The Security Rule text we reviewed contains no patch deadline and no word patching. It does require risk analysis, risk management that reduces risks to a reasonable and appropriate level, and protection from malicious software as an addressable item. In practice an unpatched, exploitable flaw in a system holding ePHI is hard to defend.
Where patching fits
Risk analysis (required) means an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI. Risk management (required) means implementing security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level. A known vulnerability is a vulnerability. Leaving it unaddressed, with no recorded reasoning, undercuts both items.
Protection from malicious software is listed under security awareness and training as addressable. Addressable means you assess whether it is reasonable and appropriate, then implement it or document why not and use an equivalent measure.
What counts as defensible
| Practice | Defensible when | Weak when |
|---|---|---|
| Fix within a stated window by severity | Window is written and followed | Window exists on paper alone |
| Delay a fix | Compensating control and a date are recorded | No record |
| Accept a risk | Owner signs and revisits it | Nobody owns it |
| Skip a fix for a component that is not reachable | Evidence of non reachability is kept | Assumed without checking |
A prioritisation order
- Known exploited vulnerabilities in internet facing systems that hold or reach ePHI.
- Flaws with a public exploit and a reachable code path.
- Critical and high severity flaws in components that process PHI.
- Everything else, on the normal cycle.
Severity scores alone mislead. Exploitability and reachability change the real urgency.
Try it yourself
Click through it at your own pace, or open it full screen. Sort findings and see how severity, exploit status and fix availability change which item you would handle first.
Document as you go
Write down the finding date, decision, owner and fix date. A short ticket history is far better evidence than a policy that says everything is patched quickly.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is there a number of days to patch under HIPAA?
Not in the rule text we reviewed. Set your own windows based on your risk analysis and keep to them.
Is patching an addressable item?
Protection from malicious software is addressable. Risk analysis and risk management are required, and unpatched known flaws bear on both.
Sources
Last reviewed: 19 October 2026.
