Major HIPAA Security Rule Changes Are Coming: What Small Healthcare Practices Need to Know
In January 2025, the Department of Health and Human Services (HHS) proposed the first major overhaul of the HIPAA Security Rule since 2013. As of this writing the rule is still proposed, not final, but the direction is clear: HHS wants to close the gaps that have let breaches climb year after year, and it wants to remove the wiggle room that has let some organizations treat security safeguards as optional. If you handle protected health information (PHI), now is the time to get ahead of it, not after the final rule publishes.
Why HHS Is Overhauling the Rule Now
The numbers tell the story. Between 2018 and 2023, the number of reported breaches of unsecured PHI grew by roughly 100 percent, while the number of individuals affected by those breaches grew by an alarming 950 percent. Hacking-related breaches increased about 260 percent over the same period, and ransomware incidents increased roughly 264 percent. In 2023 alone, more than 160 million individuals were affected by large breaches, a new record.
The cost side is just as stark. The average cost of a U.S. healthcare data breach reached $10.93 million in 2023, the highest average cost of any industry tracked, for the 13th year in a row. HHS's own regulatory analysis points to these figures as the justification for tightening the rule.
What Would Actually Change
The proposed rule would reshape several core parts of the Security Rule. The most significant changes include:
- No more "addressable" safeguards. Today, some Security Rule safeguards are labeled "addressable," which has often been misread as optional. The proposal would make nearly all safeguards mandatory, with only narrow, documented exceptions.
- Mandatory multi-factor authentication (MFA) for access to systems that create, receive, maintain, or transmit PHI.
- Mandatory encryption of PHI at rest and in transit, replacing the current "addressable" treatment of encryption.
- Network segmentation to limit how far an intruder can move if one system is compromised.
- Regular vulnerability scanning and periodic penetration testing of systems that touch PHI.
- Written asset inventories and network maps, kept current, so organizations actually know where their PHI lives.
- Defined patch management timelines, with faster remediation required for higher-risk vulnerabilities.
- Annual compliance audits, including a review of the organization's own risk analysis, rather than a one-time or infrequent exercise.
- Faster incident coordination between covered entities and business associates, including reporting when contingency plans are activated.
Taken together, these changes would convert a lot of what has historically been "best practice" guidance into explicit, auditable requirements.
What It Could Cost You to Get This Wrong
HIPAA civil penalties are already significant and are adjusted upward for inflation every year. Under the current tier structure in 45 CFR 160.404, penalties can reach well over $2 million per violation category, per year, for violations due to willful neglect that go uncorrected. Since 2003, HHS's Office for Civil Rights has collected more than $144 million in settlements and civil money penalties from HIPAA enforcement actions, and enforcement activity has generally increased, not decreased, in recent years.
If the proposed rule is finalized as written, the standard timeline would be 60 days from publication until the rule takes effect, followed by a 180-day compliance window, roughly eight months from final publication to the date organizations are expected to be compliant. That is not a lot of time to implement MFA, encryption, network segmentation, and formal audit processes if you are starting from zero.
What to Do Before the Rule Is Final
The good news is that almost everything in the proposal reflects what a reasonable, well-run risk management program should already be doing. You do not need to wait for a final rule to start closing these gaps:
- Confirm MFA is enabled everywhere PHI can be accessed, not just on your email system
- Verify that PHI is encrypted at rest and in transit across every system and vendor that touches it
- Review your network for flat, unsegmented access between systems that handle PHI and everything else
- Get a current, specific risk analysis in place if your last one is outdated, generic, or missing entirely
- Establish a real patch management process with defined timelines instead of ad hoc updates
How Consolidated IT Solutions Can Help
Preparing for this rule change is not a one-time project, and it is not something most small practices can absorb on top of day-to-day operations. Consolidated IT Solutions helps practices like yours get ahead of it with:
- A no-cost initial HIPAA gap assessment measured against the proposed Security Rule requirements, not just the current baseline
- MFA, encryption, and network segmentation implemented across your actual environment
- A documented, prioritized remediation plan scoped to your budget and timeline
- Ongoing managed IT and security services so your compliance posture doesn't lapse the moment the final rule publishes
- Audit-ready documentation for cyber insurers, business partners, or OCR investigators
Schedule your free HIPAA Gap Assessment and find out exactly where your practice stands before the new rule becomes mandatory.