverage and ask only for what is missing.

Questions to ask your team

  • If a customer asked tomorrow for evidence that we meet each technical safeguard, what would we send, and who would sign it?
  • Which of our subcontractors handle our customers' ePHI, and what evidence do we hold from each of them?
  • If we switched to disaster operations at 2 a.m. on a Saturday, how would every affected customer hear from us within 24 hours?

Go deeper: the vendor challenges, ranked, every proposed vendor duty and the 3, 6 and 12 month plans.

How we help

Gap Assessment → Fractional CISO → BCP / DR Plans → IR Tabletop Exercises →

Before you are asked

The three questions a skeptical CISO will ask.

The register, the tables and the plans are in each part's Go deeper panel and on the notes page.

  1. Why should we spend money now on a rule that may be withdrawn or rewritten?

    Because the work to start with is already required. A complete inventory, a written risk analysis covering all ePHI, a risk management plan that closes items, tested incident response and recovery, and vendors who meet their obligations are expectations under today's Security Rule, and OCR's 2026 settlements cite the risk analysis requirement. Fund those first. Keep the proposal's new deadlines, such as 15 day patching, one hour access removal and 72 hour recovery, as readiness targets unless a contract or your own risk decisions already require them, and treat them as rule requirements once a final rule sets them.

  2. What would we hand OCR if it opened an investigation tomorrow?

    The risk analysis with its date and scope, the risk management plan showing what was fixed and when, the inventory and data flows it rests on, the business associate agreements, and records of training, incident response and recovery tests. Test the package now by reviewing it the way an investigator would. Check that the scope includes every system and vendor that touches ePHI, and that each serious risk has an owner and a closure date or a documented decision.

  3. Can our critical vendors prove their safeguards work?

    Start with the vendors that hold ePHI or would stop patient care if they failed. Ask each for a current report or certificate with a mapping to the technical safeguards, plus their breach and contingency notice commitments. Where a vendor cannot show it, choose between a dated remediation plan, added contract terms, compensating controls on your side and replacement, and record that choice in the risk analysis. Under the proposal, the covered entity would obtain the vendor's written verification at least every 12 months and use it in its risk analysis of continuing the relationship. Recording it now is good practice under the current rule.

Go deeper

The notes behind this page.

Open any section. The same material is on the notes page when you want to share or print it.

Definitions

These terms are used in the specific sense below.

TermMeaning in this briefing
Covered entityA health plan, a health care clearinghouse or a health care provider that conducts certain transactions electronically, such as billing. HIPAA applies to them directly.
Business associateA person or company that creates, receives, maintains or transmits protected health information for a covered entity, such as a software, cloud, billing, analytics or IT service provider. A business associate's own vendors that handle the same data are subcontractors, and are business associates too.
ePHIElectronic protected health information, meaning protected health information (identifiable health information covered by HIPAA) that is held or sent electronically.
OCRHHS's Office for Civil Rights, which enforces the HIPAA Privacy, Security and Breach Notification Rules.
Proposed rule (NPRM)A notice of proposed rulemaking. It creates no new obligations. A final rule can differ from it and would set its own effective and compliance dates.
Unified AgendaThe federal government's twice-yearly calendar of planned regulations. Its dates are estimates.
Required and addressableUnder the current rule, an organization must assess whether each "addressable" specification is reasonable and appropriate and implement it if so. If not, it must document why and implement an equivalent measure when that is reasonable and appropriate. They were never optional. The proposal would make each specification apply, with listed exceptions.
Relevant electronic information systemA system that creates, receives, maintains or transmits ePHI, or that otherwise affects its confidentiality, integrity or availability (proposed 164.304).
ImplementAs proposed, to put a safeguard into effect so that it is "in use, operational, and function[ing] as expected."
Contingency plan activationSwitching to backup, disaster recovery or emergency operations. As proposed, a business associate would tell the covered entity within 24 hours, whether or not there was a breach.
Qualified personFor penetration tests and the vendor analysis, a person with appropriate knowledge of and experience with generally accepted cybersecurity principles. The text does not require an outside firm or a particular credential.
Recognized security practicesUnder Public Law 116-321 (2021), security practices HHS must consider when it enforces the Security Rule, if an organization can show they were in place for the previous 12 months. They can count in its favor but do not replace compliance with the rule.
How the dates would work

The proposed rule sets its dates from the day a final rule is published (P). It would take effect at P plus 60 days, with general compliance due 180 days after the effective date (P plus 240 days). An existing business associate agreement that was in place and compliant before publication, and is not renewed or modified between the effective and compliance dates, would be treated as compliant until the earlier of its renewal after the compliance date or one year after the effective date. The table reads the agenda's July 2027 as the month of publication. The agenda date is a planning estimate, so that is an assumption.

