HIPAA Security Rule Delayed to 2027: Next Steps for Medical Practices

The HIPAA Security Rule overhaul that the U.S. Department of Health and Human Services (HHS) proposed in January 2025 is still only a proposal, and HHS now lists July 2027 as its target for final action. The Notice of Proposed Rulemaking (NPRM), published in the Federal Register on January 6, 2025 as 90 FR 898, would make encryption, multi-factor authentication, network segmentation and 72-hour system restoration mandatory for covered entities and business associates. In the federal government's 2026 Unified Agenda, the rule has moved to the "Long-Term Actions" stage. For medical practices and outpatient clinics, that delay changes the timeline, not the obligation: the current Security Rule remains in effect, and the HHS Office for Civil Rights (OCR) continues to settle cases built on failures the existing rule already covers.

This article covers where the proposal stands as of November 2026, what the current rule already expects, what recent OCR enforcement shows, and how to use the extra time well.

Is the new HIPAA Security Rule final yet?

No. The rule is proposed, not final. OCR issued the NPRM on December 27, 2024, and it was published in the Federal Register on January 6, 2025 under RIN 0945-AA22, with public comments due by March 7, 2025. The proposed rule in the Federal Register runs 125 pages and would substantially rewrite 45 CFR Part 164, Subpart C.

The most recent status comes from the Unified Agenda entry for RIN 0945-AA22, which HHS publishes through the Office of Management and Budget. As of this writing, it shows:

• Stage: Long-Term Actions, rather than the final rule stage.
• Final action target: July 2027.
• Priority: Economically Significant, and classified as a major rule.
• Legal deadline: None.

The agenda description still says the rule "will" strengthen requirements for regulated entities to prevent, detect, contain, mitigate and recover from cybersecurity threats. In other words, HHS has not withdrawn the proposal. A target date on the agenda is a plan, not a promise.

What would the proposed rule require of medical practices?

According to the HHS fact sheet on the NPRM, the proposal would turn many of today's flexible expectations into specific, written, time-bound requirements. The changes most relevant to a medical practice include:

• Removing the distinction between "required" and "addressable" implementation specifications, so that all specifications become required with limited exceptions.
• Written documentation of all Security Rule policies, procedures, plans and analyses.
• A technology asset inventory and a network map showing how electronic protected health information (ePHI) moves through your systems, updated at least once every 12 months and whenever your environment changes.
• A written risk analysis with specific elements, including a review of that inventory and map, identification of reasonably anticipated threats and vulnerabilities, and a risk level for each.
• Encryption of ePHI at rest and in transit, and multi-factor authentication, each with limited exceptions.
• Vulnerability scanning at least every six months and penetration testing at least once every 12 months.
• Network segmentation, anti-malware protection, removal of extraneous software, and consistent configuration of workstations and other systems.
• Written procedures to restore certain systems and data within 72 hours, plus a criticality analysis to set restoration priorities.
• Written incident response plans, with procedures for testing and revising them.
• A compliance audit at least once every 12 months.
• Annual written verification from business associates that they have deployed the required technical safeguards, and notice from business associates within 24 hours when they activate a contingency plan.

The NPRM also describes the timeline that would apply once a final rule is published: the rule would take effect 60 days after publication, and regulated entities would then have 180 days to comply with new or modified standards. That window is short for a small clinic that has never built an asset inventory or tested a restore, which is why waiting for the final text carries real risk.

What does the current HIPAA Security Rule already require?

The fact sheet is explicit: "While the Department is undertaking this rulemaking, the current Security Rule remains in effect." The rule was first published in 2003 and last revised in 2013, and it still requires administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of ePHI.

Several of the proposed requirements are less new than they look. HHS states in the NPRM that regulated entities are already required to conduct an accurate and thorough risk analysis, and that doing so in practice means inventorying technology assets and understanding how ePHI moves through your systems. Encryption is a similar case. Under the current rule, encryption is an "addressable" specification, which does not mean optional. A practice must assess whether encryption is reasonable and appropriate, implement it if so, and if not, document why and put an equivalent alternative in place. HHS wrote that encryption is built into most software today and that regulated entities "should already have done so in most circumstances."

