The HIPAA Security Rule: Key Updates since March 2025

For businesses operating in the healthcare sector, adhering to guidelines established by the Health Insurance Portability and Accountability Act (HIPAA) is essential to avoid hefty fines and potential legal action. More importantly, it demonstrates a commitment to safeguarding patient data, which is crucial in an era where data breaches and cyber threats are increasingly common.

Earlier this year, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) proposed changes to the HIPAA Security Rule that would transform the landscape of healthcare data protection. Let’s dive into those changes.

Elimination of “Addressable” Standards

One of the most significant proposed updates to the HIPAA Security Rule is the elimination of “addressable” standards. Previously, entities could address these standards in a manner that suited their specific circumstances, often leading to inconsistent implementation. Under the updated rule, all implementation specifications are mandatory, ensuring a more uniform approach to safeguarding electronic protected health information (ePHI).

This change aims to close gaps in security practices and ensure all regulated entities adopt a comprehensive set of security measures. By removing the flexibility previously allowed, the rule ensures all healthcare organizations meet a standard baseline of security, thus enhancing overall protection of sensitive healthcare data.

Mandatory Encryption

Encryption has always been a critical component of data security, but the latest update to the HIPAA Security Rule would make it mandatory for all ePHI. This includes data at rest (stored on devices and servers) and data in transit (being transmitted over networks).

The mandatory encryption requirement significantly reduces the risk of data breaches, ensuring that even if data is intercepted or accessed without authorization, it remains unreadable and unusable. Exceptions to this rule are minimal and well-defined, ensuring encryption becomes the norm rather than the exception in healthcare data security.

Multi-Factor Authentication

The adoption of multi-factor authentication (MFA) as a required security measure represents a significant enhancement in the protection of ePHI. MFA adds an additional layer of security by requiring users to provide two or more verification factors to gain access to sensitive information.

With the implementation of MFA, healthcare organizations can better prevent unauthorized access, even if passwords are compromised. This measure is particularly important in an era where cyber threats are increasingly sophisticated and persistent.

Regular Security Assessments

Regular security assessments would be a mandatory feature under the updated HIPAA Security Rule. Vulnerability scans must be conducted every six months to identify and address potential weaknesses in the organization’s security posture.

Additionally, annual penetration tests are required to simulate attacks on the organization’s systems and uncover vulnerabilities that could be exploited. These proactive measures ensure healthcare entities remain vigilant and continuously improve their security defenses.

Strengthened Risk Analysis

The updated HIPAA Security Rule places a stronger emphasis on comprehensive risk analysis. Organizations would be required to conduct a detailed and documented risk analysis that includes a thorough review of their technology asset inventory and network map.

This enhanced approach ensures all potential risks are identified and addressed, providing a clearer understanding of the organization’s security landscape. By maintaining an up-to-date inventory and network map, healthcare entities can better manage and mitigate risks associated with their technology assets.

Enhanced Incident Response

The revised HIPAA Security Rule offers detailed guidelines and expectations for responding to security incidents. Organizations are required to have well-defined contingency plans and incident response procedures in place.

These enhancements ensure healthcare entities are prepared to effectively respond to and recover from security incidents, minimizing the impact on operations and patient care. Clearer guidelines also help organizations comply with regulatory requirements and improve their overall resilience.

Alignment with NIST Guidelines

The updated HIPAA Security Rule is designed to align closely with the National Institute of Standards and Technology (NIST) guidelines, incorporating recognized cybersecurity best practices.

This alignment ensures healthcare organizations adopt robust security measures that are widely accepted and proven effective. By following NIST guidelines, entities can better protect ePHI and stay ahead of evolving cyber threats.

Expanded Rights for Data Subjects

The updated HIPAA Security Rule would expand the rights of data subjects, providing them with greater control over their ePHI. These amendments ensure individuals can more easily access and manage their health information.

By empowering individuals, the rule aims to promote transparency and trust between healthcare providers and patients. It also ensures patients have the necessary tools to protect their personal health information.

Simplified Consent Processes

The updated rule simplifies the consent processes for sharing Substance Use Disorder (SUD) records. Once the rule is finalized, patients can provide a one-time consent for sharing their SUD information with healthcare entities, streamlining the process and reducing administrative burden.

This change facilitates better coordination of care for patients with SUD, ensuring that healthcare providers have the necessary information to deliver effective treatment. Simplified consent processes also improve patient experience and support compliance with regulatory requirements.

These updated HIPAA requirements aren’t groundbreaking, but they reflect common sense practices most organizations already follow, showing HIPAA is aligning with industry standards. Staying compliant with frameworks like HITRUST and ISO is a smart way to stay ahead of future regulations. Contact us to speak with a member of our team.