Healthcare cyberattacks continue to evolve, and federal regulators are responding with stronger proposed cybersecurity expectations. 

The U.S. Department of Health and Human Services (HHS) has proposed major updates to the HIPAA Security Rule, with July 2027 currently listed as an estimated final-action date on the federal regulatory agenda. That date is not guaranteed and may change, but the proposal gives healthcare organizations a clear signal about where cybersecurity expectations are heading. 

One area receiving greater attention is vulnerability management, including both automated vulnerability scanning and penetration testing. 

Vulnerability Scans vs. Penetration Tests 

While the two are related, they serve different purposes. 

Vulnerability scans use automated tools to identify known technical weaknesses, outdated software, missing patches, and configuration issues across systems and devices. 

Penetration tests go a step further. Qualified security professionals simulate real-world attacks to determine whether identified weaknesses can actually be exploited and how far an attacker could potentially move through the environment. 

Think of a vulnerability scan as finding unlocked doors. A penetration test evaluates what could happen if someone actually tried to walk through them. 

What Could Change Under the Proposed Rule? 

The current HIPAA Security Rule requires organizations to identify risks to electronic protected health information (ePHI) and implement reasonable safeguards, but it does not prescribe a specific vulnerability-scanning or penetration-testing schedule. 

If finalized as proposed, that would change. 

Covered entities and business associates could be required to: 

• Conduct automated vulnerability scans at least once every six months, or more frequently based on their risk analysis 

• Perform penetration testing on relevant electronic information systems at least once every 12 months, or more frequently when warranted 

• Use qualified individuals to perform penetration testing 

• Continuously monitor authoritative sources for newly identified vulnerabilities 

• Address identified vulnerabilities through established patch-management and risk-management processes 

How Healthcare Organizations Can Prepare Now 

Organizations do not need to wait for a final rule to strengthen these practices. 

Start by reviewing which systems contain or interact with ePHI and determining whether they are currently included in regular vulnerability scanning. From there, work with your internal IT team or managed service provider (MSP) to establish testing schedules, assign responsibility for remediation, document findings, and verify that identified weaknesses are actually corrected. 

Penetration testing may also require outside expertise, particularly for smaller organizations without dedicated security personnel. 

The goal is not simply to complete another compliance task. These activities help healthcare organizations understand where weaknesses exist before an attacker finds them. 

Building these processes now can strengthen patient data protection today while making future compliance requirements easier to manage if the proposed rule is finalized. 

The post Beyond the Checkbox: Mastering Vulnerability Scans and Penetration Testing for the 2027 Proposed HIPAA Rules appeared first on HIPAA Secure Now!.

Healthcare organizations rely on an increasingly complex web of EHR platforms, cloud services, medical devices, applications, vendors, and business associates. But when it comes to HIPAA compliance, knowing where electronic protected health information (ePHI) is stored isn’t enough, you also need to understand how it moves. 

A comprehensive network map should document the systems and technology assets that interact with ePHI, while clearly illustrating how that information flows into, through, and out of the organization. This visibility is fundamental to an effective security risk analysis. After all, it is difficult to identify risks to ePHI when you don’t have a complete picture of the systems, connections, and third parties that may affect it. 

This is becoming even more important under HHS’s proposed updates to the HIPAA Security Rule. The proposed rule would explicitly require regulated entities to maintain a technology asset inventory and a network map illustrating the movement of ePHI, updating them at least annually and when environmental or operational changes may affect ePHI. 

For healthcare organizations, that means documenting more than servers and workstations. Cloud-hosted EHRs, backup providers, connected systems, remote environments, and relevant business associates may all need to be considered when mapping the ePHI ecosystem. 

Importantly, these Security Rule changes remain proposed, not final, and the current HIPAA Security Rule remains in effect. But organizations shouldn’t wait for a compliance deadline to gain visibility into their environments. 

A complete network and ePHI data-flow map isn’t just documentation, it’s the foundation for understanding risk and protecting patient information. 

The post Mapping ePHI: Why Network Visibility Is Essential for HIPAA Compliance appeared first on HIPAA Secure Now!.

Another proposed change to the HIPAA Security Rule involves network segmentation. While the term may sound technical, the concept is fairly straightforward. 

What is Network Segmentation? 

It is a security control that divides your network into separate areas. The goal is to limit how far an unauthorized user can go if they gain access to your organization’s systems. If someone gets through one door, you do not want them to suddenly have keys to every room in the building. If an attacker compromises one computer, account, or system, network segmentation can help prevent them from automatically reaching other systems that contain sensitive information, including electronic protected health information (ePHI). 

