HIPAA Is Changing.
Be Ready Early.
HHS has proposed the most significant HIPAA overhaul in over a decade. The rules are not final yet, but enforcement of today's requirements is active, and the organizations that prepare now will avoid a scramble later.
Where things stand
The Biggest Update in Over a Decade.
The Department of Health and Human Services, through its Office for Civil Rights, has put forward the most sweeping modernization of the HIPAA Security Rule in more than ten years. The proposal drew thousands of public comments and signals a decisive shift in how healthcare organizations and their vendors are expected to protect electronic protected health information. The era of "we will get to it eventually" is ending, and the coming rules are built around controls that are prescriptive, testable, and mandatory rather than optional.
At the center of the overhaul is a hard line on access and data protection. Multi-factor authentication would become mandatory across every point where someone can reach patient data, and encryption of that data, both at rest and in transit, would move from a discretionary "addressable" item to a firm requirement. In practice, weak passwords and unencrypted systems would no longer be defensible gaps. They would be violations.
Just as significant is the expectation that you can prove you know your own environment. Organizations would be required to maintain a full inventory and map of every system that touches patient data, so nothing sensitive is left undocumented or forgotten. That visibility must be backed by continuous testing: vulnerability scans at least every six months and a full penetration test every year, turning security from a once-in-a-while project into an ongoing discipline.
Finally, the proposal hardens how you contain and recover from incidents. Networks would need to be segmented so a single breach cannot move freely across the organization, critical systems would need documented plans to be restored within 72 hours, and every covered entity and business associate would be expected to complete a formal compliance audit each year. Taken together, these changes reward the organizations that prepare now and expose those that wait. The sections below break down exactly what is coming and how Code Genius helps you get ahead of it.
Proposed Security Rule
What Would Change.
If finalized as proposed, these requirements would reshape how healthcare organizations and their vendors protect electronic protected health information.
Mandatory Multi-Factor Authentication
MFA would be required across all access points to electronic protected health information (ePHI), closing one of the most exploited gaps in healthcare security.
No More "Addressable" Controls
The long-standing distinction between "required" and "addressable" specifications would be largely eliminated, making most safeguards mandatory.
Encryption Becomes Compulsory
Encryption of ePHI at rest and in transit would shift from addressable to a firm requirement, with narrow exceptions.
Asset Inventories & Data Maps
Organizations would maintain a written technology asset inventory and network data-flow maps, reviewed and updated at least annually.
Vulnerability Scanning & Pen Testing
Vulnerability scanning at least every six months and annual penetration testing would become standard practice.
Network Segmentation
Networks would need to be segmented to contain threats and limit lateral movement, keeping systems that touch ePHI isolated from the rest of the environment.
72-Hour Recovery Plans
A written incident response plan with a 72-hour critical-system recovery objective, plus 24-hour notice from business associates when contingency plans activate.
Annual Compliance Audits
Covered entities and business associates would conduct and document internal compliance audits every 12 months.
Proposed Privacy Rule
Changes for Patient Rights.
Faster Record Access
The window to provide individuals copies of their PHI would shrink from 30 days to 15 days.
Expanded Patient Access
Individuals could inspect records in person and take notes or photos, and providers would post estimated fee schedules for access.
Broader Care Coordination
The definition of "health care operations" would expand to include care coordination and case management, with new minimum-necessary exceptions.
How Code Genius helps
Get Ahead of the Changes Now.
Most of what's proposed is already recognized as security best practice. Our team helps you close the gaps early so a future deadline never turns into a fire drill.
A smarter first move
Talk Through Your HIPAA Roadmap.
Book a call and we'll help you assess where you stand today and build a practical plan for what's coming.
This page is for general informational purposes only and does not constitute legal advice. The rules described are proposed and not yet final; specific requirements and timelines may change. Consult qualified legal and compliance counsel for guidance specific to your organization.