The Proposed HIPAA Security Rule Update: A Checklist for 2026

Your HIPAA risk assessment is a document, not a feeling. Here's what the proposed rule changes.

The Department of Health and Human Services (HHS) has proposed the most significant update to the HIPAA Security Rule since it was written. If finalized as proposed, it would require mandatory encryption, MFA, regular vulnerability scanning, annual penetration testing, and a regularly updated asset inventory. Those requirements would apply across every system that touches electronic protected health information (ePHI).

The rule is not final. As of this writing, it remains a proposed rule under HHS review, and the current Security Rule stays in effect while that review continues. That distinction matters for how you plan. This article explains both what's proposed and what a reasonable security program already needs to have in place today.

Key takeaways

• Where the proposed rule actually stands right now
• What changes if it's finalized as written
• What a reasonable security program should already document, regardless of the outcome
• A practical checklist you can use with your own team or IT partner

Where the proposed rule actually stands

HHS published its Notice of Proposed Rulemaking for the HIPAA Security Rule in the Federal Register in January 2025. The public comment period closed the following March, and HHS has been reviewing thousands of submitted comments since.

That means the proposal has not been finalized. The current Security Rule, the one your practice is already required to follow, remains fully in effect while HHS continues that review. Treat the proposed rule as a strong signal of where enforcement is heading, not as a deadline on the calendar yet.

Why the direction matters even before the rule is final

Your insurance renewal is likely to ask for MFA and encryption in writing. An examiner is likely to ask for a current risk analysis. Those are many of the same controls the proposed rule would formalize. A practice that waits for the final text is waiting on controls its insurer or examiner may already ask about.

What the proposed rule would change

If finalized as written, the update would remove the current distinction between "addressable" and "required" safeguards. Under today's rule, a practice can document a reasonable alternative to certain controls. Under the proposal, most of those same controls become mandatory with only narrow exceptions.

Encryption of ePHI

The proposal would require encryption of ePHI both at rest and in transit, with only narrow exceptions and no addressable option for smaller practices.

Multi-factor authentication

MFA would become a required control on every system that accesses ePHI. That includes your electronic health record (EHR) system, billing software, scheduling tools, remote access, and any mobile application that touches patient data.

Regular vulnerability scanning and penetration testing

The proposal introduces specific timelines for vulnerability scanning and requires periodic penetration testing rather than leaving the frequency to each practice's judgment.

HHS's fact sheet says the proposal would require vulnerability scanning at least every 6 months and penetration testing at least once every 12 months.

A current, maintained asset inventory

Practices would need to maintain an up-to-date inventory of the technology systems that touch ePHI. A list that was accurate 2 years ago and hasn't been revisited since isn't enough.

Written documentation across the board

The proposal would require written, reviewed, and regularly updated policies, procedures, and risk analyses, not just a completed checklist from your last audit.

What already matters, regardless of the final rule

You don't need to wait for a final rule to know what a defensible security posture looks like. The proposal's direction lines up with the controls cyber insurers and the HHS Office for Civil Rights (OCR) may ask about.

A practice administrator preparing for a renewal or an audit should already be able to answer a few direct questions. Is MFA enforced everywhere ePHI can be accessed, not just on the systems where it was easiest to turn on?

• Is ePHI encrypted at rest and in transit across every system that stores it, including backups?
• Do you have a current, written risk analysis, or does yours predate your last major software change?
• Can you produce documentation showing when vulnerabilities were last scanned and addressed?

If any of those questions don't have a confident answer, that's the gap worth closing first.

Our post on why compliance is no longer a large-company problem looks at how this applies to smaller organizations.

A practical checklist for practice administrators

Use this as a starting point for a conversation with your own team or IT partner, not as a substitute for a formal risk analysis.

Access and authentication

Enforce MFA on your EHR, email, remote access, and any system that touches ePHI. Don't carve out exceptions for convenience.

For related reading, see our post on why identity has become your organization's new security perimeter.

Encryption

Encrypt ePHI at rest and in transit, including on laptops, mobile devices, and backup systems, not just your primary database.

Our guide on why backup alone is not a recovery strategy looks at backups and recovery.

Asset inventory

Keep a current list of every system, device, and application that creates, stores, or transmits ePHI. Review it on a set schedule rather than updating it only when something breaks.

Vulnerability management

Document a schedule for vulnerability scanning, and keep a record of what was found and fixed.

Penetration testing

Have an independent party test your systems periodically, then document the findings and address them rather than filing them away.

Network documentation

Keep a current network diagram and configuration record that your IT partner or examiner can review, not a description that lives in one person's memory.

Written risk analysis

Keep a risk analysis that reflects your current systems and vendors. Review it on a regular schedule rather than leaving it unopened since the last renewal.

AI use

Can you account for how your staff is using AI on client and patient files?

What KairosIT delivers

KairosIT builds the documented, HIPAA-aligned IT controls that support this kind of checklist, along with the uptime that protects your schedule. That includes the following.

• An inventory of the systems and vendors that touch ePHI
• MFA and encryption implementation
• Vulnerability scanning
• The written documentation your next audit or insurance renewal will ask you to produce

For more on how we support practices like yours, see our IT services for healthcare.

KairosIT does not provide formal compliance attestation or certification. The KairosIT Compliance Readiness Assessment supports your compliance efforts with documentation and evidence. It does not replace legal or compliance counsel, and it doesn't certify your practice as compliant with any framework.

The KairosIT Compliance Readiness Assessment

The Assessment is a structured evaluation of your security posture, backup integrity, and regulatory documentation gaps, including an inventory of the AI tools your staff is actually using. You finish with a written findings report you can act on, whether or not you work with KairosIT afterward.

If your practice doesn't yet have documented answers to the questions above, that findings report is a reasonable place to start. That holds whether the final HIPAA Security Rule arrives next year or later.

Book your KairosIT Compliance Readiness Assessment

The proposed rule isn't final, and it may still change before it is. What won't change is the direction. Encryption, MFA, documented risk analysis, and a current asset inventory are already the baseline your insurer and your next examiner expect.

A HIPAA risk assessment is a document, not a feeling. If yours isn't current, or you're not sure, book your Compliance Readiness Assessment with KairosIT. Find out exactly where the gaps are before someone else asks you to produce the answer.