HHS published its proposed update to the HIPAA Security Rule in the Federal Register on 6 January 2025, with comments closing on 7 March 2025. A July 2026 trade report, citing the federal regulatory agenda, says final action is not expected until July 2027. Until a final rule appears, the existing Security Rule is the one enforced.
If you are a startup and a clinic, insurer or health platform has asked you to sign a business associate agreement (BAA), you are probably a business associate. Read the proposal anyway. It shows where the bar is heading, and buyers already ask about it.
What's affected
The proposal does not change who is covered. It changes how specific the requirements are. In the NPRM text, HHS proposes that regulated entities would need to:
- Keep a written technology asset inventory and a network map, reviewed at least every 12 months and when the environment changes.
- Write procedures to restore critical systems and data within 72 hours of a loss.
- Use multi-factor authentication, with documented exceptions for emergencies.
- Obtain written verification from business associates and assess the risk of each business associate arrangement.
The NPRM also states that, once a final rule takes effect, a business associate would have to implement and document the revised safeguards even if its customer's contract has not been amended.
How to check if you're exposed
Write down, for each customer: what data they send you, where it is stored, who can see it, and which of your vendors touch it. If you cannot fill in all four columns in an hour, you do not yet know your exposure. That table is also the seed of the asset inventory the proposal asks for.
What to do now
- Confirm your role. Do you create, receive, maintain or transmit electronic protected health information for a customer? If yes, you are a business associate.
- Sign a BAA only after you know what data you will hold and where.
- Run a risk analysis and keep it dated. This is already required under the current rule.
- Build the asset inventory and network map now. They are cheap early and painful later.
- Turn on MFA for staff and admin access.
- Test a restore. Write down how long it took.
- List your own vendors that touch customer data and get their security documentation.
A note on contracts: a BAA is a contract between you and your customer, and its terms can be stricter than the regulation. Read the breach notification window and the subcontractor clauses before you sign, and keep a copy of every BAA next to the system diagram it relates to.
How to avoid this trap
- Do not store health data in tools you cannot sign a BAA with.
- Do not copy a covered entity's policies. Yours must match what you do.
- Do not wait for the final rule. Customers are already asking for MFA, asset inventories and restore tests.
Try it yourself
Time a restore of one customer's data from backup to a clean environment. Compare the time with the 72 hour figure in the proposal, then write the result and the date in your runbook.
Quick check
Is the proposed HIPAA Security Rule update in force?
No. It is a proposed rule published 6 January 2025. The current rule remains the enforced standard.
What is the first thing to establish when a health customer sends a BAA?
Whether you create, receive, maintain or transmit electronic protected health information for them.
