The HIPAA Security Rule Final Rule Has Not Arrived. That Does Not Mean Healthcare Organizations Should Wait
The anticipated HIPAA Security Rule final rule did not arrive on the expected May 2026 timeline. For healthcare organizations, health plans, technology vendors, and business associates, that may feel like breathing room.
It is not.
A missed regulatory target does not reduce the cybersecurity pressure facing the healthcare industry. It does not change the current HIPAA Security Rule. It does not erase OCR’s continued focus on risk analysis, technical safeguards, documentation, and accountability. And it certainly does not make ransomware, phishing, business email compromise, vendor risk, or ePHI exposure any less dangerous.
The better way to view the delay is simple: organizations have been given more time to prepare before expectations become more prescriptive.
That time should be used wisely.
From our perspective, the challenge is rarely whether an organization has written policies or intended security controls. The more difficult question is whether those controls can be demonstrated through objective evidence. Independent assessments routinely reveal a gap between what organizations believe is operating and what they can actually prove. As regulatory expectations evolve, that distinction becomes increasingly important.
Where the HIPAA Security Rule Update Stands
In late 2024, the U.S. Department of Health and Human Services Office for Civil Rights issued a Notice of Proposed Rulemaking to modify the HIPAA Security Rule. The proposed rule was published in the Federal Register in January 2025 and was designed to strengthen cybersecurity protections for electronic protected health information, commonly referred to as ePHI.
The proposal is significant because it would move HIPAA security compliance further away from broad flexibility and closer to more defined cybersecurity expectations.
Among the most significant proposed provisions are requirements or clarifications involving:
- Written documentation for Security Rule policies, procedures, plans, and analyses
- Technology asset inventories and network maps showing how ePHI moves through systems
- More detailed and comprehensive security risk analysis
- Encryption of ePHI at rest and in transit, with limited exceptions
- Multi-factor authentication, with limited exceptions
- Vulnerability scanning at least every six months
- Penetration testing at least every 12 months
- Network segmentation
- Backup and recovery controls
- Annual compliance audits
- Stronger business associate verification and notification requirements
The final rule was expected by many observers in May 2026. That date has now passed without a final rule being issued.
However, the lack of a final rule should not be mistaken for a lack of regulatory direction. OCR has already made its concerns clear: the healthcare sector needs stronger, better documented, and more consistently tested cybersecurity controls.
None of these concepts are entirely new. Many healthcare organizations already have elements of these practices in place. The challenge is consistency. Controls may exist in one part of the environment but not another. Documentation may exist but be incomplete. Testing may occur but not be retained. From an independent assurance perspective, these gaps often become apparent only when organizations attempt to produce evidence supporting their compliance efforts.
The Current Rule Still Matters
One of the biggest mistakes organizations can make right now is assuming that no final rule means no action is needed.
The current HIPAA Security Rule remains in effect. Covered entities and business associates are still required to protect the confidentiality, integrity, and availability of ePHI. They are still expected to conduct accurate and thorough risk analysis. They are still responsible for implementing reasonable and appropriate administrative, physical, and technical safeguards.
Cybersecurity governance is also becoming a board-level issue. Directors, executive leadership, cyber insurers, business partners, and investors increasingly expect organizations to understand their cyber risks, prioritize remediation efforts, and demonstrate that critical safeguards are operating effectively. HIPAA compliance is only one dimension of a broader governance responsibility.
In other words, HIPAA security compliance is not suspended while the final rule is pending.
The proposed rule may eventually change, narrow, expand, or be delayed further. But the underlying message is unlikely to disappear: healthcare organizations must be able to show that security controls are not only written in policies, but actually implemented, operating, monitored, tested, and maintained.
That is where many organizations will feel the pressure.
A policy says what should happen. Evidence proves what did happen.
That distinction is becoming increasingly important. Organizations often discover that documenting policies is significantly easier than demonstrating consistent execution. Producing evidence that access reviews occurred, vulnerabilities were remediated, backups were tested, or incident response exercises were completed requires discipline long before a regulator, customer, or auditor requests it.
OCR, customers, boards, cyber insurers, auditors, and business partners are increasingly interested in the second part.
Why Waiting Creates Risk
It is understandable that some organizations may want to wait until the final language is published before making changes. Budgets are tight. IT teams are stretched. Healthcare operations are complex. Legacy systems are everywhere. No one wants to spend time or money preparing for requirements that may change.
That caution is reasonable.
Complete inaction is not.
Many of the proposed requirements are already considered sound cybersecurity practice. Asset inventories, risk assessments, MFA, encryption, vulnerability management, incident response planning, backup testing, vendor oversight, and control documentation are not exotic concepts. They are foundational security disciplines.
Recent enforcement actions increasingly demonstrate that OCR isn’t simply asking whether a control exists—it wants organizations to demonstrate that the control was implemented, operating as intended, periodically evaluated, and maintained over time.
