Your workforce is an important part of protecting electronic protected health information (ePHI). HIPAA already requires covered entities and business associates to train their workforce, maintain security policies, and control access to ePHI. A proposed update to the HIPAA Security Rule would make many of these requirements more specific. 

What Does HIPAA Require Today? 

The current Security Rule requires a security awareness and training program for all workforce members, including management. It also includes addressable provisions covering security updates, protection from malicious software, login monitoring, and password management. 

Organizations must maintain written Security Rule policies and procedures, update them when needed, and have procedures for ending access when a workforce member leaves. However, the current Security Rule does not set a specific annual training schedule, a deadline for training new workforce members, or a timeframe for removing access. 

What Would the Proposed Rule Change? 

If finalized as written, the proposed rule would establish clearer training content and deadlines. Covered entities and business associates would need to: 

• Provide role-based security training at least once every 12 months 

• Train new workforce members no later than 30 days after they first receive system access 

• Provide updated training within 30 days of a material policy or procedure change affecting someone’s role 

• Provide ongoing reminders/continuous trainings about security responsibilities and emerging threats 

• Document that training and reminders were provided 

The proposal would also require workforce security policies and procedures to be reviewed and tested annually. 

Training is only one part of workforce security. Under the proposal, system and facility access would need to be terminated as soon as possible, but no later than one hour after a workforce member’s employment or other arrangement ends. When that person had authorized access to systems maintained by another covered entity or business associate, that organization would generally need to be notified within 24 hours. 

These changes are not final, but organizations can begin preparing by reviewing their training, policies, documentation, and access-removal processes. 

The post HIPAA Workforce Security: What Could Change? appeared first on HIPAA Secure Now!.

Healthcare organizations depend on outside vendors for billing, cloud storage, IT support, legal services, and everyday operations. When a vendor accesses, processes, receives, maintains, or transmits protected health information (PHI) on your behalf, it generally is a business associate under HIPAA. 

That relationship creates responsibilities for both parties—and signing a Business Associate Agreement (BAA) is only the beginning. 

A BAA Is Essential, but It Is Not Vendor Management 

A BAA defines how a business associate may use and disclose PHI, requires appropriate safeguards, and addresses incident reporting and subcontractor responsibilities. However, a signed agreement does not prove that a vendor has effective security controls. 

Healthcare organizations need a repeatable process for managing vendors throughout the relationship: 

1. Identify and classify. Maintain an inventory of vendors, the services they provide, the PHI they handle, and any subcontractors they use. 
2. Evaluate risk. Review safeguards such as access controls, multifactor authentication, encryption, workforce training, incident response, backups, and vulnerability management before access begins. 
3. Set clear expectations. Ensure the BAA and service agreement address responsibilities, notification procedures, data return or destruction, and other requirements appropriate to the risk. 
4. Monitor the relationship. Reassess higher-risk vendors on a defined schedule and whenever services, ownership, access, or subcontractors change. 
5. Offboard securely. Remove accounts and integrations, recover assets, and confirm that PHI is returned or destroyed when required and feasible. 

Business associates must apply the same discipline to subcontractors that handle PHI on their behalf. Each additional party extends the chain of responsibility—and can increase exposure if oversight is weak. 

Effective vendor management is not paperwork for its own sake. It helps your organization know who has access to PHI, understand the risk, respond faster to incidents, and prevent former vendors from retaining unnecessary access or data. 

HIPAA Secure Now helps healthcare organizations assess risk, maintain policies and documentation, train employees, and keep compliance work moving throughout the year. 

Schedule a HIPAA compliance review to identify vendor-management gaps and prioritize your next steps. 

The post Business Associate and Vendor Management: A New Approach is Needed appeared first on HIPAA Secure Now!.

One common misconception about the HIPAA Security Rule is that an “addressable” safeguard is optional. That is not the case. 

Under the current Security Rule, when an implementation specification is designated as addressable, an organization must determine whether that safeguard is reasonable and appropriate for its environment. If it is not, the organization must document why and, when reasonable and appropriate, implement an equivalent alternative measure. 

The proposed HIPAA Security Rule changes could significantly reduce that flexibility. HHS has proposed eliminating the distinction between “required” and “addressable” implementation specifications, making the specifications required with limited exceptions. 

Why Is HHS Proposing This Change? 

During the recent NIST/HHS Safeguarding Health Information: Building Assurance Through HIPAA Security conference, one of the points discussed was that the Security Rule was originally designed with flexibility so organizations could adapt as technology evolved. 

