The HIPAA Security Rule overhaul slipped to 2027. That's not a reprieve.
HHS has moved the Security Rule rewrite to its long-term regulatory agenda, with final action now anticipated in July 2027. The date that should be driving your planning isn't that one — it's the 240 days that start the moment the rule publishes.
If you have been waiting for the biggest change to HIPAA security requirements in more than a decade, you are still waiting. The Notice of Proposed Rulemaking — HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information — was published in the Federal Register on January 6, 2025 (HHS's own fact sheet is the shorter read). The comment period closed on March 7, 2025, and OCR received roughly 4,745 comments. OCR's earlier agenda targeted a final rule in spring 2026. That target has moved.
In the Fall 2026 Unified Agenda, HHS moved the proposed amendments (RIN 0945-AA22) to its Long-Term Actions list and identified July 2027 as the anticipated timeframe for final action. The Privacy Rule changes are on a separate, faster track. And the pressure to withdraw the security proposal entirely is real: a coalition of more than a hundred hospital and provider groups has asked HHS to do exactly that, arguing the cost estimates understate the burden on under-resourced providers.
What has not changed
The existing Security Rule is still the enforceable standard, and enforcement did not pause while the rewrite stalled. HHS inflation-adjusted HIPAA civil monetary penalties effective January 28, 2026. Your risk analysis obligation, your business associate agreements, and your breach notification duties all sit exactly where they sat in 2024.
Which means the delay changes your deadline, not your workload. Organizations treating "the rule isn't final" as a reason to defer the current requirements are misreading which rule they're actually being audited against.
What the proposal would add
The proposed rule is prescriptive in a way HIPAA has never been. The changes that matter most for anyone maintaining a control library:
The distinction between required and addressable implementation specifications would be eliminated. Every specification becomes a requirement. For most organizations this is the single largest change — a decade of documented decisions not to implement an addressable control would need revisiting.
Encryption of ePHI at rest and in transit moves from addressable to required, with narrow technical exceptions and tighter documentation for invoking them. Multi-factor authentication would be required for systems accessing ePHI.
Comprehensive technology asset inventories and network maps, maintained rather than produced once. This is the requirement organizations most consistently underestimate, because it turns scope from a document into an operational process.
More prescriptive risk analyses, annual penetration testing and vulnerability scanning, defined incident response and disaster recovery obligations, and strengthened verification of business associate safeguards.
The real deadline is 240 days
Here is the arithmetic that should shape your planning. When the final rule publishes, covered entities get 180 days for the substantive requirements, and business associates get an additional 60 days to bring agreements into line — 240 days in total.
Eight months to inventory every system holding ePHI, close the gaps that "addressable" used to cover, deploy MFA across clinical and administrative systems, stand up recurring testing, re-paper your business associate agreements, and document all of it well enough to survive an investigation. For an organization running aging on-premises infrastructure and informal device management, eight months is not a planning horizon. It's a scramble.
Why a mapped control library absorbs this
This is the argument for a mapped control library rather than a framework-by-framework program. If your HIPAA compliance is a standalone binder, a final rule means rebuilding the binder inside the 240-day window. If your HIPAA obligations are expressed as controls in a maintained library, the same rule means a mapping update: new requirements land against controls you already operate, and the gaps that remain are genuinely gaps rather than unknowns. Most of what the proposal would newly require — encryption, MFA, asset inventory, testing cadence — you are already doing for SOC 2 or ISO 27001. The work is proving it under a different framework's language, which is exactly what mapping is for. See how multi-framework compliance works for in-house teams.
What to do in the next two quarters
- Find every addressable decision you've documented. Those are your candidate gaps under a final rule. Knowing the list is most of the work.
- Get the asset inventory real. Not a spreadsheet from last year — a maintained record of where ePHI lives, including the places nobody wants to admit it lives.
- Close encryption and MFA now. These are the two requirements with procurement and change-management tails. They do not compress into eight months alongside everything else.
- Map, don't duplicate. If you carry SOC 2, ISO 27001, or CMMC alongside HIPAA, express the obligations once and inherit across. Duplicated programs are what makes a rule change expensive.
The Security Rule rewrite is delayed, not dead — July 2027 is the current target and it could move again. The existing rule is fully enforceable today, with higher penalties than last year. When the final rule publishes you get 240 days, and the organizations that absorb it comfortably will be the ones whose controls were already mapped rather than filed.