For the first time in over a decade, HHS has proposed sweeping changes to the HIPAA Security Rule. The "addressable" safeguard designation is proposed for elimination. Documentation requirements would expand significantly across new written policies, procedures, and assessments. And the compliance window — once the final rule drops — will be shorter than most organizations expect.
In January 2025, HHS published the most significant proposed update to the HIPAA Security Rule since 2013. If finalized as proposed, these changes would fundamentally alter how your compliance program operates — and organizations that wait for the final rule to begin preparing will already be behind.
MFA, encryption of ePHI at rest and in transit, and network segmentation are proposed to become required for all regulated entities. The rule retains narrow documented exceptions — for example, when a technology asset does not support MFA or encryption — but those exceptions require implementing compensating controls and thorough documentation. The days of simply noting a safeguard as "not reasonable and appropriate" are over.
The proposed rule would require a technology asset inventory reviewed and updated on an ongoing basis, but at least once every 12 months and whenever there is a change in the environment or operations that may affect ePHI. It would also require a detailed network map of all systems handling ePHI, and written disaster recovery procedures. Critically, those procedures must include a plan to restore critical electronic information systems and data within 72 hours of a disruption.
The proposed rule would require covered entities to obtain annual written verifications from their Business Associates confirming that the required technical safeguards have been deployed. Business Associates would face the same obligation toward their subcontractors. A BA's security gaps — or a subcontractor's — would become your compliance exposure.
The NPRM was published January 6, 2025. Under the proposed rule, the effective date is 60 days after publication of a final rule. All regulated entities — regardless of size or type — then have 180 days from that effective date to comply. That means the total window from publication to the compliance deadline is 240 days for every covered entity and business associate, with no size-based distinction.
The final rule has not yet been issued — but that is not a reason to wait. The organizations that will meet the compliance deadline are the ones that begin their gap assessment before the clock starts.
This is not a sales call. It is a practitioner-led strategy conversation — the kind where you walk away with a clearer framework for thinking about your compliance exposure than you had before you called.
The briefing is led by Melissa Thornton directly — not a junior associate, not a pre-recorded webinar.
Tell me a little about your organization so I can make this conversation as useful as possible for you.
No pressure. No jargon. I will send a short 5-minute intake form after booking so we can use our time well.
You cannot buy compliance out of a box, and a generic gap template won't protect you when the final rule drops. Because the proposed changes eliminate the "addressable" loophole entirely, your remediation strategy depends entirely on your specific infrastructure, tech stack, and vendor ecosystem.
I don't issue blind, cookie-cutter quotes — my advisory process follows a phased evolution to ensure your compliance program is entirely defensible.
A 30-minute executive conversation. We will map out your current operational data-flows, pinpoint your highest-exposure gaps under the new rule, and define your true compliance boundaries. You walk away with a clear diagnostic framework, whether you hire me or not. Secure your spot in the panel
Following our briefing, if you require a formal, audit-ready validation, I construct a customized scope of work tailored precisely to your headcount, EHR architecture, and reliance on third-party SaaS or AI tools.
For high-growth healthcare entities or startups requiring ongoing policy engineering, continuous vendor vetting, and emergency audit readiness as the federal 240-day compliance window closes.
The first step is always the Briefing. Let's find out where your organization actually stands before the official compliance clock starts ticking.
Book Your Free 2026 Strategy Briefing
Book your free 30-minute strategy briefing today. Walk away with a clear framework for where your organization stands — before the final rule drops and the compliance clock starts.
Book My Free 30-Minute BriefingNo pressure. No jargon. I will send a short 5-minute intake form after booking so we can use our time well.