Technology has certainly evolved. Many safeguards that may have once been difficult, costly, or impractical to implement are now considered fundamental security practices. 

Encryption is a good example. 

Years ago, encryption could be expensive or difficult to implement, particularly for a small healthcare organization. Depending on the organization’s circumstances, there may have been other reasonable and appropriate ways to protect electronic protected health information (ePHI). 

Today, encryption is widely available and often built directly into the technology healthcare organizations already use. What may have once required additional technology and resources has increasingly become a baseline safeguard for protecting sensitive information. 

The same evolution is happening across other areas of cybersecurity. As technology becomes more accessible and threats become more sophisticated, expectations for protecting ePHI are changing with them. 

What Does This Mean for Your Organization? 

The proposed HIPAA Security Rule has not been finalized, so the current Security Rule requirements remain in effect. 

However, healthcare organizations do not have to wait for a final rule to start preparing. 

Now is a good time to review the safeguards your organization currently treats as addressable. Understand which safeguards have been implemented, where alternative measures are being used, and whether those decisions still make sense based on today’s technology and cybersecurity risks. 

This review can also help identify areas that may require additional planning, budgeting, or support from your IT team or managed service provider. 

Even if the final rule differs from the current proposal, evaluating these safeguards today can help strengthen the protection of ePHI and put your organization in a better position to adapt as HIPAA requirements evolve. 

Preparing now means having more time to make thoughtful decisions instead of waiting until a compliance deadline is approaching. 

The post What Could the End of “Addressable” HIPAA Safeguards Mean for Healthcare Organizations? appeared first on HIPAA Secure Now!.

Healthcare cyberattacks continue to evolve, and federal regulators are responding with stronger proposed cybersecurity expectations. 

The U.S. Department of Health and Human Services (HHS) has proposed major updates to the HIPAA Security Rule, with July 2027 currently listed as an estimated final-action date on the federal regulatory agenda. That date is not guaranteed and may change, but the proposal gives healthcare organizations a clear signal about where cybersecurity expectations are heading. 

One area receiving greater attention is vulnerability management, including both automated vulnerability scanning and penetration testing. 

Vulnerability Scans vs. Penetration Tests 

While the two are related, they serve different purposes. 

Vulnerability scans use automated tools to identify known technical weaknesses, outdated software, missing patches, and configuration issues across systems and devices. 

Penetration tests go a step further. Qualified security professionals simulate real-world attacks to determine whether identified weaknesses can actually be exploited and how far an attacker could potentially move through the environment. 

Think of a vulnerability scan as finding unlocked doors. A penetration test evaluates what could happen if someone actually tried to walk through them. 

What Could Change Under the Proposed Rule? 

The current HIPAA Security Rule requires organizations to identify risks to electronic protected health information (ePHI) and implement reasonable safeguards, but it does not prescribe a specific vulnerability-scanning or penetration-testing schedule. 

If finalized as proposed, that would change. 

Covered entities and business associates could be required to: 

• Conduct automated vulnerability scans at least once every six months, or more frequently based on their risk analysis 

• Perform penetration testing on relevant electronic information systems at least once every 12 months, or more frequently when warranted 

• Use qualified individuals to perform penetration testing 

• Continuously monitor authoritative sources for newly identified vulnerabilities 

• Address identified vulnerabilities through established patch-management and risk-management processes 

How Healthcare Organizations Can Prepare Now 

Organizations do not need to wait for a final rule to strengthen these practices. 

Start by reviewing which systems contain or interact with ePHI and determining whether they are currently included in regular vulnerability scanning. From there, work with your internal IT team or managed service provider (MSP) to establish testing schedules, assign responsibility for remediation, document findings, and verify that identified weaknesses are actually corrected. 

Penetration testing may also require outside expertise, particularly for smaller organizations without dedicated security personnel. 

The goal is not simply to complete another compliance task. These activities help healthcare organizations understand where weaknesses exist before an attacker finds them. 

Building these processes now can strengthen patient data protection today while making future compliance requirements easier to manage if the proposed rule is finalized. 

The post Beyond the Checkbox: Mastering Vulnerability Scans and Penetration Testing for the 2027 Proposed HIPAA Rules appeared first on HIPAA Secure Now!.

