Skip to main content
> HIPAA

Health Insurance Portability and Accountability Act

Protecting patient health information through mandated security safeguards

Governing Body: U.S. Department of Health and Human Services (HHS)
Established: 1996 (Security Rule effective 2005) Last Updated: 2013 (Omnibus Rule) Scope: United States
750,000+
Covered Entities

What does the HIPAA Security Rule require?

The HIPAA Security Rule requires covered entities and their business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. Core requirements include a risk analysis, a designated Security Official, access controls, audit logging, encryption where reasonable, workforce training, and business associate agreements. HIPAA is flexible by design: safeguards scale to the size and complexity of the organization, but the risk analysis and the named Security Official are not optional. The HHS Office for Civil Rights enforces the rule, with penalties reaching over $2 million per violation category per year.

// What is HIPAA?

HIPAA establishes national standards for protecting sensitive patient health information from disclosure without patient consent. The law applies to healthcare providers, health plans, and healthcare clearinghouses, along with their business associates who handle protected health information (PHI).

The Security Rule specifically requires covered entities to implement administrative, physical, and technical safeguards ensuring the confidentiality, integrity, and availability of electronic protected health information (ePHI). Organizations must conduct risk assessments, implement appropriate controls, and maintain documentation demonstrating compliance efforts.

Enforcement has intensified significantly since 2018, with the Office for Civil Rights (OCR) pursuing both large health systems and small practices for violations. The 2013 Omnibus Rule expanded business associate liability and strengthened breach notification requirements.

Proposed Update: Delayed to July 2027

In December 2024 the HHS Office for Civil Rights proposed the first major overhaul of the HIPAA Security Rule since 2003, published in the Federal Register on January 6, 2025. The comment period closed March 7, 2025 with 4,745 comments on the record, and the rule has been slipping ever since. OMB's Unified Agenda now files the rulemaking (RIN 0945-AA22) under Long-Term Actions with final action projected for July 2027, a full year past the May 2026 date it carried through spring 2025. Industry is pushing to kill it outright: on December 8, 2025, a coalition of more than 100 health systems and provider associations led by CHIME, including Cleveland Clinic, Yale New Haven Health System, Advocate Health, the American Medical Association, and the American Academy of Pediatrics, asked HHS to withdraw the proposal. Their argument is that prescriptive technical mandates conflict with how modern healthcare IT is actually built, that the price tag pulls money away from patient care, and that the 240-day compliance runway is unrealistic. Nothing here is settled: the rule is neither finalized nor withdrawn. Read the items below as a map of where HIPAA security is heading. None of it is enforceable today.

  • No more "addressable" safeguards

    The proposal removes the required-versus-addressable distinction. Controls such as encryption of ePHI and multi-factor authentication would become mandatory, though organizations would still choose how to implement them.

  • Encryption and MFA required

    Encryption of ePHI at rest and in transit, and multi-factor authentication for systems that access ePHI, would be required rather than discretionary.

  • Asset inventory and network map

    Covered entities and business associates would maintain a written inventory of technology assets and a map of how ePHI moves through their systems, reviewed at least annually.

  • Regular testing and review

    The proposal adds penetration testing at least once a year, vulnerability scanning at least every six months, and written policies that are reviewed and tested on a set schedule.

  • Providers are asking HHS to withdraw it

    On December 8, 2025, more than 100 health systems and provider associations led by CHIME wrote to HHS asking it to pull the proposal outright and restart with regulated entities at the table on a flexible, risk-based standard. The coalition wants withdrawal, so treat July 2027 as a projection rather than a plan.

  • Cost and timeline are the sticking points

    HHS priced its own proposal at roughly $9 billion in the first year and $6 billion a year for years two through five. A final rule would take effect 60 days after publication with compliance due 180 days later, a 240-day runway that hospital IT leaders say does not fit the multi-year reality of replacing clinical systems.

// Inside HIPAA

The HIPAA Security Rule (45 CFR Part 160 and Part 164, Subparts A and C) establishes the standards most relevant to cybersecurity programs. It's structured around three safeguard categories, each containing required and addressable implementation specifications.

1

Administrative Safeguards

§164.308

The largest section covering policies and procedures governing ePHI protection. These controls address organizational behavior and workforce management.

Risk Analysis & Management

Required assessment of potential risks to ePHI, plus measures to reduce them to reasonable levels. This is where most OCR enforcement actions originate.

Workforce Security

Authorization procedures, clearance processes, and termination protocols ensuring only appropriate personnel access ePHI.

Security Awareness Training

Ongoing education including phishing awareness, password management, and security reminders for all workforce members.

Contingency Planning

Data backup plans, disaster recovery procedures, and emergency mode operations ensuring ePHI availability during crises.

Business Associate Management

Written contracts (BAAs) requiring partners to implement equivalent safeguards when handling PHI.

2

Physical Safeguards

§164.310

Controls protecting the physical infrastructure housing ePHI systems and the hardware itself.

Facility Access Controls

Policies and procedures limiting physical access to electronic information systems and facilities housing them.

Workstation Security

Physical safeguards for workstations accessing ePHI, including positioning and access restrictions.

Device and Media Controls

Procedures governing hardware disposal, media reuse, and movement of devices containing ePHI.

3

Technical Safeguards

§164.312

The technology and policies protecting ePHI and controlling access. These are the controls security teams implement and monitor daily.

Access Controls

Unique user identification, emergency access procedures, automatic logoff, and encryption/decryption mechanisms.

Audit Controls

Hardware, software, and procedural mechanisms recording and examining system activity containing ePHI.

Integrity Controls

Policies and procedures protecting ePHI from improper alteration or destruction.

