The HIPAA Security Rule overhaul is now a long-term action

What changed

The Department of Health and Human Services' proposed overhaul of the HIPAA Security Rule, RIN 0945-AA22, has moved in the Unified Agenda from Final Rule Stage to Long-Term Actions. Its projected final action is now July 2027. In the Spring 2025 agenda, the same rule sat in Final Rule Stage with a projected final action of May 2026.

The move came in the Fall 2025 edition of the agenda, which was delayed into 2026 and published in the Federal Register as the 2026 Unified Agenda on August 14, 2026.

Primary sources: the Unified Agenda entry for RIN 0945-AA22, and the proposed rule itself, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 90 FR 898, published January 6, 2025, comments closed March 7, 2025.

At the time of writing, the Federal Register lists exactly one document against that RIN: the proposed rule. No final rule has issued.

What it actually requires

Nothing new yet. The Security Rule in force is unchanged, including its distinction between required and addressable implementation specifications.

What the proposal would change, read from the rule text rather than from summaries of it:

• The addressable category disappears. The proposal would "remove the distinction between 'addressable' and 'required' implementation specifications" and require regulated entities to comply with both the standards and the implementation specifications.
• A written technology asset inventory and a network map, under proposed 45 CFR 164.308(a)(1)(i), covering all technology assets that may affect the confidentiality, integrity or availability of ePHI, and describing the movement of ePHI into, through and out of those systems.
• Encryption of all ePHI at rest and in transit, with limited exceptions.
• Multi-factor authentication, with a definition added to the rule.
• Vulnerability scanning and penetration testing, with penetration testing "performed at least once every 12 months".
• Restoration of critical relevant electronic information systems and data within 72 hours of loss, under proposed 45 CFR 164.308(a)(13)(ii)(A), with other systems restored according to a criticality analysis.

What it means for an engineering team

Most of this is already the floor somewhere else. A team that has been through HITRUST or SOC 2 Type II holds most of these controls today. The proposal's effect is to move them from "we chose to" to "we must", which changes the evidence you keep rather than the architecture you build.

The asset inventory and the network map are the two items teams cannot produce on demand. Not because they are hard, but because they are nobody's job. An inventory regenerated from infrastructure state is a different artifact from one maintained by hand, and only the first is still true a year later.

Multi-factor authentication everywhere is where the cost hides. Interactive logins are the easy half. Service accounts, automation identities and break-glass paths are the ones that force a design decision, and they are also the ones that turn up in incident reports.

A 72-hour restoration target is an architecture constraint, not a sentence in a plan. It is a recovery time objective. If nobody has restored from backup end to end and timed it, the number is a hope.

What is still unsettled

Whether the rule survives in this shape. A move to Long-Term Actions is not a withdrawal, but it is not momentum either, and the substance of a rule rarely comes out of a long pause unchanged.

What July 2027 means. The previous edition said May 2026. Projected dates in the Unified Agenda are planning figures, not commitments.

Nothing about the threat environment paused. Enforcement under the current Security Rule continues, and a risk analysis that was inadequate in 2025 is not made adequate by the delay of a rule that would have described it more precisely.

Sources

• HHS Office for Civil Rights. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information. Proposed rule, 90 FR 898, January 6, 2025. Comments closed March 7, 2025.
• Office of Information and Regulatory Affairs. Unified Agenda entry, RIN 0945-AA22. Fall 2025 edition. Retrieved September 11, 2026.
• Regulatory Information Service Center. Introduction to the Unified Agenda of Federal Regulatory and Deregulatory Actions, 2026. 91 FR 52792, August 14, 2026.
• Electronic Code of Federal Regulations. 45 CFR Part 164, Subpart C, Security Standards for the Protection of Electronic Protected Health Information. Current text, retrieved September 11, 2026.