Healthcare organizations rely on an increasingly complex web of EHR platforms, cloud services, medical devices, applications, vendors, and business associates. But when it comes to HIPAA compliance, knowing where electronic protected health information (ePHI) is stored isn’t enough, you also need to understand how it moves. 

A comprehensive network map should document the systems and technology assets that interact with ePHI, while clearly illustrating how that information flows into, through, and out of the organization. This visibility is fundamental to an effective security risk analysis. After all, it is difficult to identify risks to ePHI when you don’t have a complete picture of the systems, connections, and third parties that may affect it. 

This is becoming even more important under HHS’s proposed updates to the HIPAA Security Rule. The proposed rule would explicitly require regulated entities to maintain a technology asset inventory and a network map illustrating the movement of ePHI, updating them at least annually and when environmental or operational changes may affect ePHI. 

For healthcare organizations, that means documenting more than servers and workstations. Cloud-hosted EHRs, backup providers, connected systems, remote environments, and relevant business associates may all need to be considered when mapping the ePHI ecosystem. 

Importantly, these Security Rule changes remain proposed, not final, and the current HIPAA Security Rule remains in effect. But organizations shouldn’t wait for a compliance deadline to gain visibility into their environments. 

A complete network and ePHI data-flow map isn’t just documentation, it’s the foundation for understanding risk and protecting patient information. 

The post Mapping ePHI: Why Network Visibility Is Essential for HIPAA Compliance appeared first on HIPAA Secure Now!.

Another proposed change to the HIPAA Security Rule involves network segmentation. While the term may sound technical, the concept is fairly straightforward. 

What is Network Segmentation? 

It is a security control that divides your network into separate areas. The goal is to limit how far an unauthorized user can go if they gain access to your organization’s systems. If someone gets through one door, you do not want them to suddenly have keys to every room in the building. If an attacker compromises one computer, account, or system, network segmentation can help prevent them from automatically reaching other systems that contain sensitive information, including electronic protected health information (ePHI). 

Where Do You Start? 

Before you can segment your network, you first need to understand where your PHI lives. 

• Is ePHI stored on your servers? 

• Is ePHI being sent or stored in email? 

• Is ePHI contained within your EMR or EHR? Do you have any legacy systems? 

• Is there any medical equipment that contain hard drives with ePHI? 

• Are employees storing PHI on workstations, laptops, smartphones, or shared drives? 

• Are there other applications or cloud systems that contain PHI? 

Once you understand where PHI is located, your IT team or managed service provider (MSP) can determine how those systems should be separated from other parts of your network. 

Why Does This Matter?  

Strong cybersecurity includes limiting the damage when something does happen. Without segmentation, an attacker who gains access to one part of your environment may be able to move through the network and access additional systems. With segmentation, you can create barriers that make that movement more difficult. An unauthorized user gaining access to one system should not automatically mean they have access to everything. Start by identifying where your PHI lives, then work with your IT provider to determine whether appropriate barriers exist between critical systems and the rest of your network. 

The post Network Segementation & The Proposed HIPAA Security Rule appeared first on HIPAA Secure Now!.

Patch management is the process of identifying, prioritizing, acquiring, installing, evaluating, and verifying software and system updates. It helps correct security weaknesses while reducing the risk that an update will disrupt operations or affect electronic protected health information (ePHI). 

How do covered entities and business associates know what needs patching? Common sources include: 

• Vendor notifications and security advisories  

• Automated vulnerability scans  

• Penetration-testing results  

• Government resources, such as CISA’s Known Exploited Vulnerabilities Catalog  

• IT or managed service provider reports  

• Internal risk analyses and system reviews  

The U.S. Department of Health and Human Services (HHS) proposed significant HIPAA Security Rule changes in December 2024. As of today, the proposal has not been finalized. The federal regulatory agenda identifies July 2027 as an estimated final-action date, but that date is not binding and may change. 

If finalized as proposed, covered entities and business associates would need written procedures for identifying, prioritizing, acquiring, installing, evaluating, and verifying patches, updates, and upgrades across relevant electronic information systems. These procedures would need to be reviewed and tested at least annually. 

Critical risks generally would need remediation within 15 calendar days after the need is identified when a patch, update, or upgrade is available. High risks generally would need remediation within 30 calendar days. If remediation is unavailable, the applicable period would begin when it becomes available. Organizations would set and document timelines for other risks. 

Limited exceptions would apply when remediation is unavailable or would adversely affect the confidentiality, integrity, or availability of ePHI. The organization would have to document the exception in real time and implement appropriate compensating controls. 

