Written and maintained by CASRAI Editorial Board
Last updated
The HIPAA Security Rule Notice of Proposed Rulemaking (NPRM)—published by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in the Federal Register on January 6, 2025 (90 FR 898, RIN 0945-AA22, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information)—represents the most sweeping structural overhaul of 45 CFR Part 164, Subpart C since the original HIPAA Security Rule was finalized in 2003 and updated under the HITECH Omnibus Rule in 2013.
Prompted by a surge in ransomware attacks and large-scale healthcare data breaches affecting over 167 million individuals in a single year, the HHS OCR rule overhaul targets the root architectural weaknesses cited in OCR breach investigations: treating “addressable” controls as optional, lacking complete technology asset inventories, failing to deploy universal Multi-Factor Authentication (MFA) and encryption, and lacking tested 72-hour disaster recovery capabilities across administrative, physical, and technical safeguards.
What Are the Proposed HIPAA Security Rule Changes? Core Structural Overhaul
The HHS OCR NPRM restructures 45 CFR §§ 164.304–164.316 around eight major operational and technical mandates that apply equally to Covered Entities (hospitals, clinics, health plans, clearinghouses) and Business Associates (cloud providers, EHR vendors, billing services, and clinical research data platforms):
| Regulatory Domain (45 CFR Part 164) | Legacy 2003 / 2013 HIPAA Security Rule | Proposed HIPAA Security Rule Overhaul (90 FR 898) |
|---|---|---|
Implementation Specification Status (§ 164.306(d)) |
Split specifications into “Required” and “Addressable” (permitting entities to document why a control was not reasonable and substitute an alternative). | Eliminates the “Required” vs. “Addressable” distinction entirely. All implementation specifications are mandatory unless a narrow, explicitly codified regulatory exception applies. |
Technology Asset Inventory & Network Map (§ 164.308(a)(1)) |
Implied as part of the general Security Risk Analysis (SRA), with no explicit format or cadence codified in the regulation text. | Requires a formal written Technology Asset Inventory and a Network Map tracking all ePHI data flows (including AI tools, APIs, and IoT/medical devices), updated at least every 12 months and upon material environment changes. |
Encryption of ePHI (§ 164.312(a)(2)(iv) & (e)(2)(ii)) |
“Addressable” specification for both data at rest and data in transit. | Mandatory encryption of all ePHI both at rest and in transit using prevailing NIST cryptographic standards, with tightly bounded exceptions (such as legacy FDA-authorized medical devices with documented compensating controls). |
Multi-Factor Authentication (MFA) (§ 164.312(d)) |
Required general “Person or Entity Authentication” without explicitly mandating MFA in the regulatory text. | Explicitly mandates Multi-Factor Authentication (MFA) for all users and accounts accessing relevant electronic information systems or ePHI. |
Network Segmentation (§ 164.312(e)) |
Not explicitly mentioned in the 2003 rule text. | Requires technical controls to segment electronic information systems (isolating EHRs, biomedical devices, and research enclaves) to prevent lateral ransomware propagation. |
Contingency Plan & Restoration Speed (§ 164.308(a)(7)) |
Required a data backup plan and disaster recovery plan without a specific numerical restoration deadline. | Mandates written procedures and verified technical capability to restore critical relevant electronic information systems and data within 72 hours of a loss. |
| Vulnerability Scanning & Penetration Testing | Required periodic technical and non-technical evaluations (§ 164.308(a)(8)) without fixed intervals. |
Mandates automated vulnerability scans at least every 6 months and penetration testing at least every 12 months by a qualified person, plus strict patch management timelines. |
Business Associate Verification (§ 164.308(b) & § 164.314(a)) |
Required a signed written Business Associate Agreement (BAA) without mandatory annual technical verification. | Requires obtaining annual written verification from every Business Associate (backed by a technical compliance assessment and executive certification) that required technical safeguards are deployed, plus 24-hour notification upon contingency plan activation. |
How Does the HIPAA Security Rule NPRM Change Encryption and MFA Requirements?
