The HIPAA Security Rule Overhaul: Preparing for Mandatory Encryption, MFA and Asset Inventory

The proposed HIPAA Security Rule rewrite removes the single word that a generation of healthcare providers has leaned on to defer their hardest security work: ‘addressable’. Take that word out and a set of long-postponed engineering projects become hard obligations at once.

Most commentary on the HHS Office for Civil Rights proposal treats it as a compliance update, something the policy team absorbs and the auditors tick. It is not. Read as an engineer rather than a lawyer, the Notice of Proposed Rulemaking issued on 27 December 2024 and published in the Federal Register on 6 January 2025 describes a multi-year remediation programme for a large share of covered entities and their business associates. The question the board should be asking is not ‘when is the deadline’ but ‘how far is our estate from what this actually requires, and how long would it take to close that gap’.

What the word ‘addressable’ was doing

Since 2003 the Security Rule has split its implementation specifications into two classes. ‘Required’ meant do it. ‘Addressable’ meant assess whether the safeguard is reasonable and appropriate for your environment, and if not, document why and implement an equivalent measure or none at all. Encryption of ePHI, both at rest and in transit, sat in the addressable column. So, in practice, did much of what a modern security team would call baseline hygiene.

Addressable was always meant to be a proportionality mechanism. In the field it became a permission slip. A large number of organisations documented a rationale for not encrypting, not segmenting, not enforcing strong authentication, and moved on. The proposal removes the distinction entirely: all implementation specifications would become required, subject only to a narrow set of enumerated exceptions. The flexibility that many providers built their posture around disappears.

The four controls that stop being optional

Four proposed mandates carry most of the engineering weight. None is exotic. The difficulty is that each one, done properly across a real clinical estate, is a project rather than a policy line.

Encryption of ePHI at rest and in transit. Straightforward on a greenfield system, genuinely hard across legacy clinical applications, imaging archives, medical devices and the interfaces between them. You cannot mandate encryption you have not inventoried, which is why the honest first move is a cryptographic inventory of where ePHI actually lives and how it moves before you commit a remediation budget.

Multi-factor authentication. Easy for the corporate email tier, awkward for shared clinical workstations, on-call access and the long tail of applications that were never built to accept a second factor. The exceptions are narrow, so the awkward cases are the ones that determine the timeline.

Network segmentation. This is the most invasive of the four. Segmenting a flat hospital network to contain lateral movement touches clinical operations, biomedical devices and vendor-managed equipment that cannot simply be re-addressed on a weekend. It is the item most likely to still be in progress two years after a firm decides to start.

A technology asset inventory and a network map. The proposal requires a maintained inventory of technology assets and a network map showing the movement of ePHI through the entity’s systems, reviewed and updated at least once every twelve months. As I have written in a closer look at the inventory and map requirement, this is a data-model problem before it is a documentation exercise: a one-off diagram will not survive the twelve-month refresh, so the inventory has to be sourced from systems that already know what is on the network.

Underneath those four sit the cadence obligations that make them auditable: vulnerability scanning proposed at least every six months, penetration testing at least annually, and compliance audits at least annually. Cadence is where ‘we did it once’ quietly fails.

Why this is a build, not a refresh

The pattern here is familiar to anyone who has worked through the New York financial-services regime. When NYDFS closed out its Part 500 amendments, the duties that caused the most work were precisely the ones this proposal echoes: a defensible asset inventory and enforced MFA, evidenced rather than asserted. The lesson from that final phase going live was that the controls sound routine and the evidencing is not. HIPAA is heading to the same place, across an estate that is typically older and more clinically constrained than a bank’s.

The proposal also sets a compressed clock once a final rule lands. The NPRM contemplates the final rule taking effect 60 days after publication, with a general 180-day compliance period after that, and a further transition window only for bringing business associate agreements into line. Roughly eight months, in other words, to demonstrate controls that segmentation and encryption programmes routinely take two to three years to deliver across a hospital group. Any organisation that waits for the final rule before starting is choosing to attempt a multi-year build inside a two-quarter window.

The delay is not a reprieve

As of mid-2026 the timetable has moved. HHS shifted the rulemaking out of the final-rule stage and into longer-term actions, with the projected finalisation pushed back to 2027, and observers expect the department to finalise the less contentious, highest-impact provisions rather than the entire package. That is real breathing room, and it will be misread. The direction of travel is not in doubt: encryption, MFA, segmentation and a maintained asset inventory are where federal healthcare security is going, with or without every clause of this specific draft. Treating the delay as a reason to stand the programme down simply converts today’s slack into tomorrow’s compressed, expensive catch-up.

The sensible posture is to decouple the engineering from the rulemaking. An organisation that cannot encrypt its ePHI, enforce a second authentication factor, contain lateral movement, or produce a current map of where regulated data flows has a security problem the rule merely names. Fixing that is worth doing whether the final rule arrives in 2027 or slips again.

Where to start before the rule is final

The first move is not a gap assessment against the draft text. It is an honest inventory: where ePHI is stored and transmitted, what is encrypted today, which systems can and cannot take MFA, and how flat the network really is. That inventory tells you the size of the build, and the build is what determines whether the eventual compliance clock is survivable.

The firms that will struggle are the ones that spent two decades treating ‘addressable’ as ‘optional’ and are now one final rule away from having to prove they did the work. The word is being removed. The deferral it enabled is being removed with it.