If publishedEffective (plus 60 days)Compliance (plus 180 more)Latest date for existing BAAs (effective plus one year)
July 1, 2027August 30, 2027February 26, 2028August 30, 2028
July 15, 2027September 13, 2027March 11, 2028September 13, 2028
July 31, 2027September 29, 2027March 27, 2028September 29, 2028

The transition covers the contract and assurance terms (proposed 164.308(b) and 164.314(a)). It does not delay any safeguard. A business associate would still implement the revised controls by the general compliance date. The date has moved before. The September 2025 agenda projected May 2026, and the 2026 agenda moved the rule to long-term action with July 2027.

Who has pushed back and on what

Positions we read in the original (the organizations' own letters, or the published interview) are marked as read. Others were seen in search results and coverage and should be read in the original before being quoted.

WhoWhenPositionStatus
CHIME, American Health Care Association, Association of American Medical Colleges, Federation of American Hospitals, Health Innovation Alliance, MGMA, National Center for Assisted Living (joint letter to the President and the HHS Secretary)February 17, 2025The proposal "should be rescinded immediately"; HHS's $9 billion first-year estimate is "a woefully inadequate estimate"; the timeline is unreasonable; the proposal does not address P.L. 116-321 on recognized security practicesRead
MGMA (comment letter)March 7, 2025"We urge you to withdraw it in its entirety"; too burdensome for medical groupsRead
American Hospital Association (response to an HHS request for information)February 23, 2026Urges HHS to withdraw the proposed rule; calls the 72 hour restoration timeframe arbitrary and infeasible in complex cyberattacksRead
AMA, HSCC, AAFP and HIMSS2025Reported in coverage to have asked for changes to the proposal; we have not yet read their statements in the originalSeen in search results
OCR Director Paula Stannard (TechTarget interview)2026OCR has not decided which proposals, if any, will be finalized; "There's a very high cost of doing nothing"; organizations "treat addressable as optional and just don't do it"Read

Our reading is that compliance periods, flexibility for smaller organizations, the recovery deadline, the evidence burden and the exceptions are the provisions most likely to change. That is an inference from the comments. HHS has not said so.

The 2026 enforcement cases

All 12 HIPAA enforcement actions OCR announced in 2026 through November 7, by announcement date. Each links to its HHS announcement. The briefing's count of 13 covers the 12 months to November 7, which adds Concentra (December 16, 2025, $112,500, right of access).

AnnouncedOrganizationTypeAmountWhat OCR cited
February 19, 2026Top of the World Ranch Treatment CenterCovered entity, provider (substance use treatment)$103,000 and a two-year corrective action planRisk analysis, after phishing
March 5, 2026MMG Fusion (12th Risk Analysis Initiative action)Business associate, dental practice software$10,000 (reduced for financial condition) and a three-year corrective action planNo accurate and thorough risk analysis; impermissible disclosure of PHI for about 15 million people after a December 2020 intrusion; failure to notify covered entity customers
April 23, 2026Axia Women's HealthCovered entity, provider$320,000 and a two-year corrective action planRisk analysis, after ransomware
April 23, 2026Assured ImagingCovered entity, provider$375,000 and a two-year corrective action planRisk analysis, impermissible disclosure and late notice to individuals, after ransomware
April 23, 2026Consociate HealthBusiness associate, third party administrator$225,000 and a two-year corrective action planRisk analysis, after ransomware that followed phishing
April 23, 2026Star Group Health Benefits PlanCovered entity, health plan$245,000 and a two-year corrective action planRisk analysis and impermissible disclosure, after ransomware
June 18, 2026Spencer Gifts benefit plansCovered entity, health plan$450,000 and a two-year corrective action planRisk analysis; policies and procedures, after ransomware
July 2026 (agreement dated July 29; no press release found)OSF Healthcare SystemCovered entity, provider$552,250 and a two-year corrective action planRisk analysis, impermissible disclosure, late notice to individuals and to HHS, after ransomware
August 27, 2026Azul VisionCovered entity, provider$50,000 and a two-year corrective action planRight of access (timely access to records)
September 17, 2026Ambry GeneticsCovered entity, provider (genetic testing)$700,000 and a two-year corrective action planRisk analysis, termination of access and unique user identification, after phishing
October 8, 2026Shen SmilesCovered entity, provider (dental)$140,000 (penalty proposed, then settled)Right of access; no right of access policies; failure to safeguard records
October 29, 2026Lehigh Valley Health NetworkCovered entity, provider (health system)$800,000 and a three-year corrective action planRisk analysis, information system activity review, impermissible disclosure, late notice to individuals and to HHS, after ransomware affecting 248,359 people

