The Department of Health and Human Services (HHS) issued proposed changes to the HIPAA Security Rule in January 2025 that are intended to address technological changes in healthcare and strengthen the cybersecurity of protected health information (PHI). Although a date of May 2026 was proposed for the final rule, HHS has pushed the expected publication date to July 2027.

One of the many stated reasons for the proposed Security Rule modifications is the “alarming growth in the number of breaches affecting 500 or more individuals…and the rampant escalation of cyberattacks using hacking and ransomware.”

Proposed requirements include:

• conducting a Security Rule compliance audit
• deploying multi-factor authentication in and penetration testing of relevant electronic information systems
• completing network segmentation; disabling unused ports and removing extraneous software
• updating cybersecurity policies and procedures
• revising business associate agreements; and updating workforce member training.

Benefits of the new rules are expected to include:

• a reduction in reputational damage to regulated entities resulting from breaches
• help guarding against potential data loss, preventing health care cost increases to recoup financial losses from responding to breaches
• increased confidence that EPHI is protected to a higher degree than previously
• minimizing the potential disruption of service for individuals served by covered entities

Eagle Associates will monitor for publication of the final Security Rule and will provide articles explaining the new requirements as soon as it is published.

Eagle Associate’s HIPAA Compliance System subscribers will receive updated policies, Security Risk Analysis template and instruction, employee training materials and necessary forms and agreements following publication of the final rule.