HIPAA Security Rule Delayed to 2027: Why Healthcare Can’t Wait

HHS originally proposed the Security Rule overhaul in December 2024 to strengthen protections for electronic protected health information (ePHI) as cyberattacks and ransomware continued to affect the healthcare sector. The new rule is still under consideration, but HHS has pushed its projected timeline to July 2027 and moved it to its long-term rule-making agenda.

The proposed updated rule would change how organizations protect ePHI, requiring more specific, documented controls and more consistent testing. Several safeguards that were previously classified as “addressable” would become mandatory, and the rule would place greater emphasis on demonstrating effective security measures rather than simply documenting policies.

Among the new requirements for healthcare organizations would be:

• MFA: Enforce mandatory MFA to strengthen identity controls for systems that access ePHI

• Network segmentation: Segment networks to isolate critical systems and limit lateral movement

• 72-hour restoration capability: Show that critical systems and data can be restored within 72 hours after a security incident

• Asset inventory and network visibility: Keep an up-to-date inventory of systems that store, process, or transmit ePHI, as well as accurate network maps showing how data moves

• Audit and compliance evidence: Show that security controls are being enforced and working in practice, not just documented in policies

These provisions aren’t in effect yet, but they signal where federal healthcare cybersecurity requirements may be headed. 

The delay gives organizations time to strengthen their defenses and prepare for potential new requirements while the rule is being finalized.

Healthcare networks were built to be flat so physicians could quickly access information from anywhere in the hospital. But that accessibility also means that the network depends heavily on perimeter defenses to keep threats out.

Perimeter defenses can reduce the risk of an initial compromise, but they can’t eliminate it. A phishing attack, stolen credential, vulnerable internet-facing system, or compromised medical device can provide an initial foothold. Without network segmentation, an attacker can then move laterally toward more critical areas, including systems that house electronic health records (EHRs). 

Healthcare organizations can start preparing now by using microsegmentation to isolate endpoints, limit blast radius, shorten restoration windows, and demonstrate compliance. A structured four-step approach can help teams implement these controls effectively: 

1. Map systems that communicate with ePHI

2. Segment critical systems

3. Plan for containment and recovery

4. Build evidence into security

The HIPAA Security Rule may not be finalized until July 2027, but healthcare organizations don’t have to wait until then to address the risks behind the proposed changes. Since the new rule would mark a transition away from perimeter defenses and an emphasis on proving compliance, preparing also means building a stronger defense against current threats.

Start by assessing your network’s readiness across segmentation, MFA, visibility, containment, restoration capability, and compliance demonstration.

Ready to take action? Use our HIPAA checklist to evaluate your readiness, or watch our on-demand webinar for a deep dive into the technical details.