The issue is that many organizations have gaps between what they believe is in place and what can be proven.
In independent assessments, organizations frequently discover that the issue is not whether a control exists, but whether it operates consistently across the enterprise. Multi-factor authentication may protect most users but exclude privileged accounts. Vulnerability scanning may occur regularly, yet remediation tracking may be inconsistent. Asset inventories may exist but fail to capture cloud services or departmental technology. These are the types of operational gaps that documentation alone does not reveal.
For example:
- Is the asset inventory complete and current?
- Do risk assessments account for all systems that create, receive, maintain, or transmit ePHI?
- Is MFA consistently enforced across relevant systems?
- Are encryption controls documented and validated?
- Are vulnerability scans performed on schedule and tracked through remediation?
- Has the incident response plan been tested?
- Are business associate security obligations verified, or simply assumed?
- Can leadership see where the organization is exposed?
These are not merely compliance questions. They are operational resilience questions.
When a healthcare organization cannot answer them confidently, it is carrying hidden risk.
Cybersecurity Is Now a Governance Issue
Cybersecurity is no longer viewed solely as an IT or compliance function. It has become an enterprise risk management issue that demands active oversight from executive leadership and governing boards. While the HIPAA Security Rule establishes important regulatory expectations, today’s healthcare organizations are also responding to increasing scrutiny from cyber insurers, business partners, customers, accrediting organizations, and investors—all of whom expect leadership to understand cyber risk, allocate appropriate resources, and oversee the effectiveness of the organization’s security program.
This shift changes the conversation from “Are we compliant?” to “Can we demonstrate that our cybersecurity program is operating effectively?” Boards are asking for meaningful reporting on cyber risk rather than technical metrics. Cyber insurers increasingly request evidence of key safeguards during underwriting and renewals. Business partners and healthcare systems often expect independent assurance before entrusting organizations with sensitive information. In each of these situations, organizations are expected to do more than describe their security program—they must be prepared to demonstrate that critical controls are implemented, operating consistently, and supported by reliable evidence. This requires meaningful governance reporting—metrics that help leadership understand organizational risk, remediation progress, and the effectiveness of key safeguards rather than simply reporting technical activity.
Organizations that treat cybersecurity as a governance responsibility rather than a regulatory checklist are generally better positioned to respond to evolving threats, satisfy stakeholder expectations, and adapt to future regulatory changes. Whether the HIPAA Security Rule is finalized tomorrow or months from now, executive leadership should view this period as an opportunity to strengthen governance, validate the effectiveness of existing controls, and build confidence that the organization can demonstrate its cybersecurity readiness when it matters most.
What Healthcare Organizations Should Do Now
The delay creates an opportunity to prepare in a practical, prioritized way. Organizations do not need to boil the ocean, but they should start closing the most obvious gaps.
Rather than attempting to implement every element of the proposed rule immediately, organizations should first understand where their greatest operational risks and evidence gaps exist. A structured readiness assessment often provides a clearer picture than simply comparing policies to regulatory language.
A strong readiness plan should begin with five areas.
1. Refresh the HIPAA Security Risk Assessment
The risk assessment remains the foundation. It should be current, specific, and tied to actual systems, workflows, vendors, and ePHI movement.
A generic assessment that does not reflect the real technology environment will not provide much protection. It may check a box, but it will not guide meaningful risk reduction.
Effective risk assessments do more than identify theoretical risks. They should connect identified risks to implemented safeguards, identify where controls are missing or operating inconsistently, and provide management with a practical roadmap for reducing risk over time.
2. Build or Update the Asset Inventory and ePHI Data Map
Organizations cannot protect what they do not know exists.
A current inventory of systems, applications, devices, databases, cloud environments, third-party platforms, and integrations is essential. Just as important is understanding where ePHI enters, moves, resides, and exits the environment. This is especially important for organizations using cloud platforms, remote work tools, patient engagement systems, billing platforms, AI-enabled tools, analytics applications, or outsourced service providers.
For example, organizations sometimes discover that newer patient engagement platforms, cloud collaboration tools, or AI-powered applications handling ePHI were never incorporated into the formal risk analysis because they were deployed outside the traditional IT governance process.
Organizations should also evaluate whether emerging AI tools have introduced new pathways for creating, processing, storing, or transmitting ePHI that were not contemplated in earlier risk assessments.
3. Validate Core Technical Controls
Healthcare organizations should assess whether key controls are implemented consistently, including encryption, MFA, access controls, logging, vulnerability management, endpoint protection, backup and recovery, and network segmentation.
The word “consistently” matters. Many organizations have strong controls in one part of the environment and weaker controls somewhere else. Attackers do not need the best-defended door. They need the neglected side entrance.