Ten of the 12 cite the risk analysis, seven followed ransomware and two were right of access cases. Every action except Shen Smiles came with a corrective action plan. Our quarterly HIPAA breach and enforcement briefing has every action since 2018 and the HHS breach portal figures, and is updated each quarter.

The full requirement register

The work types are Improve (strengthen what exists), Update (rewrite documents), Assess (analyze or test) and Change (a control or process that may not exist yet). Effort is our planning judgment for a mid-size organization with an established but uneven program. It is not based on a survey. "Twelve months" means at least once every 12 months, and in many sections also after a relevant change, whichever comes first.

AreaProposed sectionKey requirement and deadlineWorkEffortAlready expected today?
Scope and definitions160.103, 164.304Systems that "otherwise affect" ePHI are in scope; "implement" means in use and workingAssess, updateMediumLargely; comprehensive scope already supports today's risk analysis
Required and addressable164.306(c)Each specification applies, with listed exceptionsAssess, updateMediumAddressable already requires assessment and a documented decision
Asset inventory and network map164.308(a)(1)"Accurate and thorough written inventory and a network map"; asset, version, owner, location; how ePHI enters, moves and leaves; 12 months and after changesImprove, assessHighYes, HHS says an accurate risk analysis already requires it
Risk analysis164.308(a)(2)Written, with threats, vulnerabilities, likelihood, impact, risk levels and the risk of each business associate; 12 monthsImprove, assessHighYes, the requirement in OCR's 2026 cases
Evaluation before changes164.308(a)(3)Written evaluation before a major operational or environmental changeChangeMediumPartly; current evaluation follows changes
Patch management164.308(a)(4)Critical risk patches within 15 calendar days, high risk within 30; exceptions only in the listed circumstances, documented in real time with compensating controlsImprove, changeHighNew deadlines
Risk management plan164.308(a)(5)Written, prioritized, implemented "in a timely manner"; 12 monthsImprove, updateMedium to highYes
Sanctions164.308(a)(6)Apply and document sanctions; review policy every 12 monthsUpdateLow to mediumYes
Activity review164.308(a)(7)Written retention and review of logs and records; test every 12 monthsImprove, updateHighYes, regular review already required
Security official164.308(a)(8)Named in writing, responsible for policies and technical controlsUpdateLowYes
Workforce access and termination164.308(a)(9)Access ends no later than one hour after employment or an arrangement ends; notify other regulated entities of relevant changes within 24 hoursChangeHighTermination procedures yes; the deadlines are new
Information access management164.308(a)(10)Access procedures for users and technology assets; MFA and segmentation policiesImprove, changeHighPartly
Training164.308(a)(11)Everyone by the compliance date, then every 12 months; new staff within 30 days of first access; within 30 days of a material policy changeImprove, updateMediumYes, with new deadlines
Incident response164.308(a)(12)Written plans, root cause remediation, records; test every 12 monthsImprove, assessMedium to highYes, testing is more explicit
Contingency planning164.308(a)(13)Criticality analysis; procedures to restore critical relevant systems and data within 72 hours of their loss; test every 12 monthsChange, assessHighBackup and recovery yes; 72 hours is new
Compliance audit164.308(a)(14)Audit against each standard every 12 months; no outside auditor requiredAssessMedium to highNew
Business associate verification164.308(b)Written analysis and signed certification, before ePHI is shared and every 12 monthsChangeHighNew
Business associate agreements164.314(a)Add contingency activation notice within 24 hours; flow terms to subcontractorsUpdateMediumIncident and breach reporting yes; activation notice new
Facility, workstation and device controls164.310Written procedures per facility; sanitization to "current standards"; review every 12 monthsImprove, updateMediumYes
Access controls164.312(a)Unique IDs for users and assets; separate administrator identities; lockouts; segmentationImprove, changeHighPartly
Encryption164.312(b)"All electronic protected health information at rest and in transit," with listed exceptionsChangeHighHHS says "should already have done so in most circumstances"
Configuration management164.312(c)Secure baselines, anti-malware, remove extra software, disable unused portsImprove, changeHighPartly
Audit logs164.312(d)Record "in real-time all activity" in relevant systems; alert on suspicious activityImprove, changeHighAudit controls yes; real time breadth is new
MFA164.312(f)Across technology assets in relevant systems, and for privilege changes; listed exceptionsChangeHighNew breadth
Vulnerability scans164.312(h)"At least once every six months," or more often per the risk analysisImproveMedium to highNew floor
Penetration testing164.312(h)"At least once every 12 months" by a qualified personAssessMedium to highNew
Data backup164.312(i)Copies "no more than 48 hours older"; real-time failure alerts; sample restores "at least monthly"Improve, assessHighBackups yes; the deadlines are new
System backup164.312(j)Back up relevant systems; test every six monthsImprove, assessHighPartly
Documentation164.316Each action, activity and assessment in writing; review every 12 months; keep six yearsUpdate, changeMedium to highSix year retention yes
HHS's own cost assumptions

