The Flexibility You Relied On
Is About to Be Gone.
For the first time in over a decade, HHS has proposed sweeping changes to the HIPAA Security Rule. The "addressable" safeguard designation is proposed for elimination. Documentation requirements would expand significantly across new written policies, procedures, and assessments. And the compliance window — once the final rule drops — will be shorter than most organizations expect.
Three Proposed Changes That Would Affect Every Covered Entity and Business Associate
In January 2025, HHS published the most significant proposed update to the HIPAA Security Rule since 2013. If finalized as proposed, these changes would fundamentally alter how your compliance program operates — and organizations that wait for the final rule to begin preparing will already be behind.
Required Technical Controls
MFA, encryption of ePHI at rest and in transit, and network segmentation are proposed to become required for all regulated entities. The rule retains narrow documented exceptions — for example, when a technology asset does not support MFA or encryption — but those exceptions require implementing compensating controls and thorough documentation. The days of simply noting a safeguard as "not reasonable and appropriate" are over.
Expanded Documentation Requirements
The proposed rule would require a technology asset inventory reviewed and updated on an ongoing basis, but at least once every 12 months and whenever there is a change in the environment or operations that may affect ePHI. It would also require a detailed network map of all systems handling ePHI, and written disaster recovery procedures. Critically, those procedures must include a plan to restore critical electronic information systems and data within 72 hours of a disruption.
Vendor Accountability
The proposed rule would require covered entities to obtain annual written verifications from their Business Associates confirming that the required technical safeguards have been deployed. Business Associates would face the same obligation toward their subcontractors. A BA's security gaps — or a subcontractor's — would become your compliance exposure.
When the Final Rule Drops, the Clock Starts Immediately
The NPRM was published January 6, 2025. Under the proposed rule, the effective date is 60 days after publication of a final rule. All regulated entities — regardless of size or type — then have 180 days from that effective date to comply. That means the total window from publication to the compliance deadline is 240 days for every covered entity and business associate, with no size-based distinction.
The final rule has not yet been issued — but that is not a reason to wait. The organizations that will meet the compliance deadline are the ones that begin their gap assessment before the clock starts.
A 30-Minute Conversation That Tells You Where You Actually Stand
This is not a sales call. It is a practitioner-led strategy conversation — the kind where you walk away with a clearer framework for thinking about your compliance exposure than you had before you called.
- 5 minutes: Your context — org type, size, current posture, and what is driving the call right now.
- 15 minutes: A walk through the three proposed rule changes and where organizations in your segment are typically exposed.
- 5 minutes: Two or three specific observations based on your intake — a framework for thinking about your gaps, not a gap analysis.
- 5 minutes: If it makes sense, a description of the paid gap assessment and whether it is the right next step for your organization.
The briefing is led by Melissa Thornton directly — not a junior associate, not a pre-recorded webinar.
Book Your 2026 HIPAA Strategy Briefing
Tell me a little about your organization so I can make this conversation as useful as possible for you.
No pressure. No jargon. I will send a short 5-minute intake form after booking so we can use our time well.
The Full Gap Assessment: Fixed Scope. Fixed Fee. Fixed Timeline.
If the free briefing confirms you have meaningful exposure — and most organizations do — the next step is a structured gap assessment that gives you a written, defensible record of where you stand and a prioritized plan to get compliant before the enforcement deadline.
What Is Included
- 60–90 minute stakeholder interview with your leadership and technical team
- Focused document review: current policies, technical control inventory, BAA list, and prior risk assessments
- 15–25 page written report mapped section by section to the proposed mandatory technical controls and documentation requirements
- Prioritized remediation roadmap with 30/60/90-day milestones
- 60-minute readout call with leadership to walk through findings and answer questions
Optional Add-Ons
- Stakeholder interview (60–90 min)
- Focused document review
- 15–25 page written report
- Prioritized 30/60/90-day roadmap
- Leadership readout call (60 min)
The Organizations That Are Ready
Started Before the Clock.
Book your free 30-minute strategy briefing today. Walk away with a clear framework for where your organization stands — before the final rule drops and the compliance clock starts.
Book My Free 30-Minute BriefingNo pressure. No jargon. I will send a short 5-minute intake form after booking so we can use our time well.