The proposal would move HIPAA from a documentation-and-intent framework to a technical-enforcement framework. Critical safeguards would no longer be “addressable,” meaning organizations could no longer document a reason why they cannot implement them. The question regulators ask would shift from “Did you document why you couldn’t do this?” to “Is it deployed? Can you prove it?” This would apply to encryption, multi-factor authentication, network segmentation, endpoint protection, and annual penetration testing. For a complete overview of the proposed changes, see our HIPAA resource guide.

No. Under the proposal, organization size is no longer a mitigating factor. Every covered entity, whether a solo dental practice, a small clinic, or a large health system, would be held to the same mandatory floor. A dental office would need to meet the same security standards as a hospital system, and documentation without implementation would fail audits regardless of size.

Key proposed mandates include multi-factor authentication (MFA) on systems accessing ePHI, encryption at rest and in transit with no opt-out, an annual risk analysis with written, specific criteria, network segmentation to isolate ePHI systems, anti-malware and endpoint protection on all devices, critical patching within 15 days with documentation, annual workforce training, annual penetration testing, a full asset inventory with ePHI network mapping, and enhanced business associate agreement (BAA) requirements, including written verification of vendors’ safeguards.

Under the current rule, an addressable control is something your organization can evaluate and decide not to implement if you document a valid reason, such as cost, operational burden, or lack of technical feasibility. For example, you could choose not to deploy encryption if you wrote a justification explaining why it wasn’t reasonable for your situation. The proposed update would eliminate this flexibility for critical safeguards: they would be required, period.

HIPAA applies to all covered entities and business associates. This includes dental practices, eyecare centers, chiropractic and physical therapy clinics, orthopedic groups, surgical centers, general and family practices, senior care organizations, disability service providers, in-home care agencies, pediatric practices, behavioral health providers, healthcare clearinghouses, health plans, and any business associate (like an IT provider, billing company, or cloud backup vendor) that handles protected health information (ePHI). If you work with patient health information in any capacity, you are subject to HIPAA.

The maximum fine is $50,000 per violation, with an annual cap per violation category of $1.9 million. Violations can accumulate quickly: a single breach affecting multiple patients, or multiple violations across different security controls, can result in significant penalties. Beyond fines, non-compliance can result in mandatory corrective action plans, loss of patient trust, operational disruption, and potential loss of business.

Good IT security focuses on uptime, functionality, and protecting systems from unauthorized access. HIPAA compliance layers documentation, evidence, auditability, and regulatory proof on top of that. You can have solid IT security and still fail a HIPAA audit if you cannot document your controls, prove they are in place, show who accessed what data and when, demonstrate incident response procedures, or validate third-party safeguards. IT security operates; HIPAA audits proof.

A BAA is a written contract required between your organization and any vendor that handles protected health information (ePHI), such as your IT provider, EMR vendor, billing company, or cloud backup service. It establishes the vendor’s obligation to protect ePHI, specifies what data they can access, defines how they must safeguard it, and includes breach notification provisions. Missing BAAs with vendors who handle ePHI can trigger OCR penalties without any breach occurring.

SIEM stands for Security Information and Event Management. It collects and analyzes logs from your servers, workstations, firewalls, email, and applications in real time, so suspicious activity, unauthorized access attempts, and data exfiltration can be detected before they become breaches. HIPAA already requires audit controls, and the proposed update strengthens logging and monitoring expectations; SIEM is one of the most practical ways to meet them. Without it, an attacker can hide in your network for months undetected.

EDR (Endpoint Detection and Response) and MDR (Managed Detection and Response) go far beyond traditional antivirus. Antivirus detects known malware signatures; EDR/MDR monitors behavior to catch ransomware, fileless attacks, credential theft, lateral movement, and other modern threats. The proposed update calls for anti-malware and endpoint protection across devices that access ePHI, and EDR/MDR is how most practices meet that standard today.

Common risk indicators include outdated firewalls and network equipment, unencrypted hard drives, shared login credentials, missing audit logs, no multi-factor authentication, weak or reused passwords, untested backups, missing Business Associate Agreements, unclear incident response procedures, and no documented risk analysis. If you cannot quickly produce an asset inventory of systems handling ePHI, a recent penetration test, or proof of annual training, you are likely at risk. A professional HIPAA risk assessment can provide clarity.

Not yet. HHS published the proposed rule in January 2025, and as of fall 2026 it has not been finalized; the federal regulatory agenda currently lists final action for July 2027. Under the proposal, organizations would have about 180 days after the rule takes effect to comply. That window would need to cover MFA, encryption, penetration testing, an asset inventory, disaster recovery validation, policy updates, and staff training, so practices that start now will be in a much stronger position. The current Security Rule remains fully in effect in the meantime.

Start with a risk analysis and asset inventory: document all systems that handle ePHI, identify current security gaps, and prioritize the proposed mandatory controls. Review your policies for risk management, incident response, backup and disaster recovery, workforce training, and sanctions. Audit your network for unauthorized access, unencrypted data, and shared logins. Make sure your EMR is properly segmented and logged, verify BAAs with all vendors, and schedule a penetration test. The sooner you begin, the less pressure you’ll face later.

HIPAA already requires an accurate and thorough risk analysis that is kept current. The proposed update would make it explicitly annual, alongside annual penetration testing, annual workforce training, and regular phishing awareness. Beyond these, your compliance posture should be monitored continuously, especially patch management, access controls, and incident logs. Compliance is not a one-time project; it is an ongoing operational responsibility.

OCR enforces HIPAA through audits, breach investigations, and complaints, and it is actively enforcing the current rule today, with risk analysis failures among the most common findings. Non-compliant organizations face fines, mandatory corrective action plans, reputational damage, and loss of business. Once the updated rule is finalized and its compliance window closes, the same enforcement will apply to the new requirements.