Where Do You Start? 

Before you can segment your network, you first need to understand where your PHI lives. 

• Is ePHI stored on your servers? 

• Is ePHI being sent or stored in email? 

• Is ePHI contained within your EMR or EHR? Do you have any legacy systems? 

• Is there any medical equipment that contain hard drives with ePHI? 

• Are employees storing PHI on workstations, laptops, smartphones, or shared drives? 

• Are there other applications or cloud systems that contain PHI? 

Once you understand where PHI is located, your IT team or managed service provider (MSP) can determine how those systems should be separated from other parts of your network. 

Why Does This Matter?  

Strong cybersecurity includes limiting the damage when something does happen. Without segmentation, an attacker who gains access to one part of your environment may be able to move through the network and access additional systems. With segmentation, you can create barriers that make that movement more difficult. An unauthorized user gaining access to one system should not automatically mean they have access to everything. Start by identifying where your PHI lives, then work with your IT provider to determine whether appropriate barriers exist between critical systems and the rest of your network. 

The post Network Segementation & The Proposed HIPAA Security Rule appeared first on HIPAA Secure Now!.

Patch management is the process of identifying, prioritizing, acquiring, installing, evaluating, and verifying software and system updates. It helps correct security weaknesses while reducing the risk that an update will disrupt operations or affect electronic protected health information (ePHI). 

How do covered entities and business associates know what needs patching? Common sources include: 

• Vendor notifications and security advisories  

• Automated vulnerability scans  

• Penetration-testing results  

• Government resources, such as CISA’s Known Exploited Vulnerabilities Catalog  

• IT or managed service provider reports  

• Internal risk analyses and system reviews  

The U.S. Department of Health and Human Services (HHS) proposed significant HIPAA Security Rule changes in December 2024. As of today, the proposal has not been finalized. The federal regulatory agenda identifies July 2027 as an estimated final-action date, but that date is not binding and may change. 

If finalized as proposed, covered entities and business associates would need written procedures for identifying, prioritizing, acquiring, installing, evaluating, and verifying patches, updates, and upgrades across relevant electronic information systems. These procedures would need to be reviewed and tested at least annually. 

Critical risks generally would need remediation within 15 calendar days after the need is identified when a patch, update, or upgrade is available. High risks generally would need remediation within 30 calendar days. If remediation is unavailable, the applicable period would begin when it becomes available. Organizations would set and document timelines for other risks. 

Limited exceptions would apply when remediation is unavailable or would adversely affect the confidentiality, integrity, or availability of ePHI. The organization would have to document the exception in real time and implement appropriate compensating controls. 

Organizations should not wait. The HHS Office for Civil Rights has confirmed that the current HIPAA risk-analysis requirement includes risks and vulnerabilities to ePHI from unpatched software. 

The post HIPAA Patch Management: What to Prepare For appeared first on HIPAA Secure Now!.

For healthcare leaders, multi-factor authentication, or MFA, is more than an IT decision. It is a business decision that directly affects patient trust, operational resilience, regulatory risk, and the organization’s reputation. 

Healthcare organizations rely on digital systems for patient records, billing, scheduling, communication, and clinical workflows. When access to those systems is compromised, the impact can extend far beyond a single account. A breach can expose electronic protected health information (ePHI), interrupt patient care, create costly recovery work, and damage the trust an organization has worked hard to build. 

Passwords Alone Are No Longer Enough 

Passwords remain one of the most common entry points for attackers. They can be stolen through phishing emails, exposed in data breaches, reused across multiple accounts, or purchased on the dark web. 

Even a strong password cannot provide complete protection if it falls into the wrong hands. 

MFA adds another layer of verification before access is granted. In addition to entering a password, the user must confirm their identity through another method, such as an authentication application, security key, or unique code. 

That additional step makes it much more difficult for an attacker to enter a system using stolen credentials alone. 

Why MFA Matters in Healthcare 

Healthcare organizations and their business associates manage highly sensitive information across a wide range of systems, users, and locations. Employees may access ePHI from clinical workstations, laptops, mobile devices, cloud platforms, or remote environments. 

A single compromised account could provide an attacker with access to patient data, email, shared files, administrative systems, or connected applications. Privileged accounts, remote access tools, and systems containing ePHI should be especially important priorities when implementing MFA. 

HIPAA Expectations Are Changing 

MFA is also becoming a more urgent HIPAA consideration. 