The regulatory impact analysis estimates first-year costs of about $9 billion and about $6 billion a year after that, across about 1.8 million regulated entities (about 820,000 covered entities and 1 million business associates) and about 740,000 group health plan sponsors. Its first-year table (Table 6) assumes these hours per organization, on top of the compliance HHS assumes already exists.

ActivityWhoHours assumed per organization, first year
Annual compliance auditEach regulated entity2
Verifying its own technical safeguards for customersEach business associate2
Obtaining business associate verificationEach covered entity0.5
Obtaining subcontractor verificationEach business associate0.083 (about five minutes)
MFAEach regulated entity1.5
Network segmentationEach regulated entity4.5
Penetration testingEach regulated entity3
Contingency activation noticeEach business associate0.5
Updating policies and proceduresEach regulated entity3.5
Revising business associate agreementsEach regulated entity1

The figures are national averages for incremental work. HHS also said it could not reliably estimate the cost of compensating controls for legacy devices. Budget from your own counts of applications, sites, interfaces, vendors and the controls you can show working.

The hardest changes to make
  1. The inventory and ePHI map (164.308(a)(1) and (a)(2)). The information sits with IT, clinical engineering, departments and vendors. An incomplete scope weakens every later step.
  2. Broad MFA and separate administrator access (164.312(a) and (f)). Legacy applications, shared clinical workstations and vendor remote access need integration work and sometimes replacement.
  3. Encryption and its exceptions (164.312(b)). Finding every unprotected copy, interface and export, managing keys, and governing device exceptions with migration plans.
  4. Network segmentation (164.308(a)(10) and 164.312(a)). Requires understanding clinical traffic and testing changes without disrupting care.
  5. Real-time logging across relevant systems (164.312(d)). Some systems cannot produce the data, and collection, storage and staffed alerting are recurring costs.
  6. Patch deadlines with defensible exceptions (164.308(a)(4)). Vendor approval, clinical validation and maintenance windows all compete with 15 and 30 days.
  7. Proven recovery (164.308(a)(13), 164.312(i) and (j)). Recovering connected services within 72 hours means identity, infrastructure, interfaces and vendors recovering together.
  8. Annual vendor verification used in risk decisions (164.308(b)). Vendor evidence is uneven, and reading it, following up and deciding takes sustained capacity.
Every proposed vendor duty by section
DutySectionWhat it says
Verification before sharing ePHI164.308(b)(1)The covered entity obtains satisfactory assurances and verifies that the business associate has deployed the technical safeguards
Annual written verification164.308(b)(2)(ii)"At least once every 12 months," through both a written analysis of the vendor's relevant systems against each technical safeguard by a person with appropriate knowledge and experience, and a written certification of the analysis by a person authorized to act for the vendor
Use in the customer's risk analysis164.308(a)(2)The covered entity assesses the risk of "entering into or continuing" each business associate relationship, based on the verification
Contingency activation notice164.314(a)(2)(i)(D)Report activation of the contingency plan "without unreasonable delay, and in no case later than 24 hours after activation"
Security incident and breach reporting164.314(a)(2)(i)(C); current 164.410Report security incidents, including breaches. Current breach notice: without unreasonable delay and no later than 60 days after discovery
Workforce access changes164.308(a)(9)Notify the other regulated entity of relevant authorization changes or terminations as soon as possible, no later than 24 hours
Subcontractors164.308(b), 164.314(a)(2)(iii)The business associate obtains assurances and verification from its own subcontractors; the covered entity does not have to verify them directly
Delegated security work164.308(b)(3)A business associate may serve as the designated security official; the delegating organization remains liable for compliance
All other safeguards164.302, 164.308, 164.310, 164.312, 164.316Apply to business associates as to covered entities, including the inventory, risk analysis, patch deadlines, MFA, encryption, logging, scans, penetration tests, backups, 72 hour recovery, the annual audit and documentation
Transition for existing agreements164.318Existing compliant agreements, not renewed or modified between the effective and compliance dates, are treated as compliant until renewal after the compliance date or one year after the effective date, whichever is earlier
What buyers already ask for

