US healthcare providers should track the HIPAA Security Rule that applies today, the proposed rule HHS published in January 2025 to strengthen it, and HHS's voluntary cybersecurity guidance for the sector. A proposal is not law. Confirm the current status with HHS and counsel before changing a program because of it.
What applies now?
The HIPAA Security Rule sets standards for protecting electronic protected health information, known as ePHI, held by covered entities and their business associates. It is organized around administrative, physical and technical safeguards. It is risk-based: you assess your environment and choose controls that fit, and you document the decisions. Official text and guidance are on the HHS website, which is the authority for exact requirements.
Two practical points follow. A documented, current risk analysis is the foundation of everything else, and the proposal itself cites common deficiencies the Office for Civil Rights has observed in investigations. And business associates are covered directly, so a vendor that touches ePHI has its own obligations and your contracts should reflect them.
What did HHS propose?
On 6 January 2025, the Federal Register published a notice of proposed rulemaking titled HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, with comments due 7 March 2025. HHS describes the proposal as revising the Security Rule to address changes in how health care is provided, significant increases in breaches and cyberattacks, common deficiencies the Office for Civil Rights has observed in investigations, other cybersecurity guidelines and best practices, and court decisions affecting enforcement.
The notice is long, and this article does not summarize its specific technical requirements. Read the Federal Register text itself, or a summary from counsel, for details.
Is it final?
Our check on 18 October 2026 of the Federal Register's public API found only the January 2025 proposed rule filed under that regulation identifier, and no final rule. That is a point-in-time observation and it needs confirming with HHS, because agencies can act at any time and unified agenda timelines change. Do not describe any proposed requirement to customers or auditors as binding until a final rule says so.
What should providers do in the meantime?
You do not need to wait. The proposal's own stated reasons point to sensible work: rising attacks, repeated findings by investigators, and alignment with recognized cybersecurity practice.
Constructed example: a 40-bed hospital reads the proposal and builds a ninety-day plan without waiting. It refreshes its enterprise-wide risk analysis, completes an inventory of systems that hold ePHI, confirms MFA on remote and administrative access, tests restoring its electronic record system from backup, and reviews contracts with the five vendors that handle the most patient data. Whatever the final rule says, none of that work is wasted.
HHS also runs the HHS Cyber Gateway, which lists Healthcare and Public Health Cybersecurity Performance Goals and free resources for the sector. Check it for current voluntary goals that give a practical baseline.
What about medical devices and software?
Devices and clinical software raise separate questions, such as pre-market expectations from the FDA and patching for devices that cannot be updated easily. We did not confirm current FDA text for this article, so check the agency's cybersecurity pages before relying on a requirement. Meanwhile, inventory every connected device and note which ones cannot be patched and how they are isolated.
How to check or apply this
- Confirm the latest status of the Security Rule proposal on the HHS site and in the Federal Register.
- Refresh the enterprise-wide risk analysis and write down the decisions.
- Build or update the inventory of systems, devices and vendors that handle ePHI.
- Enable MFA on remote access, email and administrator accounts.
- Test restoration of critical clinical systems and record how long it takes.
- Review business associate agreements and ask vendors for evidence of their controls.
- Review state laws too, since some states add their own requirements.
- Brief leadership with plain language on what is proposed, what is in force and what you have done.
Where does Safeguard fit?
Safeguard's compliance automation helps collect evidence and map findings to framework controls, and its dependency scanning covers software you build. It does not make an organization HIPAA compliant and does not replace legal advice.
Quick check
Is the January 2025 HIPAA proposal in effect?
A proposed rule is not in effect. On our 18 October 2026 check we found only the proposal in the Federal Register. Confirm current status with HHS.
Does HIPAA tell you exactly which controls to use?
Not in every case. The Security Rule is risk-based and flexible. You document your analysis and justify the safeguards you choose, which is why a current risk analysis matters.
Sources
- Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 6 January 2025
- Federal Register API record for the same document
- HHS Cyber Gateway
Last reviewed: 18 October 2026.