Under the current HIPAA Security Rule, some access-control safeguards are considered addressable, allowing organizations to evaluate how they apply based on their circumstances. The proposed HIPAA Security Rule updates would establish stronger and more consistent expectations for MFA. 

Although the proposed rule has not been finalized and its requirements may change, the direction is clear: healthcare organizations should prepare for stronger access controls. 

A Practical Step You Can Take Now 

Implementing MFA now can reduce the likelihood of unauthorized access while supporting several broader organizational goals. It can strengthen cyber insurance readiness, support Security Risk Assessment findings, protect remote and privileged accounts, and demonstrate due diligence to patients, partners, and regulators. 

There may be brief adjustments as employees become familiar with a new login process, but that inconvenience is small compared with the disruption that can follow a compromised account. 

The question is no longer whether MFA adds another step. The real question is whether your organization can afford to rely on passwords alone. 

MFA is one of the most practical and effective steps healthcare leaders can take today to reduce risk, protect ePHI, and prepare for where HIPAA expectations are heading. 

The post Why MFA Is Essential for Healthcare Organizations appeared first on HIPAA Secure Now!.

As healthcare organizations prepare for the proposed updates to the HIPAA Security Rule, one area receiving significant attention is encryption. 

While the rule has not yet been finalized and may change before publication, the proposal makes the overall direction clear: encryption is expected to become a foundational safeguard for protecting electronic protected health information (ePHI), rather than an addressable implementation specification. 

For many healthcare organizations, this is an opportunity to evaluate whether their current security practices align with where HIPAA expectations are heading. 

Protecting ePHI at Rest and in Transit 

If the proposed rule is finalized as written, organizations should expect encryption to be applied much more broadly to ePHI at rest, meaning data stored on devices or systems. 

This includes: 

• Laptops, desktops, tablets, and smartphones that store or access ePHI 

• Servers and databases containing ePHI 

• Backup media, including external hard drives and cloud backups 

• Portable storage devices such as USB drives 

The proposal also reinforces the importance of protecting ePHI while it is in transit, or moving between locations or systems. 

Examples include: 

• Encrypted email solutions 

• Secure web connections 

• Virtual Private Networks (VPNs) for remote access 

• Encrypted communications between healthcare applications and cloud services 

These safeguards help reduce the risk of unauthorized access while sensitive patient information is being stored, shared, or transmitted. 

Start Preparing Now 

Healthcare organizations do not need to wait for the final rule before evaluating their encryption posture. 

A practical first step is creating or updating a technology asset inventory to identify every device, application, and system that creates, receives, maintains, or transmits ePHI. From there, organizations can confirm encryption is enabled where appropriate, document current encryption standards, and identify any legacy systems that may not support modern encryption practices. 

Taking these steps now can help reduce future implementation costs while strengthening your organization’s overall cybersecurity posture. 

HIPAA Secure Now Is Here to Help 

Although the final rule may differ from the current proposal, the direction is becoming increasingly clear. Strong encryption is quickly becoming an expected safeguard for protecting patient data. 

HIPAA Secure Now is here to help healthcare organizations understand what may be changing, evaluate their current security posture, and prepare before the compliance clock starts. If you have questions about encryption, asset inventories, or your organization’s HIPAA readiness, our compliance team is ready to help. 

The post Encryption and the Proposed HIPAA Security Rule Changes appeared first on HIPAA Secure Now!.

In January 2021, the U.S. Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) proposing updates to the HIPAA Privacy Rule. The proposal was intended to remove barriers to coordinated care, improve individuals’ access to their health information, reduce unnecessary administrative burden, and strengthen certain patient rights while continuing to protect the privacy of protected health information (PHI).

The proposal has remained under federal review for several years. If a final rule is published, it may adopt some, all, or none of the originally proposed changes. 

When Could This Happen? 

While HHS has not announced an official publication date, the final rule is widely expected to be published as early as August 2026 based on the federal regulatory agenda.

If finalized, organizations will not be expected to comply immediately. Historically, HIPAA rules have become effective 60 days after publication, with compliance required approximately 180 days later. The final rule will establish the official effective and compliance dates. 

What Was Included in the Proposal? 