Hospital for Special Surgery publishes its vendor security expectations, which vary by vendor type and are described as "not all-inclusive." They include a SOC 2 Type II report; cybersecurity evaluations such as ISO 27001, HIPAA, HITRUST, NIST CSF or NIST 800-53; network and web application penetration testing; vulnerability scanning; audit logging and SIEM integration; encryption at rest (AES 256) and in transit (TLS 1.2 or later); disaster recovery and business continuity procedures; incident response procedures with defined reporting thresholds; and single sign-on, MFA and role-based access. We also saw 2025 and 2026 industry guidance in search results (MGMA's cybersecurity playbook and Health Sector Coordinating Council model contract terms and supply chain guides) and have not yet read it in the original, so we do not describe its recommendations here. Under the proposal, a buyer would add the safeguard-by-safeguard analysis, the signed certification, the 24 hour activation notice and evidence that the vendor verifies its own subcontractors.

Why a SOC 2 report is not enough on its own

A SOC 2 report describes controls against the AICPA's trust services criteria for a defined system and period. The proposed verification asks whether the vendor has deployed each technical safeguard in 164.312. To use a SOC 2 report as part of that answer, read its scope (which systems and services), its period, its exceptions, its carve-outs for subcontractors and its list of controls the customer must operate, then fill the gaps against specific requirements such as six month scans, annual penetration tests, 48 hour backups, monthly restore tests and MFA coverage. Treat a HITRUST certification, an ISO 27001 certificate or a penetration test letter the same way, and ask for the assessment or test detail behind it, since the certificate or letter alone may not show scope, exceptions or what the customer must operate. None is designated in the proposal as a substitute for the analysis and certification.

The vendor challenges ranked by difficulty

This ranking is our assessment of implementation difficulty. It is not based on an industry study.

RankChallengeWhy it is hardVendors most exposed
1Complete evidence an authorized person will certifyPolicies and reports have to connect to deployed controls, tests, exceptions and fixes, and an authorized person certifies the analysis as accurateSmaller software companies, AI startups, billing companies, dental and specialty software
2Proving recovery and meeting notice deadlinesA successful backup job does not prove an application, its identity service, keys and interfaces come back; 24 hour notices need current contacts and after-hours escalationManaged service providers, billing platforms, practice and clinical software serving many customers
3Retrofitting older productsMFA, encryption, segmentation, separate administrator identities and 15 and 30 day patching can need engineering work and customer rolloutsOn-premises and specialty software, managed service providers, older SaaS platforms
4Subcontractor chainsEvidence is needed from the hosting, support and processing providers that handle ePHI as subcontractors, which can include AI model and API providers, and their commitments may be weaker than what customers askAI tools, SaaS platforms, billing processors, managed service providers
5Questionnaire overloadCustomer requests can arrive in different formats and on different schedules, drawing on staff who also handle remediationAny vendor with many health care customers, smaller vendors most
6Shared, multi-tenant platformsShowing tenant isolation, privileged support access and customer-specific recovery without exposing other customers; a clear split of which controls the customer configuresLarge SaaS and cloud providers, managed service providers

Multi-tenancy is not prohibited. A vendor would need to show reasonable and appropriate segmentation, authorized access and controls that work.

