Should You Wait for the Final HIPAA Security Rule Before Upgrading Your Security Program?

No. The proposed HIPAA Security Rule overhaul is not final, and the federal regulatory agenda now shows final action in July 2027 rather than the May 2026 target HHS originally floated (HIPAA Journal). But the rule that is in force today already requires an accurate and thorough risk analysis, and OCR is still settling cases on exactly that point (HHS press release, September 17, 2026). The delay buys planning time. It does not buy a pause in enforcement.

Healthcare compliance teams are stuck between two timelines. One is a proposed rule that would turn today's flexible, risk-based standard into a prescriptive checklist. The other is the current rule, which OCR is enforcing now. This post lays out where the rulemaking stands, what would change, and which investments are worth making before anyone knows the final text.

Where the rulemaking stands

HHS's Office for Civil Rights issued the Security Rule notice of proposed rulemaking (NPRM) on December 27, 2024, and HHS states that the current Security Rule remains in effect while the Department undertakes the rulemaking. The NPRM was published in the Federal Register on January 6, 2025, and OCR received almost 5,000 comments, according to HIPAA Journal's reporting. HHS had proposed a May 2026 release for the final rule. The Office of Management and Budget's website now shows final action due in July 2027, and HIPAA Journal notes that date could slip again, or that OCR could act earlier.

Treat July 2027 as a planning assumption, not a promise. Rules of this size routinely change between proposal and final text, and nothing in the public record commits the current administration to finalizing the proposal as written. What is certain is the baseline: the existing rule, in HHS's own summary, is organized around administrative, physical, and technical safeguards, and it dates to 2003, with the last major update in the 2013 Omnibus Rule (HIPAA Journal).

What the proposal would change

The proposal's central move is to end the "addressable" category. Under today's rule, HHS is explicit that "addressable" does not mean optional: an entity must adopt the specification where it is reasonable and appropriate, or document why not and adopt an equivalent alternative. Many organizations have read that flexibility generously. Per HIPAA Journal's summary of the NPRM, the proposal would instead:

• Eliminate the addressable classification and make implementation specifications mandatory, with limited exceptions.
• Require encryption, multifactor authentication, network segmentation, and anti-malware protection.
• Require annual penetration tests and vulnerability scans every six months.
• Require annual audits of Security Rule compliance and risk analyses at least annually, built on a technology asset inventory and a network map showing how ePHI flows.
• Add dedicated backup and recovery controls for ePHI, shorter timelines for business associates, and extensive written documentation.

Each of these maps to work that organizations either already do or can start now. That is the useful way to read the proposal: as a preview of the evidence an auditor could ask for, not as a reason to wait.

What OCR is enforcing today

On September 17, 2026, OCR announced a $700,000 settlement with Ambry Genetics over a phishing attack that potentially exposed the PHI of 225,370 individuals. OCR found potential Security Rule violations including failure to conduct an accurate and thorough risk analysis, failure to terminate access to ePHI when a workforce member's arrangement ended, and failure to assign unique user identifiers. Ambry will operate under a two-year corrective action plan (HHS).

The OCR director's statement in that release is the clearest signal available on posture: conducting a compliant risk analysis, engaging in risk management, and fully implementing the Security Rule provisions "continue to be the foundation for effective cybersecurity and the best cyberdefense." None of those obligations depend on the final rule. Meanwhile the threat volume has not gone away: 397 breaches affecting 500 or more individuals were reported to OCR between January 1 and June 30, 2026, a 5.9 percent decline from the first half of 2025.

A no-regret plan for the next 12 months

Because the final text is unknown, prioritize work that satisfies both the current rule and every version of the proposal that has been discussed publicly. In rough order:

1. Build the asset inventory and ePHI data-flow map. A defensible risk analysis cannot exist without knowing which systems create, receive, store, or transmit ePHI. This is also the first thing the proposal's annual risk analysis would depend on.
2. Redo the risk analysis against that inventory and tie it to a remediation plan. The Ambry findings show where OCR looks first. Document the plan and keep the evidence; the current rule requires documentation to be retained for six years, per HIPAA Journal's summary of the administrative safeguards.
3. Close access-control gaps. Terminate access promptly when roles end, enforce unique user IDs, and extend MFA to remote access, email, and privileged accounts.
4. Move to a recurring vulnerability scanning cadence of at least every six months, and in practice more often for internet-facing systems. Schedule a penetration test annually; our penetration test cost guide covers how scope drives price.
5. Test recovery, not just backup. The current contingency plan standard in 45 CFR 164.308 already calls for a data backup plan, disaster recovery plan, and emergency-mode operations plan, and the proposal would add dedicated backup and recovery controls.
6. Retire "addressable" as a shield. For every addressable specification you currently treat as not applicable, re-read your written rationale. If it would not survive a reviewer who assumes the control is mandatory, implement it.

Business associates and vendor oversight

The proposal pushes responsibility outward, with shorter timelines for business associates and verification of their technical safeguards. Even before any final rule, a covered entity's exposure includes the notification clock its vendors can actually meet. If your managed security provider or hosting partner takes days to tell you about an incident, your own breach notification obligations are already compromised; we walk through that arithmetic in our MSSP breach-notification contract guide. Review business associate agreements now for incident-notice windows, evidence-sharing rights, and exit terms.

Where managed security fits

For many regulated organizations the practical gap is operational, not conceptual: continuous monitoring, scheduled scanning, and evidence collection that survives an audit. A managed program can supply those, but accountability for the risk analysis stays with the covered entity or business associate. Cyberuptive's healthcare security practice and the HIPAA Security Rule readiness checklist are starting points for scoping what to build in-house and what to outsource.

Frequently asked questions about the HIPAA Security Rule update

Is the proposed HIPAA Security Rule update in effect?

No. The proposal is a notice of proposed rulemaking issued on December 27, 2024. HHS states that the current Security Rule remains in effect while the rulemaking proceeds, so existing requirements, including the risk analysis requirement, still apply today.

When will the final HIPAA Security Rule be published?

No date is committed. HHS originally targeted May 2026, but the Office of Management and Budget's website now shows final action due in July 2027. That date could be extended further, and the rule could also be finalized earlier.

What does it mean to eliminate the addressable classification?

Today, addressable implementation specifications must be adopted when reasonable and appropriate, or replaced with a documented equivalent alternative. The proposal would remove that flexibility and make implementation specifications mandatory, with limited exceptions. Encryption is the most commonly cited example.

Should we start MFA, encryption, and penetration testing before the final rule?

Yes, where they also support your current risk analysis. These controls address risks OCR already expects you to identify and manage, and the proposal would require them. Starting now spreads cost and gives you evidence of risk management if an investigation occurs.

Is OCR still enforcing the Security Rule while the update is pending?

Yes. On September 17, 2026, OCR announced a $700,000 settlement with Ambry Genetics, citing failures including an inaccurate or incomplete risk analysis, and imposed a two-year corrective action plan.

Does the proposed rule affect business associates?

Yes. Business associates are regulated directly under the Security Rule, and the proposal describes shorter timelines for them and verification of their technical safeguards. Covered entities should review business associate agreements for incident-notice windows and evidence-sharing rights.