Transmission Security

Technical measures guarding against unauthorized access to ePHI transmitted over networks.

Note: The Security Rule distinguishes between 'required' specifications (must implement) and 'addressable' specifications (implement if reasonable, or document why an alternative provides equivalent protection). Addressable does not mean optional. Organizations must either implement the specification or document why it's not reasonable and what alternative measures they've adopted.

// Who Must Comply

  • 1 Healthcare providers transmitting health information electronically (hospitals, clinics, physicians, dentists, pharmacies)
  • 2 Health plans (health insurers, HMOs, employer-sponsored plans, government programs like Medicare/Medicaid)
  • 3 Healthcare clearinghouses processing nonstandard health information
  • 4 Business associates handling PHI on behalf of covered entities (IT vendors, billing companies, cloud providers, consultants)
  • 5 Subcontractors of business associates with PHI access

// Key Requirements

Risk Assessment

Conduct accurate and thorough assessments of risks to ePHI confidentiality, integrity, and availability

Access Management

Implement role-based access controls ensuring workforce members only access PHI necessary for their functions

Encryption

Encrypt ePHI at rest and in transit, or document why encryption is not reasonable and implement equivalent measures

Breach Notification

Notify affected individuals within 60 days of breach discovery, plus HHS and media for breaches affecting 500+ individuals

Documentation

Maintain written policies, procedures, and evidence of compliance activities for six years

Training

Provide regular security awareness training to all workforce members with PHI access

// Enforcement & Penalties

OCR enforces HIPAA through investigations and audits, with penalties based on the level of negligence. Willful neglect violations carry the steepest fines, while organizations demonstrating good-faith compliance efforts may receive reduced penalties.

Maximum Penalty

$1.5 million per violation category per year

Examples:

  • Anthem Inc. - $16 million settlement for breach affecting 79 million individuals
  • Premera Blue Cross - $6.85 million for breach affecting 10.4 million
  • Banner Health - $1.25 million for lack of risk analysis and risk management

// Cyber Insurance Impact

Cyber insurers increasingly require documented HIPAA compliance programs before issuing policies to healthcare organizations. Claims involving PHI breaches trigger policy provisions requiring evidence of Security Rule compliance. Inadequate HIPAA programs can result in coverage denials or significantly increased premiums. Many insurers now require annual risk assessments and penetration testing as coverage conditions.

// How Breach Craft Helps

We help organizations achieve HIPAA compliance through genuine security improvements, not checkbox exercises. Our services address the specific requirements and challenges of HIPAA.

Gap Assessment

Measure your security against industry standards.

Learn more

Penetration Testing

Find the gaps before attackers do.

Learn more

Virtual CISO

Executive security leadership on demand.

Learn more

Tabletop Exercises

Practice your incident response.

Learn more

Application Testing

Find what scanners miss.

Learn more

Wireless Security Testing

Secure your wireless infrastructure.

Learn more

// Common Questions

Who must comply with HIPAA?
HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically) and to their business associates (vendors that handle ePHI on their behalf, such as cloud providers, billing companies, and IT firms). Business associates are directly liable for Security Rule compliance and must sign a business associate agreement with each covered entity they serve.

Does HIPAA require penetration testing?
HIPAA does not name penetration testing as an explicit requirement, but the Security Rule requires a risk analysis and periodic evaluation of security controls (45 CFR 164.308(a)(8)). HHS guidance and OCR enforcement treat technical testing, including penetration testing and vulnerability scanning, as a reasonable way to meet the evaluation standard. For most organizations handling significant ePHI, regular testing is the practical path to defensible compliance.

Can a virtual CISO serve as the HIPAA Security Official?
HIPAA requires a single named Security Official responsible for the security program (45 CFR 164.308(a)(2)), but it does not require that person to be an employee. Many covered entities and business associates assign the role to an outside expert while keeping internal accountability. A virtual CISO can serve as or support the Security Official, bringing program leadership that small teams often lack in-house.

When will the updated HIPAA Security Rule take effect?
Not before 2027, and possibly never. The December 2024 Notice of Proposed Rulemaking from the HHS Office for Civil Rights drew 4,745 public comments before the period closed in March 2025, and OMB's Unified Agenda has since moved the rulemaking to Long-Term Actions with final action projected for July 2027, pushed back from a May 2026 target. In December 2025, more than 100 health systems and provider associations led by CHIME asked HHS to withdraw the proposal outright. If a final rule does publish, entities get 60 days to the effective date and another 180 days to comply. Until then, the 2013 Omnibus version of the Security Rule is the one OCR enforces.

What should we do while the HIPAA Security Rule update is delayed?
Build the controls the proposal names, because the rule in force already reaches most of them through the risk analysis standard. An asset inventory and network map, multi-factor authentication, encryption of ePHI at rest and in transit, and annual technical testing are all defensible answers to the risk analysis and evaluation standards at 45 CFR 164.308 today, and cyber insurers ask for them regardless of what OCR finalizes. The slip to 2027 buys room to phase that work across two budget cycles rather than the 240 days a final rule would allow. We run a gap assessment that maps your current safeguards against both the enforceable rule and the proposed one, so you know which gaps are liabilities now and which are bets on 2027.

// Related Frameworks

SOC 2 NIST CSF

// Industries That Need HIPAA

These industries commonly require HIPAA compliance as part of their regulatory obligations.

Healthcare Higher Education

Guide last reviewed: September 1, 2026

Ready to Strengthen Your Defenses?

Schedule a free consultation with our security experts to discuss your organization's needs.

Schedule Consultation Call Us

Or call us directly at (445) 273-2873