The Proposed HIPAA Security Rule Is Coming: Why July 2027 Is Closer Than You Think
The proposed HIPAA Security Rule update is not law yet. There is no current compliance deadline for the proposed changes.
That does not make it safe to wait.
HHS currently targets July 2027 for final action on the proposal. If the final rule follows the proposed structure, organizations would have approximately 240 days from publication to mandatory compliance:
- 60 days until the final rule becomes effective
- 180 additional days to comply with most new or modified requirements
Two hundred forty days may sound manageable. For a healthcare organization that needs to build an accurate asset inventory, map ePHI across systems, deploy comprehensive MFA and encryption, establish continuous vulnerability management, update policies, validate business associates, and document risk decisions, it is not a long runway.
It is a compressed implementation window.
The better strategy is clear: use the time before the final rule to address requirements that are already aligned with current HIPAA expectations.
> This article reflects the regulatory landscape as of September 22, 2026. The proposed rule may change before final publication. Organizations should consult qualified legal and compliance professionals for advice specific to their circumstances.
THE PROPOSAL IS PENDING. THE CURRENT RULE IS ENFORCEABLE NOW
HHS published the proposed rule, titled “HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information,” in January 2025.
The proposal would make several cybersecurity practices more explicit and prescriptive. These include requirements involving:
- Technology asset inventories
- Network and ePHI mapping
- Risk analysis and risk management
- Multifactor authentication
- Encryption
- Vulnerability management
- Patch management
- Network segmentation
- Incident response and contingency planning
- Compliance audits and documentation
The proposal is still a proposal. HHS’s July 2027 target is a planning estimate, not a guarantee that a final rule will be published on that date.
However, organizations should not confuse “not final” with “not relevant.”
The existing HIPAA Security Rule remains fully enforceable. Covered entities and business associates must already implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI.
The proposed rule largely provides greater detail around activities that effective security programs should already perform.
OCR’S 2026 ENFORCEMENT SENDS A CLEAR MESSAGE
OCR enforcement is not waiting for the final rule.
In 2026, OCR collected more than $2.2 million in settlements tied to risk analysis failures. The pattern matters: organizations are not being penalized only because they experienced a cyberattack. They are being scrutinized for failing to understand and manage the risks that made the attack possible.
The Ambry Genetics settlement, for example, involved a phishing incident affecting more than 225,000 individuals. OCR cited failures that included:
- Not conducting an accurate and thorough risk analysis
- Not properly terminating access to ePHI
- Not assigning unique user IDs to all workforce members accessing ePHI
That is the enforcement lesson: a breach may trigger the investigation, but the underlying compliance failure often begins with incomplete risk analysis.
OCR’s Risk Analysis Initiative reinforces the expectation that risk analysis must be accurate, thorough, documented, and connected to an active risk management process.
A checklist completed years ago is not enough. A generic template is not enough. A vulnerability scan without business context is not enough.
WHY 240 DAYS IS NOT A REALISTIC STARTING POINT
The proposed 240-day window begins only after a final rule is published. It does not account for the time required to prepare your organization to act.
For many healthcare organizations, the work involves multiple departments, vendors, locations, applications, cloud platforms, medical devices, and legacy systems. Security improvements must be implemented without disrupting patient care or critical operations.
Consider the proposed requirements individually:
ASSET INVENTORIES TAKE DISCIPLINE
You cannot protect technology assets you cannot identify.
A defensible inventory should account for endpoints, servers, cloud workloads, medical devices, applications, remote-access systems, network equipment, and other technology that creates, receives, maintains, or transmits ePHI.
The inventory also needs ownership, location, business purpose, criticality, and security status. That is an operational program, not a one-time spreadsheet.
NETWORK AND DATA MAPPING REQUIRE CONTEXT
Organizations need to understand how ePHI moves through their environment.
That means documenting systems, integrations, interfaces, storage locations, transmission paths, administrative access, third-party connections, and backup environments. The goal is not to create a decorative diagram. The goal is to identify where a compromise could begin and how far it could spread.
MFA AND ENCRYPTION ARE ENTERPRISE-WIDE PROJECTS
Deploying MFA to a few administrative accounts is different from implementing MFA across workforce, privileged, remote, cloud, vendor, and application access.
Encryption also requires more than enabling a default setting. Organizations must examine data at rest, data in transit, endpoint storage, backups, removable media, email workflows, and third-party platforms.