Organizations should not wait. The HHS Office for Civil Rights has confirmed that the current HIPAA risk-analysis requirement includes risks and vulnerabilities to ePHI from unpatched software. 

The post HIPAA Patch Management: What to Prepare For appeared first on HIPAA Secure Now!.

For healthcare leaders, multi-factor authentication, or MFA, is more than an IT decision. It is a business decision that directly affects patient trust, operational resilience, regulatory risk, and the organization’s reputation. 

Healthcare organizations rely on digital systems for patient records, billing, scheduling, communication, and clinical workflows. When access to those systems is compromised, the impact can extend far beyond a single account. A breach can expose electronic protected health information (ePHI), interrupt patient care, create costly recovery work, and damage the trust an organization has worked hard to build. 

Passwords Alone Are No Longer Enough 

Passwords remain one of the most common entry points for attackers. They can be stolen through phishing emails, exposed in data breaches, reused across multiple accounts, or purchased on the dark web. 

Even a strong password cannot provide complete protection if it falls into the wrong hands. 

MFA adds another layer of verification before access is granted. In addition to entering a password, the user must confirm their identity through another method, such as an authentication application, security key, or unique code. 

That additional step makes it much more difficult for an attacker to enter a system using stolen credentials alone. 

Why MFA Matters in Healthcare 

Healthcare organizations and their business associates manage highly sensitive information across a wide range of systems, users, and locations. Employees may access ePHI from clinical workstations, laptops, mobile devices, cloud platforms, or remote environments. 

A single compromised account could provide an attacker with access to patient data, email, shared files, administrative systems, or connected applications. Privileged accounts, remote access tools, and systems containing ePHI should be especially important priorities when implementing MFA. 

HIPAA Expectations Are Changing 

MFA is also becoming a more urgent HIPAA consideration. 

Under the current HIPAA Security Rule, some access-control safeguards are considered addressable, allowing organizations to evaluate how they apply based on their circumstances. The proposed HIPAA Security Rule updates would establish stronger and more consistent expectations for MFA. 

Although the proposed rule has not been finalized and its requirements may change, the direction is clear: healthcare organizations should prepare for stronger access controls. 

A Practical Step You Can Take Now 

Implementing MFA now can reduce the likelihood of unauthorized access while supporting several broader organizational goals. It can strengthen cyber insurance readiness, support Security Risk Assessment findings, protect remote and privileged accounts, and demonstrate due diligence to patients, partners, and regulators. 

There may be brief adjustments as employees become familiar with a new login process, but that inconvenience is small compared with the disruption that can follow a compromised account. 

The question is no longer whether MFA adds another step. The real question is whether your organization can afford to rely on passwords alone. 

MFA is one of the most practical and effective steps healthcare leaders can take today to reduce risk, protect ePHI, and prepare for where HIPAA expectations are heading. 

The post Why MFA Is Essential for Healthcare Organizations appeared first on HIPAA Secure Now!.

As healthcare organizations prepare for the proposed updates to the HIPAA Security Rule, one area receiving significant attention is encryption. 

While the rule has not yet been finalized and may change before publication, the proposal makes the overall direction clear: encryption is expected to become a foundational safeguard for protecting electronic protected health information (ePHI), rather than an addressable implementation specification. 

For many healthcare organizations, this is an opportunity to evaluate whether their current security practices align with where HIPAA expectations are heading. 

Protecting ePHI at Rest and in Transit 

If the proposed rule is finalized as written, organizations should expect encryption to be applied much more broadly to ePHI at rest, meaning data stored on devices or systems. 

This includes: 

• Laptops, desktops, tablets, and smartphones that store or access ePHI 

• Servers and databases containing ePHI 

• Backup media, including external hard drives and cloud backups 

• Portable storage devices such as USB drives 

The proposal also reinforces the importance of protecting ePHI while it is in transit, or moving between locations or systems. 

Examples include: 

• Encrypted email solutions 

• Secure web connections 

• Virtual Private Networks (VPNs) for remote access 

• Encrypted communications between healthcare applications and cloud services 

These safeguards help reduce the risk of unauthorized access while sensitive patient information is being stored, shared, or transmitted. 

Start Preparing Now 

Healthcare organizations do not need to wait for the final rule before evaluating their encryption posture. 