For example, an organization may believe multi-factor authentication has been fully deployed, only to discover that legacy VPN connections, privileged administrative accounts, service accounts, or older clinical systems remain outside the organization’s standard authentication controls.
Performing vulnerability scans is only part of the process. Organizations should also be able to demonstrate that identified vulnerabilities are prioritized, remediated appropriately, and tracked through resolution.
During independent reviews, organizations often discover that controls believed to be enterprise-wide have exceptions that were never documented or formally accepted. Those exceptions may be entirely reasonable, but they should be understood, evaluated, and supported by management decisions rather than discovered during an investigation or incident.
4. Review Business Associate Risk
Business associates and subcontractors remain a major source of exposure. Healthcare organizations should revisit agreements, security requirements, vendor risk reviews, breach notification expectations, and evidence of control performance.
A signed Business Associate Agreement establishes contractual obligations, but it does not confirm that appropriate safeguards are operating. Organizations should understand how higher-risk vendors protect ePHI, manage vulnerabilities, respond to incidents, and oversee their own subcontractors.
That does not mean every vendor needs to be buried under unreasonable questionnaires. It does mean organizations should have a defensible process for evaluating vendor risk and documenting the results.
5. Prepare Evidence Before It Is Needed
The proposed rule’s direction is clear: documentation and proof matter.
Organizations should begin organizing evidence that demonstrates how security controls operate. This may include risk assessments, policies, access reviews, MFA reports, encryption configurations, vulnerability scan results, remediation tracking, incident response testing, backup testing, vendor reviews, training records, and executive reporting.
Waiting until a regulator, customer, auditor, board member, or cyber insurer asks for evidence is a painful way to discover that evidence is scattered, outdated, or incomplete. Evidence that cannot be produced when needed provides little value during an OCR investigation or customer assessment.
Organizations frequently underestimate the effort required to assemble evidence after the fact. Scan reports, access reviews, configuration settings, remediation records, approval documentation, and testing results are often dispersed across multiple teams and systems. Establishing disciplined evidence collection as part of normal operations is significantly more effective than reconstructing it during an OCR investigation, customer assessment, or security incident.
Increasingly, cybersecurity questions are not coming solely from regulators. Health systems are evaluating vendors before sharing sensitive data. Cyber insurers are requesting greater evidence during underwriting and renewal. Boards want meaningful reporting on cyber risk rather than technical jargon. Organizations that can clearly demonstrate the effectiveness of their security program are better positioned across all of these conversations.
For example, an organization may have performed quarterly access reviews exactly as required yet be unable to produce documentation showing who performed the review, what exceptions were identified, or how those exceptions were resolved. The control existed—but the supporting evidence is incomplete.
Readiness Is Bigger Than Compliance
There is an important distinction between compliance and readiness. Compliance focuses on whether required activities have been performed. Readiness focuses on whether an organization can demonstrate those activities through reliable evidence when regulators, customers, cyber insurers, or business partners ask. Increasingly, organizations are being evaluated on both.
HIPAA compliance is important, but the bigger issue is trust.
Patients trust healthcare organizations with deeply personal information. Business partners trust vendors to handle sensitive data responsibly. Boards trust leadership teams to understand cyber risk. Regulators expect organizations to take security seriously before something goes wrong, not after.
The proposed HIPAA Security Rule update is a signal that the bar is rising.
Even though the final rule has not yet arrived, healthcare organizations should act as if stronger expectations are coming because, in practical terms, they already are.
The Bottom Line
The missed May 2026 deadline should not create complacency. It should create urgency with a little more runway.
Organizations that use this time to assess risk, validate safeguards, strengthen documentation, and prepare evidence will be in a better position no matter what the final rule says.
Those that wait may find themselves trying to close years of security and documentation gaps under regulatory, customer, or incident-driven pressure.
That is not a strategy. That is a scramble.
Cybersecurity is no longer viewed solely as an IT responsibility. Executive leadership and governing boards are increasingly expected to understand cyber risk, allocate appropriate resources, and oversee the organization’s security program as part of enterprise risk management.
Cybersecurity readiness is not a one-time project. Technology changes, threats evolve, new vendors are onboarded, and business processes shift. Organizations should view HIPAA readiness as an ongoing governance process rather than a periodic compliance exercise.
Whether the final rule arrives next month or next year, organizations that strengthen governance, validate controls, and build credible evidence today will be better prepared for tomorrow’s regulatory expectations—and better positioned to protect the patients and partners who rely on them.
AARC-360 works with healthcare organizations, business associates, and technology providers to evaluate cybersecurity governance, assess the design and operating effectiveness of security controls, identify evidence gaps, and strengthen overall HIPAA readiness. Our focus is not simply helping organizations understand regulatory expectations but helping them demonstrate that critical safeguards are operating as intended.