Under the 2003 Security Rule (45 CFR § 164.306(d)(3)), HHS categorized encryption and decryption as “addressable” because commercial disk and database encryption in 2003 carried performance overhead. In practice, OCR enforcement investigations repeatedly found that hospitals and clinics misinterpreted “addressable” to mean “optional”—leaving laptops, database volumes, backup tapes, and internal network traffic unencrypted without performing a valid risk equivalence analysis.
- Universal Encryption Mandate (At Rest & In Transit): By eliminating the “addressable” category, the NPRM requires every Covered Entity and Business Associate to encrypt all ePHI at rest and in transit using cryptographic algorithms that meet prevailing National Institute of Standards and Technology (NIST) standards (such as AES-256 at rest and TLS 1.2/1.3 in transit), with decryption keys stored separately from the encrypted data. Narrow exceptions apply only when an individual formally requests unencrypted delivery under
45 CFR § 164.522(b)/§ 164.524after being advised of the risks, or when an legacy FDA-cleared/approved medical device cannot technically support encryption and is isolated behind documented compensating controls. - Mandatory Multi-Factor Authentication (MFA): Under revised
45 CFR § 164.312(d), authentication must verify at least two of three distinct factors (something the user knows, possesses, or is) before granting access to any system containing ePHI, privileged administrative consoles, remote VPNs, or HIPAA-compliant cloud infrastructure. - Separate Technical Controls for Administrative Access & 24-Hour Termination: Workforce access controls must separate standard user accounts from privileged administrator accounts, and workforce access to ePHI must be terminated within 1 hour of employment termination (and within 24 hours notification when a contractor or Business Associate workforce member’s access changes).
Technology Asset Inventory, Network Mapping, and Vulnerability Management Timelines
For academic medical centers, health systems, and clinical research organizations managing hybrid cloud and laboratory environments, the NPRM codifies specific engineering cadences previously left to voluntary frameworks like NIST SP 800-66 Rev. 2 and HHS 405(d) HICP:
- Technology Asset Inventory & ePHI Network Map (Every 12 Months): Compliance teams must maintain a comprehensive inventory of every hardware server, workstation, mobile device, API, software application, and networked medical device that creates, receives, maintains, or transmits ePHI, paired with a visual and logical network map tracing how ePHI enters, moves through, and exits the environment (including transfers to third-party Business Associates and research repositories).
- Specific Patch Management & Vulnerability Remediation Windows: In addition to automated vulnerability scanning every 6 months and annual penetration testing, regulated entities must continuously monitor authoritative vulnerability feeds (such as CISA KEV and the National Vulnerability Database) and apply critical and high-severity patches within defined risk-based timelines.
- Anti-Malware, Backup Immutability, & 72-Hour Restoration Testing: Systems must deploy real-time anti-malware protections, remove extraneous software and disable unnecessary network ports, maintain immutable/isolated ePHI backups, and test disaster recovery procedures at least annually to verify that critical clinical systems can be restored within 72 hours.
Impact on Clinical Research Data Enclaves, Cloud Vendors, and Business Associates
Research universities (hybrid entities under 45 CFR § 164.105), Electronic Data Capture (EDC) vendors, and health tech Business Associates face two direct operational impacts from the updated HIPAA Security Rule framework:
- Annual Written Technical Verification From Business Associates: A one-time signed BAA on file is no longer sufficient. Covered Entities must collect an annual written verification from each Business Associate—accompanied by a documented technical analysis of the Business Associate’s information systems and a written certification signed by a person with authority (such as a CISO or corporate officer)—attesting that all required HIPAA Technical Safeguards have been implemented.
- 24-Hour Contingency Plan Activation Reporting: Separate from the 60-day Breach Notification Rule timeline for confirmed breaches of unsecured PHI, Business Associates must notify Covered Entities within 24 hours of activating their contingency plan due to a ransomware event, outage, or security emergency.
