Understanding the New HIPAA Security Rule NPRM | Key Takeaways and Cybersecurity Enhancements for Healthcare Organizations

Key takeaways

• The proposal was published by the US Department of Health and Human Services in January 2025 and is not final law.
• It matters mainly to US healthcare data handlers, so check relevance to your clients.
• Track the final rule before you change any compliance plan.

Table of Contents

• Introduction
• 1. Annual Technical Inventory and Data Mapping
• 2. Stronger Security Risk Assessments
• 3. Increased Vendor Oversight
• 4. Mandatory Multi-Factor Authentication (MFA)
• 5. Mandatory Encryption for ePHI
• 6. Formalized Incident Response Planning
• 7. Disaster Recovery and Data Backups
• 8. Mandatory Annual Compliance Audits
• 9. Workforce Security and Access Management
• 10. Network Testing, Segmentation, and Configuration
• Conclusion

Introduction

On January 6, 2025, the U.S. Department of Health and Human Services (HHS) introduced new regulations under the Health Insurance Portability and Accountability Act (HIPAA). These regulations aim to strengthen cybersecurity protections for electronic protected health information (ePHI).

This Notice of Proposed Rulemaking (NPRM) is the first major update to the HIPAA Security Rule since 2013. The changes come as a response to the increasing use of electronic medical records and the rising risks of cyberattacks on healthcare data.

Below are the top 10 important changes in the new HIPAA Security Rule NPRM that healthcare organizations must understand and implement.

1. Annual Technical Inventory and Data Mapping

What’s Changing?

• Healthcare organizations must now keep a record of all hardware, software, and data related to ePHI.
• They must also map how ePHI moves through the organization.
• These records must be updated annually or when a major security change happens.

Why is this important?

A clear inventory and data flow will help identify vulnerabilities and reduce security risks.

2. Stronger Security Risk Assessments

What’s Changing?

• Organizations must analyze security risks in greater detail.
• They need to document security measures and evaluate potential threats.
• They must also track risks and vulnerabilities consistently.

Why is this important?

Better risk assessments mean fewer security gaps and stronger protection against cyber threats.

3. Increased Vendor Oversight

What’s Changing?

• Business associates and vendors must now prove they are following HIPAA security rules.
• A cybersecurity expert must verify their security practices.
• Vendors must inform healthcare organizations within 24 hours if they activate a contingency plan due to a security issue.

Why is this important?

Many data breaches happen through third-party vendors. This rule ensures better vendor security.

4. Mandatory Multi-Factor Authentication (MFA)

What’s Changing?

• MFA is now required for all technology handling ePHI.
• Some older systems and FDA-approved medical devices before March 2023 may get exceptions, but only if a transition plan is in place.

Why is this important?

MFA adds extra security by requiring something in addition to a password to access sensitive data.

5. Mandatory Encryption for ePHI

What’s Changing?

• Encryption is now a must for ePHI stored on servers, laptops, mobile devices, and during transmission.
• Only a few exceptions apply, such as patient requests for unencrypted data.

Why is this important?

Encryption makes stolen data useless to hackers, reducing the risk of data breaches.

6. Formalized Incident Response Planning

What’s Changing?

• Organizations must create a written incident response plan that explains:
  • How security incidents should be reported.
  • How threats should be identified and removed.
• These plans must be reviewed and tested every 12 months.

Why is this important?

A clear response plan can help organizations react quickly and reduce damage from cyberattacks.

7. Disaster Recovery and Data Backups

What’s Changing?

• Organizations must create "exact" backup copies of ePHI.
• If a cyberattack happens, they must restore critical systems within 72 hours.
• Vendors must notify covered entities within 24 hours if they activate a contingency plan.

Why is this important?

Having fast recovery systems ensures patient data and healthcare operations are not disrupted for long.

8. Mandatory Annual Compliance Audits

What’s Changing?

• Organizations must conduct annual compliance audits to check if they meet HIPAA security standards.
• HHS does not specify whether these audits should be internal or external.

Why is this important?

Regular audits help identify weaknesses before hackers exploit them.

9. Workforce Security and Access Management

What’s Changing?

• Organizations must set strict rules for workforce access to ePHI:
  • Employees must only access data necessary for their job.
  • Access must be revoked within one hour after an employee leaves.
  • Other healthcare organizations must be notified within 24 hours if an employee had shared access to their data.

Why is this important?

Quickly removing unauthorized access reduces the risk of insider threats.

10. Network Testing, Segmentation, and Configuration

What’s Changing?

• Organizations must conduct vulnerability scans every six months.
• They must perform penetration testing every 12 months.
• They must implement network segmentation to prevent attackers from moving freely inside the network.
• They must remove outdated software that poses security risks.

Why is this important?

Regular testing and network segmentation limit the spread of cyberattacks.

Conclusion

The new HIPAA Security Rule NPRM introduces stricter cybersecurity regulations to protect electronic health records from increasing cyber threats.

These changes require healthcare organizations to strengthen security measures, improve risk assessments, and enforce stricter access controls.

While these new requirements may require time and investment, they are necessary to protect patient data and ensure compliance with evolving cybersecurity threats.

Healthcare organizations must start preparing now by updating their security policies, training employees, and strengthening IT infrastructure.

Related reading

• New HIPAA Security Rule Updates | A Step Forward in Safeguarding ePHI
• Strengthening Compliance with IAM Controls | Key Identity & Access Management Practices for Data Security
• Behavioral Questions in Cyber Security Interviews 2026