HIPAA

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-03-07 Comment period on the proposed Security Rule revision closed
2. 2025-01-06 HHS published the proposed rule to strengthen the Security Rule (90 FR 898)
3. 2013-09-23 Compliance date for the 2013 Omnibus HITECH amendments
4. 2006-04-21 Small health plans must comply with the Security Rule

1. 2025-01-06
   Security Rule NPRM (January 2025) Draft

   HHS proposed a broad revision of the Security Rule to strengthen the cybersecurity of ePHI; comments closed on 7 March 2025. source

   More

   • It would remove the distinction between "required" and "addressable" implementation specifications.
   • It would require a written technology asset inventory and a network map of the systems that affect ePHI.
   • It would require written procedures to restore critical systems and data within 72 hours of a loss.
   • It would require a documented compliance audit at least once every 12 months.
   • It would add a definition of multi-factor authentication (MFA).
2. 2013-06-07
   Security Rule (as corrected June 2013) ErrataCurrent text

   Technical corrections of inadvertent errors and omissions in the Privacy, Security and Enforcement Rules, including 45 CFR 164.314. source

3. 2013-01-25
   Omnibus HITECH final rule Amendment

   Modified the Privacy, Security, Enforcement and Breach Notification Rules to implement the HITECH Act; effective 26 March 2013, compliance required by 23 September 2013. source

4. 2003-02-20
   Security Standards final rule Major version

   First Security Rule for electronic protected health information, effective 21 April 2003. source

   More

   • Covered entities had to comply by 21 April 2005; small health plans by 21 April 2006.

The Security Rule covers electronic protected health information held by covered entities and their business associates.

Who

A covered entity or business associate must comply with the standards and implementation specifications of subpart C for a covered entity's ePHI. source

What it protects

The confidentiality, integrity and availability of all ePHI the entity creates, receives, maintains or transmits. source

Electronic only

The Security Rule applies only to ePHI, that is, health information transmitted by or maintained in electronic media. source

Flexibility

Entities may use any security measures that let them reasonably and appropriately implement the standards; "addressable" specifications must be assessed and either implemented, or the decision documented with an equivalent alternative where reasonable. source

Proposed changes

The January 2025 proposal is not final. The 2026 Unified Agenda lists it as a long-term action with a final action date of July 2027. source

Entities implement and document the safeguards themselves; HHS investigates compliance.

Own measures

Each entity chooses its security measures, taking into account its size, complexity, capabilities, infrastructure, costs and the risks to ePHI. source

Investigations

HHS's Office for Civil Rights investigates Security Rule compliance by covered entities and business associates. source

Proposed audit

The 2025 proposal notes the current rule does not require internal or third-party compliance audits and would require one at least every 12 months. source

HHS may impose civil money penalties in four tiers that depend on the entity's culpability.

Inflation adjustment

The amounts in 45 CFR 160.404 are adjusted for inflation every year and published in 45 CFR part 102. source

1. Law text 45 CFR part 164, subpart C – Security Standards for the Protection of Electronic Protected Health Information
2. Law text 45 CFR 160.404 – Amount of a civil money penalty
3. Law text HIPAA Security Rule To Strengthen the Cybersecurity of ePHI (proposed rule, 6 January 2025)
4. Guidance Unified Agenda entry RIN 0945-AA22 (Security Rule rulemaking)
5. Law text Omnibus HITECH final rule (25 January 2013)

1. NIST SP 800-53

   NIST SP 800-53 is a control catalog for federal systems; the HIPAA Security Rule is a law with its own standards for health information, and lets each entity choose its measures.

2. NIST CSF

   The NIST Cybersecurity Framework is voluntary guidance for any sector; the Security Rule is binding on health plans, clearinghouses, providers and their business associates.

3. FTC Safeguards Rule

   The FTC Safeguards Rule sets security program duties for non-bank financial institutions; the HIPAA Security Rule covers electronic health information.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to HIPAA (RSS)