Last reviewed: October 27, 2026 · Reading time: 9 minutes · This article is general information, not legal advice.
In January 2025 the US Department of Health and Human Services (HHS) published the most significant proposed changes to the HIPAA Security Rule since it was written. Almost two years on, the rule has not been finalized. That has led some practices to put preparation on hold. We think that is a mistake, because the most demanding proposal, being able to restore critical systems and data within 72 hours, is simply good practice that protects patients and revenue today.
- The proposed rule was published on January 6, 2025 and drew 4,747 public comments. As of October 2026 it remains a proposed rule, with a target final date of July 2027 on the federal regulatory agenda.
- If finalized as proposed, it would take effect 60 days after publication, with a further 180 days to comply.
- It would require written procedures to restore key systems and data within 72 hours, plus mandatory encryption, MFA, an asset inventory and network map, and regular testing.
- Large healthcare breaches keep rising: 805 were recorded in 2025 in HIPAA Journal’s analysis of OCR data.
Where the rule stands today
According to Stringfellow’s October 2026 review, the update is still at the proposed stage. The comment period closed in March 2025, and the regulatory agenda lists a target final date of July 2027, which is an estimate rather than a deadline. Counting the 60-day effective period and 180-day compliance window, realistic enforcement would begin around early 2028. Until then, the existing Security Rule applies in full.
What the proposal would change
| Area | Today | Proposed |
|---|---|---|
| Restore after an incident | Contingency plan required, no fixed restoration time | Written procedures to restore relevant systems and data within 72 hours |
| Encryption | “Addressable” | Required for ePHI at rest and in transit, with limited exceptions |
| Multi-factor authentication | Not explicitly required | Required, with limited exceptions |
| Asset inventory and network map | Implied by risk analysis | Written inventory and data map, updated at least yearly |
| Vulnerability scanning | Not specified | At least every 6 months |
| Penetration testing | Not specified | At least every 12 months |
| Compliance audit | Periodic evaluation | At least every 12 months |
| Business associates | Contracts (BAAs) | Yearly written verification of safeguards; notice within 24 hours when access changes or ends |
Why the 72-hour restore matters most
The breach numbers explain HHS’s focus on recovery. Hacking and IT incidents account for more than 80% of large healthcare breaches, and the largest are enormous: the 2024 Change Healthcare attack affected about 192.7 million individuals, and the largest 2025 breach, at business associate Conduent, about 62.2 million (HIPAA Journal).
For a practice, the operational impact is the hardest part: no scheduling, no charts, no billing. A 72-hour restore target forces three useful questions:
- Which systems count as “key”? Usually the EHR or practice management system, email, imaging, and billing.
- Is there a clean copy an attacker can’t reach? If ransomware can encrypt your backups, there is nothing to restore. Read our 3-2-1-1-0 backup guide.
- Have you proved the timing? Only a test restore tells you whether 72 hours is realistic. Our guide to setting RTO and RPO shows how to tier systems.
A preparation plan that pays off whatever the final rule says
| Step | Action | Helps with |
|---|---|---|
| 1 | List systems holding ePHI, with owner, location and required recovery time | Asset inventory, 72-hour restore |
| 2 | Enforce MFA on Microsoft 365, remote access and the EHR | MFA requirement, phishing |
| 3 | Keep at least one immutable, off-site backup of every ePHI system | 72-hour restore, ransomware |
| 4 | Replicate the EHR or practice server to the cloud if you need recovery in hours | 72-hour restore |
| 5 | Run and document a full restore test twice a year | Contingency planning, audit evidence |
| 6 | Ask business associates for written confirmation of their safeguards | Business associate verification |
Practices regulated by NYDFS, such as dental and health plans, should note that DFS is already penalizing weak recovery and notification. Delta Dental of New York agreed a $2.25 million settlement in April 2026. Our Who We Serve page explains how we support healthcare organizations.
Could you restore your practice in 72 hours?
Ron Klink will assess your backups, Microsoft 365 security and recovery readiness against the proposed rule.
Sources
- Stringfellow, HIPAA Security Rule update: regulators are catching up to what good practices already do, October 2026.
- Medcurity, HIPAA Security Rule changes in 2026.
- HIPAA Journal, Healthcare data breach statistics, updated 2026.
- Phoenix Strategy Group, NYDFS enforces $2.25 million settlement, 2026.