A practical first step is creating or updating a technology asset inventory to identify every device, application, and system that creates, receives, maintains, or transmits ePHI. From there, organizations can confirm encryption is enabled where appropriate, document current encryption standards, and identify any legacy systems that may not support modern encryption practices. 

Taking these steps now can help reduce future implementation costs while strengthening your organization’s overall cybersecurity posture. 

HIPAA Secure Now Is Here to Help 

Although the final rule may differ from the current proposal, the direction is becoming increasingly clear. Strong encryption is quickly becoming an expected safeguard for protecting patient data. 

HIPAA Secure Now is here to help healthcare organizations understand what may be changing, evaluate their current security posture, and prepare before the compliance clock starts. If you have questions about encryption, asset inventories, or your organization’s HIPAA readiness, our compliance team is ready to help. 

The post Encryption and the Proposed HIPAA Security Rule Changes appeared first on HIPAA Secure Now!.

In January 2021, the U.S. Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) proposing updates to the HIPAA Privacy Rule. The proposal was intended to remove barriers to coordinated care, improve individuals’ access to their health information, reduce unnecessary administrative burden, and strengthen certain patient rights while continuing to protect the privacy of protected health information (PHI).

The proposal has remained under federal review for several years. If a final rule is published, it may adopt some, all, or none of the originally proposed changes. 

When Could This Happen? 

While HHS has not announced an official publication date, the final rule is widely expected to be published as early as August 2026 based on the federal regulatory agenda.

If finalized, organizations will not be expected to comply immediately. Historically, HIPAA rules have become effective 60 days after publication, with compliance required approximately 180 days later. The final rule will establish the official effective and compliance dates. 

What Was Included in the Proposal? 

The proposed rule included several notable changes, including but not limited to: 

Patient Access and Individual Rights 

• Proposing to reduce the time to respond to an individual’s request for access to PHI from 30 calendar days to 15 calendar days  

• Proposing to strengthen an individual’s right to inspect PHI in person, including the ability to take notes and photographs  

• Proposing changes to certain fees for copies of PHI, including additional transparency through website fee schedules, individualized fee estimates, and itemized bills  

• Creating a pathway for individuals to direct electronic PHI maintained in an electronic health record (EHR) to another covered healthcare provider or health plan  

Care Coordination and Permitted Disclosures 

• Expanding and clarifying certain permitted uses and disclosures of PHI to improve care coordination and case management  

• Proposing changes affecting disclosures to social service agencies and community-based organizations involved in an individual’s care  

• Proposing updates to certain standards governing disclosures to family members and caregivers in specific situations  

• Proposing to replace the current “serious and imminent threat” standard with a “serious and reasonably foreseeable threat” standard for certain disclosures made to prevent or lessen a threat to health or safety. 

• Clarifying the application of the minimum necessary standard for certain disclosures and requests for PHI to reduce unnecessary barriers to care while maintaining privacy protections  

Notice of Privacy Practices (NPP) 

• Proposing revisions to the Notice of Privacy Practices (NPP), including eliminating the requirement to obtain a patient’s written acknowledgment of receipt while retaining the requirement to provide the notice  

• Proposing changes to the required content and format of the NPP to better inform individuals of their privacy rights  

Administrative and Operational Changes 

• Clarifying several administrative provisions intended to reduce unnecessary regulatory burden while maintaining privacy protections 

While the proposal covers many topics, its primary focus is improving patient access, supporting care coordination, reducing administrative burden, and updating the Notice of Privacy Practices. These changes remain proposals until a final rule is published.
 

What Could This Mean for Covered Entities and Business Associates and What Should They Do Now? 

Covered entities are expected to be most directly affected by many of the proposed operational changes. Business associates should also review the final rule to determine whether any contractual, operational, or policy updates may be necessary.

Depending on the final rule, organizations may need to evaluate: 

• HIPAA policies and procedures 

• Patient access request workflows 

• Notice of Privacy Practices 

• Workforce training 

• Forms and documentation 

• Business associate agreements and operational processes that support HIPAA compliance 

The final requirements, effective date, and compliance deadlines will not be known until HHS publishes the final rule.

Now is a good time to: 

• Stay informed about the publication of the final rule 

• Begin identifying policies and workflows that could be affected if the proposed changes are adopted 

• Plan time and resources to review and implement any new requirements once the final rule is published 

The post A HIPAA Privacy Rule Update Could Arrive as Early as August 2026. Here’s What Covered Entities and Business Associates Should Know appeared first on HIPAA Secure Now!.