The 3, 6 and 12 month plans

Work periods count from November 2026. The proposal sets no compliance dates until a final rule is published. Each step also supports the current rule.

For covered entities

ByWork and output
February 2027 (3 months)Confirm the security official and an executive sponsor. Reconcile the inventories and map where ePHI lives and moves, including vendors. Complete or repair the organization-wide risk analysis. Open a remediation register with owners, dates, funding decisions and interim controls. Fix urgent gaps in authentication, exposed systems, backups and access removal as they are found.
May 2027 (6 months)Expand MFA and separate administrator accounts. Set patch ownership, risk ratings and an exceptions process. Close inventory and logging gaps. Run scans and a scoped penetration test. Restore a sample of data and recover one critical service end to end. List every business associate agreement with its renewal date, contacts and the evidence held.
November 2027 (12 months)Complete the major segmentation and recovery work planned for this period, and record owners, interim controls and target dates for what remains. Keep monthly restore evidence and recurring vulnerability remediation. Refresh the risk analysis. Audit each standard separately from the risk analysis and close findings. If a final rule is published, replace assumptions with its text, dates and transition rules.

For vendors and business associates

ByWork and output
February 2027 (3 months)Complete or update the risk analysis and risk management plan. Map production, backups, support access and subcontractors. Fix serious access, encryption and backup gaps. Review current BAAs and notice duties, keep customer contacts current, and set up an escalation path that can send notices while an investigation continues. Open a gap register against the proposed safeguards.
May 2027 (6 months)Run an incident and contingency exercise that includes customer notice. Demonstrate recovery of critical systems and monthly sample restores. Set measurable patching, scanning and penetration testing cycles. Assemble a reusable evidence package covering report scopes, open findings, a mapping to each safeguard and a responsibility matrix. Obtain missing subcontractor assurances.
November 2027 (12 months)Complete an internal audit and a dry run of the written analysis and certification. Resolve the highest priority architectural gaps and schedule a yearly refresh of the evidence package. Prepare contract language and track renewals. Adjust to any final text.
Open questions and what to watch
  • The next Unified Agenda and any sign that HHS will finalize, narrow, split or withdraw the proposal.
  • Whether a final rule keeps the 72 hour recovery requirement, the annual vendor verification and the end of the required and addressable split.
  • Whether the compliance period and the transition for existing agreements change.
  • OCR's next enforcement actions under the Risk Analysis Initiative and any widening to risk management.
  • How buyers' vendor questionnaires and contract templates change at 2027 renewals.
Sources

Sources for this briefing. We opened every item except those marked "seen in search results", which should be read in the original before being quoted.

Rulemaking

Comments and positions

Enforcement and breach data

Buyer requirements and guidance

Share this update

Security updates by email

Get each update the day it's out.

A monthly digest of the stories that matter most, plus special reports when something needs a closer look: what changed, what it means for your risk, and the questions to ask your team. Unsubscribe in one click.

We send a confirmation link first, so only you can add this address. Privacy

More from us

Briefings summarize public sources in our own words and link to the originals. They are for awareness and are not legal or compliance advice. The proposed rule described here is not final, and its requirements, dates and exceptions may change; what is described reflects what was public in early November 2026. If you want to know how any of this applies to your organization, ask us.

Where to start

Not sure where your HIPAA program stands?

Start with three lists. One covers the systems and vendors that handle ePHI, one the open items from your last risk analysis, and one the evidence your critical vendors have given you. Read against parts two to six, they show where your program already meets today's rule and where the work starts. If you want a second pair of eyes on the lists or the plan, that is work we do.

Talk it through with usNotes, tables and sources

Want to know what this means for you?

Tell us where your organization stands with AI agents and what worries you most. We'll tell you whether it moves your risk, and what we would do first.

No obligation. We reply within one business day.

© 2026 CyberRisk One · Resources · Privacy