The proposed rule included several notable changes, including but not limited to: 

Patient Access and Individual Rights 

• Proposing to reduce the time to respond to an individual’s request for access to PHI from 30 calendar days to 15 calendar days  

• Proposing to strengthen an individual’s right to inspect PHI in person, including the ability to take notes and photographs  

• Proposing changes to certain fees for copies of PHI, including additional transparency through website fee schedules, individualized fee estimates, and itemized bills  

• Creating a pathway for individuals to direct electronic PHI maintained in an electronic health record (EHR) to another covered healthcare provider or health plan  

Care Coordination and Permitted Disclosures 

• Expanding and clarifying certain permitted uses and disclosures of PHI to improve care coordination and case management  

• Proposing changes affecting disclosures to social service agencies and community-based organizations involved in an individual’s care  

• Proposing updates to certain standards governing disclosures to family members and caregivers in specific situations  

• Proposing to replace the current “serious and imminent threat” standard with a “serious and reasonably foreseeable threat” standard for certain disclosures made to prevent or lessen a threat to health or safety. 

• Clarifying the application of the minimum necessary standard for certain disclosures and requests for PHI to reduce unnecessary barriers to care while maintaining privacy protections  

Notice of Privacy Practices (NPP) 

• Proposing revisions to the Notice of Privacy Practices (NPP), including eliminating the requirement to obtain a patient’s written acknowledgment of receipt while retaining the requirement to provide the notice  

• Proposing changes to the required content and format of the NPP to better inform individuals of their privacy rights  

Administrative and Operational Changes 

• Clarifying several administrative provisions intended to reduce unnecessary regulatory burden while maintaining privacy protections 

While the proposal covers many topics, its primary focus is improving patient access, supporting care coordination, reducing administrative burden, and updating the Notice of Privacy Practices. These changes remain proposals until a final rule is published.
 

What Could This Mean for Covered Entities and Business Associates and What Should They Do Now? 

Covered entities are expected to be most directly affected by many of the proposed operational changes. Business associates should also review the final rule to determine whether any contractual, operational, or policy updates may be necessary.

Depending on the final rule, organizations may need to evaluate: 

• HIPAA policies and procedures 

• Patient access request workflows 

• Notice of Privacy Practices 

• Workforce training 

• Forms and documentation 

• Business associate agreements and operational processes that support HIPAA compliance 

The final requirements, effective date, and compliance deadlines will not be known until HHS publishes the final rule.

Now is a good time to: 

• Stay informed about the publication of the final rule 

• Begin identifying policies and workflows that could be affected if the proposed changes are adopted 

• Plan time and resources to review and implement any new requirements once the final rule is published 

The post A HIPAA Privacy Rule Update Could Arrive as Early as August 2026. Here’s What Covered Entities and Business Associates Should Know appeared first on HIPAA Secure Now!.

The proposed updates to the HIPAA Security Rule are expected to move forward in 2027, and if the rule is finalized as proposed, healthcare organizations could have as little as 180 days to demonstrate compliance. 

While six months may sound like plenty of time, the reality is different for many healthcare practices. Budget planning often happens only once a year, and significant security improvements can take time to evaluate, purchase, implement, and document. 

That is why now is the right time to start the conversation. 

Budgeting Today Can Prevent Scrambling Tomorrow 

Preparing for the proposed rule does not mean you need to invest in every security solution immediately. Instead, think of this year’s budgeting process as an opportunity to identify potential gaps, prioritize future investments, and create a roadmap that aligns with your organization’s needs. 

Many of the safeguards highlighted in the proposed rule are already considered cybersecurity best practices and can strengthen your organization’s security regardless of when the final rule is published. 

As you build your 2027 budget, consider planning for investments such as: 

• Multi-factor authentication (MFA) 

• Encryption 

• Technology asset inventories 

• Vulnerability scanning and remediation 

• Backup and disaster recovery testing 

• Security Risk Assessments and ongoing risk management 

• HIPAA and cybersecurity awareness training 

• Updated policies and procedures 

• Business associate and vendor risk management 

Work with Your Trusted Advisors 

You do not have to figure out every requirement on your own. 

Now is an excellent time to meet with your IT provider, managed service provider (MSP), or compliance partner to review your current security posture, discuss where improvements may be needed, and estimate future costs. Having those conversations before budgets are finalized gives your organization greater flexibility and helps avoid unexpected expenses later. 

Prepare with Confidence 

Organizations that budget and plan ahead are far less likely to face rushed purchasing decisions, implementation delays, or last-minute compliance challenges if the final rule moves forward. 

More importantly, many of these investments provide immediate value by reducing cybersecurity risk, strengthening the protection of electronic protected health information (ePHI), and improving your overall security posture. 

HIPAA Secure Now is here to help healthcare organizations prepare before the clock starts. By taking practical steps today, you can make the 180-day compliance window far more manageable while building a stronger, more resilient organization for the future. 