VULNERABILITY MANAGEMENT MUST BE CONTINUOUS
The proposed rule points toward recurring vulnerability scanning and more active remediation practices.
That is a significant shift away from point-in-time compliance exercises. New assets appear. New vulnerabilities are disclosed. Exploits change. Risk changes.
Cenova Cyber’s Vulnerability Management as a Service combines asset discovery, recurring scanning, risk-based prioritization, remediation coordination, and validation reporting. The objective is straightforward: find the exposures that matter and verify that they are fixed.
BUILD YOUR HIPAA READINESS ROADMAP NOW
Organizations should begin with the work that creates value under both the current rule and the proposed framework.
1. COMPLETE A COMPREHENSIVE SECURITY RISK ANALYSIS
Start with an enterprise-wide review of risks and vulnerabilities to ePHI.
Your SRA should identify:
- Every environment where ePHI exists
- Threats and vulnerabilities affecting confidentiality, integrity, and availability
- Existing safeguards and control gaps
- Third-party and business associate risks
- Likely business and patient-care impacts
- Prioritized remediation actions
- Responsible owners and target dates
Document the methodology, evidence reviewed, decisions made, and limitations identified.
2. BUILD AN ACCURATE ePHI ASSET INVENTORY AND DATA MAP
Connect your inventory to your data flows.
Identify where ePHI is created, received, maintained, transmitted, stored, backed up, and destroyed. Include cloud services, remote access, applications, medical devices, business associates, and shadow IT.
This work becomes the foundation for risk analysis, access control, encryption, incident response, and business continuity.
3. IMPLEMENT MFA AND ENCRYPTION COMPREHENSIVELY
Prioritize privileged accounts, remote access, cloud administration, email, VPNs, clinical applications, and third-party access.
Then validate coverage. Identify exceptions. Document compensating controls where necessary. Do not treat MFA or encryption as a binary checkbox disconnected from actual exposure.
4. ESTABLISH CONTINUOUS VULNERABILITY MANAGEMENT
Move beyond scan-and-dump reporting.
Your program should include:
- Continuous asset discovery
- Internal and external vulnerability scanning
- Risk-based prioritization
- Patch and remediation tracking
- Validation scans
- Exception management
- Executive and compliance reporting
The proposed HIPAA rule specifically recognizes the importance of asset inventories, patch management, vulnerability management, and stronger technical safeguards.
5. DOCUMENT RISK MANAGEMENT DECISIONS
Not every control can be implemented immediately. That does not eliminate the obligation to manage the risk.
Document:
- The risk being addressed
- The control selected
- The owner
- The implementation timeline
- Any accepted limitations
- Compensating safeguards
- Approval and review dates
Strong documentation demonstrates that security decisions are deliberate, risk-based, and actively managed.
HOW CENOVA CYBER SUPPORTS HIPAA READINESS
Cenova Cyber helps healthcare organizations turn HIPAA obligations into a measurable security program.
HIPAA SECURITY RISK ASSESSMENT
Our HIPAA SRA services help identify risks to ePHI, evaluate existing safeguards, prioritize remediation, and create documentation leadership can use to make informed decisions.
VULNERABILITY MANAGEMENT AS A SERVICE
Our VMaaS program supports continuous discovery, risk-based prioritization, remediation coordination, and validation. Your team receives actionable risk information, not another isolated report.
VIRTUAL CISO SERVICES
Our vCISO services provide executive-level cybersecurity leadership without the cost of hiring a full-time CISO. We help align security strategy, compliance obligations, technical priorities, budgets, and business goals.
Together, these services create a practical path from risk identification to measurable risk reduction.
DO NOT WAIT FOR THE FINAL RULE
The final HIPAA Security Rule may change. The July 2027 target may move. The final compliance language may differ from the proposal.
The need for accurate risk analysis will not disappear.
Healthcare organizations that begin now will have more time to identify gaps, fund improvements, coordinate vendors, protect patient care, and build evidence of responsible risk management. Organizations that wait for publication may be forced to complete multi-year security work inside a 240-day window.
Start with the SRA. Build the inventory. Map the data. Strengthen access and encryption. Establish continuous vulnerability management. Document every material decision.
Contact Cenova Cyber for a free HIPAA Security Risk Assessment consultation.
Find the gaps before OCR does. Build a security program that protects ePHI, supports compliance, and keeps your organization moving forward.