The practical takeaway is simple. The delay does not give a practice permission to skip the risk analysis, leave laptops unencrypted, or go without a documented reason for a safeguard it did not adopt. Those expectations exist today.

How is OCR enforcing the Security Rule while the update waits?

Recent settlements show OCR focusing on the basics of the existing rule, especially the risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A). Two ransomware cases from HHS's own announcements illustrate the pattern.

On October 29, 2026, OCR announced a settlement with Lehigh Valley Health Network, which HHS described as its 22nd ransomware enforcement action. The Pennsylvania health system discovered suspicious activity on February 4, 2023 that was later determined to be ransomware, and filed a breach report on May 15, 2023. Data affecting 248,359 individuals was exfiltrated and posted on the dark web. OCR's potential violations included failing to conduct an accurate and thorough risk analysis, failing to regularly review information system activity such as audit logs and access reports, and failing to notify individuals and HHS on time. The health system paid $800,000 and agreed to a corrective action plan that OCR will monitor for three years.

In the 21st ransomware action, OSF Healthcare System paid $552,250 and agreed to two years of OCR monitoring after a ransomware attack exfiltrated the PHI of 53,907 individuals. Again, the first potential violation listed was the failure to conduct an accurate and thorough risk analysis.

OCR Director Paula M. Stannard summed up the agency's view in the Lehigh Valley announcement: "The best defense against cyberattacks is full implementation of the HIPAA Security Rule." Both cases were built on the rule that exists today, not the proposed one.

What should a medical practice do before the final rule arrives?

The smartest use of the delay is to close the gaps OCR is already penalizing, while building toward the controls the proposal describes. A practical sequence for a small or mid-sized practice:

1. Refresh the risk analysis. Make it accurate and thorough, cover every system that touches ePHI, and pair it with a written risk management plan. Our guide to HIPAA risk assessments walks through the process.
2. Build the asset inventory and data flow map now. OCR already recommends identifying where ePHI is located and how it enters, flows through and leaves your systems. This becomes the foundation of the risk analysis either way.
3. Turn on multi-factor authentication and encryption everywhere you can. Start with email, remote access, the EHR, and laptops. Document any exception and the alternative safeguard you chose.
4. Review system activity on a schedule. The Lehigh Valley findings included a failure to regularly review audit logs and access reports. Decide who reviews them, how often, and where that review is recorded.
5. Test a restore, not just a backup. Time how long it takes to bring your EHR, scheduling and billing systems back. That number tells you how far you are from the proposed 72-hour target.
6. Write and rehearse the incident response plan. Late notification appeared in both cases above. A tabletop exercise exposes who starts the notification clock. See our overview of healthcare data breach response for the notification steps.
7. Revisit business associate agreements. Ask your IT, billing and software vendors how they protect your ePHI today, and how they would provide the annual written verification the proposal describes.

HHS also offers a free Security Risk Assessment Tool, developed by ONC with OCR, designed for small and medium-sized practices.

How does preparing now lower cost and risk?

Practices that wait for the final rule will face a compressed project: if the proposal's timeline survives, roughly eight months from publication to the compliance date. Spreading the work across the next year lets a practice budget for MFA, encryption, segmentation and testing in normal cycles rather than as an emergency purchase. It also produces the written records, such as the risk analysis, risk management plan and activity reviews, that OCR's corrective action plans ask for after a breach.

It is also worth being realistic about the final text. HHS may change parts of the proposal before it is finalized. The controls in this article, however, are the ones HHS already recommends after ransomware investigations, so the work is unlikely to be wasted. For the requirements that apply today, read our guide to HIPAA IT compliance requirements for medical practices.

How can NorthStar help your practice prepare?

NorthStar Technology Group works with medical practices and outpatient clinics to meet current HIPAA Security Rule requirements and prepare for the proposed changes. That includes risk analysis support, asset inventories and data flow maps, MFA and encryption rollouts, backup and restore testing, and incident response planning. Every healthcare engagement begins with a signed Business Associate Agreement. You can browse more guidance in our healthcare resources hub or learn about our managed IT and security services for healthcare.

Not sure where your practice stands today? Start with a free Security Check to see which gaps to close first.