The post Preparing Your 2027 Budget for the Proposed HIPAA Security Rule appeared first on HIPAA Secure Now!.

For healthcare executives and practice owners, cybersecurity is no longer just an IT responsibility. It is a business risk, a patient trust issue, and a core part of HIPAA compliance. 

As cyberattacks against healthcare organizations continue to rise, conducting a thorough Security Risk Assessment, or SRA, is one of the most important steps your organization can take to protect electronic protected health information, also known as ePHI. 

Read more: Opportunities for MSPs in Healthcare

More Than a Compliance Requirement 

The HIPAA Security Rule requires covered entities and business associates to regularly evaluate risks to ePHI. But a strong SRA should be more than a compliance exercise. 

It should help your organization understand where sensitive data lives, how it moves, who can access it, and where vulnerabilities may exist across systems, vendors, devices, and workflows. 

Read more: Why Continuous Training Beats One-and-Done Cyber Awareness

Visibility Is the First Step Toward Protection 

Without clear visibility, healthcare organizations may overlook gaps that could lead to unauthorized access, data exposure, operational disruption, or regulatory scrutiny. 

A well-executed SRA gives leaders a practical roadmap. It helps identify weaknesses, prioritize security investments, strengthen policies and procedures, and document the steps your organization is taking to reduce risk. 

For small and mid-sized healthcare practices that may not have a dedicated compliance officer, this kind of guidance can make HIPAA readiness feel more manageable. 

Read More: Proactive Cybersecurity Strategies to Protect Your Business

Proposed Rule Changes Raise the Stakes 

The proposed updates to the HIPAA Security Rule reinforce the importance of moving beyond a “check-the-box” approach. 

If finalized as proposed, the changes could require more detailed documentation, regular reassessments, technology asset inventories, ePHI mapping, and ongoing risk management. 

In other words, risk analysis is not something to complete once and file away. It is an ongoing process that should evolve as your technology, workforce, vendors, and threat landscape change. 

OCR Is Paying Attention 

The U.S. Department of Health and Human Services Office for Civil Rights has also emphasized risk analysis through its enforcement activity. Inadequate or missing SRAs continue to appear in investigations, often leading to penalties and corrective action plans. 

Build Confidence Before Pressure Builds 

A Security Risk Assessment does more than support HIPAA compliance. It helps healthcare leaders make informed decisions, protect patient data, strengthen trust, and build a more resilient organization. 

HIPAA Secure Now is here to help healthcare organizations take that next step with confidence. 

The post The SRA: Your Roadmap to Stronger HIPAA Compliance appeared first on HIPAA Secure Now!.

The proposed HIPAA Security Rule update has not been finalized yet, but small healthcare practices should not wait until the deadline is set to start preparing. 

One practical step your organization can take now is to begin building, reviewing, or updating your asset inventory. 

An asset inventory is a documented list of the systems, devices, software, vendors, and access points that may create, receive, maintain, or transmit electronic protected health information, also known as ePHI. While asset inventories have not historically been listed as a specific HIPAA Security Rule requirement, the proposed updates could make them a much more formal expectation. 

More importantly, an asset inventory is a smart foundation for your overall security and compliance program. 

Why does it matter? 

Because you cannot protect what you do not know exists. If your practice does not have a clear picture of where ePHI lives, how it moves, and who can access it, your risk analysis may miss important gaps. That can make it harder to identify vulnerabilities, update policies, manage vendor risk, and show that your organization is taking reasonable steps to protect patient data. 

A strong asset inventory should include: 

• Hardware, such as computers, laptops, mobile devices, servers, medical devices, and equipment that touches ePHI 

• Software and applications, including EHR/EMR systems, billing platforms, cloud tools, and other SaaS applications 

• Data flows that show where ePHI is stored, transmitted, and accessed 

• Vendors and business associates that interact with your systems or patient data 

• Network components, such as routers, firewalls, remote access tools, and other connection points 

• User access, including who has access to what and at what permission level 

The goal is not perfection on day one. The goal is visibility. 

Starting now gives your practice time to identify what you use, where patient data may be exposed, and which areas may need stronger safeguards. It can also make future compliance work easier if the proposed rule is finalized and organizations have a shorter window to act. 

HIPAA Secure Now is here to help healthcare organizations take practical steps before the clock starts. For more information, or to request a sample Asset Inventory, please reach out to our compliance team. 

The post Don’t Wait for the Final HIPAA Rule: Start with Your Asset Inventory appeared first on HIPAA Secure Now!.