To safeguard healthcare data, start with an accurate risk analysis. Then implement the controls HHS has proposed and that recent enforcement cases point to: an asset inventory, MFA, encryption, segmentation, tested backups, and vendor verification. This guide is for security leads, IT admins, and compliance owners at providers, health plans, and business associates. The current HIPAA Security Rule remains in force, and the 2024 proposal to tighten it is not final. Following this plan reduces breach exposure and gives a defensible record. It does not guarantee an attack will fail.
How Can Organizations Safeguard Healthcare Data Under Current and Proposed Laws?
The existing Security Rule remains the legal baseline. HHS stated in its proposed changes that the current rule remains in effect during rulemaking. Under that rule, an entity must protect the electronic protected health information (ePHI) it creates, receives, maintains, or transmits against reasonably anticipated threats.
The December 27, 2024 proposal would significantly tighten the rule. It would remove the “addressable” versus “required” split and require written documentation of policies and analyses. It would also mandate encryption at rest and in transit, MFA, network segmentation, vulnerability scans every six months, and annual penetration tests. Restoring systems within 72 hours is also on the list.
Status is the unsettled part. A May 2026 compliance-vendor summary said the rule was still on OCR’s agenda with roughly 4,745 comments under review. A later secondary post said no final rule had been published and listed a target of July 2027. Neither is an HHS statement, so treat the timeline as unconfirmed. Check the HHS page and the Federal Register before telling leadership a date.compliancy-
The practical reading is simple. The proposal previews what auditors will increasingly expect. Teams that build to it now avoid a compressed scramble later. Teams that wait for a final rule are betting on an unconfirmed timeline.
Where do healthcare data breaches actually come from?
Most large breaches come from hacking and IT incidents, and many involve vendors. HIPAA Journal’s 2025 review of OCR portal data found that 61.5% of breaches involved PHI on network servers and 24.9% involved compromised email accounts. Only 4.6% involved unauthorised access to electronic medical records. Business associates accounted for 35.8% of breaches in the same dataset.
Counts shift depending on when the OCR portal was pulled. Breaches are added late, so different HIPAA Journal and BankInfoSecurity snapshots give different totals for 2025. Use the percentages for direction, not as fixed numbers. Scale is easier to pin down. The Change Healthcare ransomware attack disrupted thousands of practices for months and affected about 193 million people
The vendor angle changes where effort goes. A hospital can have strong MFA and still lose data through a billing or collections contractor. One example is a Georgia-based recovery service whose breach was first reported as 501 people, a placeholder, and later grew toward 500,000 as clients filed their own reports. Contract language alone does not cover that exposure. Business associates need to be verified on a schedule.
How should a risk analysis be run so it holds up?
A risk analysis holds up when it starts from a current asset inventory and a map of where ePHI flows. It then scores each threat and vulnerability by likelihood. HHS’s proposal spells this out. The inventory and network map would be updated at least every 12 months and after relevant changes. The written assessment would identify anticipated threats, vulnerabilities, and predisposing conditions, and assign a risk level to each.
This is the control regulators keep citing. OCR’s Risk Analysis Initiative produced 13 completed investigations by April 2026, along with 19 completed ransomware investigations. In one settlement, a CPA firm hit by ransomware paid $175,000 after OCR found it had not conducted an accurate, thorough risk analysis. The pattern is that ransomware triggers the investigation, and a missing risk analysis becomes the violation.
For method, NIST SP 800-66 Rev. 2 is the reference. It gives practical guidance, usable by regulated entities of all sizes, for assessing and managing ePHI risk. Its failure mode is a spreadsheet filled out once and filed. If the inventory omits a cloud storage bucket, an imaging device, or a vendor VPN, the analysis is wrong, and OCR looks for that gap.
Which technical controls matter most?
Prioritize identity, encryption, segmentation, and recoverability, in that order of effort per unit of risk reduced. These four match the proposal’s headline requirements. They also map to the threat patterns above: email compromise, server access, and ransomware.
- MFA everywhere ePHI is reachable. Cover email, VPN, remote admin, EHR, and vendor portals. Email matters most because compromised accounts were involved in about a quarter of breaches. Plan exceptions deliberately, since legacy clinical systems that cannot support MFA are the usual gap. The proposal itself allows only limited exceptions.
- Encryption at rest and in transit. Include backups, laptops, and database volumes. Encryption protects against lost media and some server theft. It does little if an attacker holds a valid logged-in session, so pair it with MFA and session controls.
- Network segmentation. Keep clinical devices, EHR databases, and guest or office networks apart. A flat network turns one phished workstation into a full-environment event.
- Backups kept separate from production. The proposal calls for separate technical controls for backup and recovery, plus written procedures to restore systems within 72 hours. A 72-hour restore target is only real if it has been tested. Untested backups are the usual failure mode.
- Scanning and testing on a cadence. Vulnerability scans every six months, and annual penetration tests are the proposed floor. Teams with internet-facing systems will want to scan more often.
None of these is a one-time purchase. Each needs an owner, a review date, and a log that shows it was checked.
How can vendors and business associates be controlled?
Treat every business associate as part of the attack surface, and ask for evidence, not promises. The proposal would require business associates to verify technical safeguards at least every 12 months. That would require a subject matter expert to provide a written analysis and a written certification that it is accurate. Business associates would also have to notify covered entities within 24 hours of activating a contingency plan.
Nothing stops a covered entity from asking for these items now. Reasonable asks include a current risk analysis summary, MFA and encryption attestations, an incident contact with a 24-hour notice clause, and a list of subcontractors that touch ePHI. The limit is leverage. Small practices often cannot force a large vendor to hand over documents, and a certification is only as good as the person signing it.
Breach clocks run on the covered entity regardless. Breaches affecting 500 or more people must be reported to HHS OCR, individuals, and the media within 60 days of discovery, and ransomware incidents are nearly always treated as reportable PHI breaches. Build the notification workflow before an incident, including who decides that an event is a reportable breach.
Can voluntary frameworks reduce regulatory exposure?
Yes, with limits. The HHS 405(d) program publishes Health Industry Cybersecurity Practices (HICP), which names the five most relevant threats and ten practices to counter them, scaled for small, medium, and large organizations. HICP is voluntary, not a compliance mandate.
Secondary sources say that documenting recognized security practices for at least 12 months before a violation can mitigate fines or shorten an audit. That rests on Public Law 116-321. Treat it as a factor OCR may weigh, not a safe harbor that cancels penalties. Written evidence of what was in place, and since when, is what makes it usable.
Priority Actions
Run or refresh the risk analysis first, because it exposes every other gap and is the control OCR cites most. Next, close MFA and encryption gaps on email and remote access. After that, test a restore against the 72-hour target and tighten vendor evidence requirements.
The trade-off is cost and friction: MFA exceptions, segmentation work, and vendor audits all slow operations and need budget. The payoff is a smaller breach footprint and a documented position if OCR investigates. It will not make an organization breach-proof, and no source reviewed here claims otherwise.