The HIPAA Security Rule NPRM: What's Proposed, and What's Still the Law Today

The HIPAA Security Rule NPRM: What's Proposed, and What's Still the Law Today

Since January 2025 a lot of vendors have been selling against a rule that does not exist yet. If someone has told you that HIPAA now requires encryption, or multi-factor authentication, or annual penetration testing, they are describing a proposal, not the law.

The distinction matters operationally, because you are allocating budget against one of them. Here is where things actually stand, and what a home health or hospice operator should do about it.

Status: Still a Proposed Rule

HHS's Office for Civil Rights published HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information in the Federal Register on January 6, 2025, at 90 FR 898, under RIN 0945-AA22. The comment period closed March 7, 2025, and 4,747 comments were received. As of this writing the Federal Register record for that docket shows no final rule and no withdrawal.

HHS is explicit about the implication. Its NPRM page states: "While the Department is undertaking this rulemaking, the current Security Rule remains in effect."

That sentence is the whole post, really. Everything in the proposal is a signal about enforcement direction. None of it is an obligation.

For scale, the last substantive rewrite of the Security Rule was the HITECH omnibus rule — a final rule published January 25, 2013 at 78 FR 5566, effective March 26, 2013, with a compliance date of September 23, 2013. The rule you are operating under is thirteen years old.

Why OCR Says It's Doing This

The numbers OCR leads with are not subtle. Per HHS's regulatory initiatives page: "From 2018-2023, reports of large breaches increased by 102 percent, and the number of individuals affected by such breaches increased by 1002 percent."

Read those two together. Breach reports roughly doubled. Affected individuals went up by a factor of eleven. That gap is the story: the growth is not mostly in more incidents, it is in incidents that are far larger. Attackers moved from laptops to aggregation points — vendors, clearinghouses, platforms holding data for hundreds of providers at once.

If you are a mid-size agency, this is the thing to internalize. Your own perimeter is not where the tail risk lives. Your vendors' perimeters are.

What Is Required Today vs. What Is Proposed

The current Security Rule works through a design choice that the NPRM would largely dismantle. Under 45 CFR 164.306(b), a covered entity "may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards," weighing its size and complexity, its technical infrastructure, costs, and "the probability and criticality of potential risks to electronic protected health information."

Implementation specifications come in two flavors. For an addressable one, 164.306(d) requires the entity to "assess whether each implementation specification is a reasonable and appropriate safeguard in its environment" and then either implement it, or document why it would not be reasonable and appropriate and "implement an equivalent alternative measure if reasonable and appropriate."

Addressable has never meant optional. It means documented. That is where agencies get into trouble: they skipped the control and also skipped the memo.

Control	Status under current law	Status under the proposal
Encryption of ePHI at rest	Addressable — 164.312(a)(2)(iv), "implement a mechanism to encrypt and decrypt electronic protected health information"	Would be required, with limited exceptions
Encryption in transmission	Addressable — 164.312(e)(2)(ii), encrypt "whenever deemed appropriate"	Would be required, with limited exceptions
Multi-factor authentication	Not specified. 164.312(d) requires procedures to verify identity; it does not name a method	Would be required, with limited exceptions
Risk analysis	Required — 164.308(a)(1)(ii)(A), "an accurate and thorough assessment"	Remains required, with prescriptive content
Asset inventory and network map	Not an express requirement	Would be required, reviewed at least every 12 months
Vulnerability scanning / penetration testing	Not an express requirement	Would be required — scanning every 6 months, testing annually
Revoking workforce access on termination	Required as a standard; no deadline specified	Would carry a 24-hour notification requirement

Other proposed items from the OCR fact sheet: written documentation of all policies and procedures, 72-hour restoration procedures for critical systems, network segmentation, and compliance audits at least every 12 months.

Note what is not in there, in any version. Neither the current Security Rule nor the proposal requires you to record phone calls. HIPAA governs how you protect ePHI you hold; it does not tell you to create a recording you did not otherwise have. Any vendor claiming otherwise is selling, not citing.

Proposed Is Not the Only Thing That Can Happen

Worth keeping in view: rules can also go backwards. The HIPAA Privacy Rule modifications for reproductive health care privacy were finalized — and then, per the same HHS page, "on June 18, 2025, a federal court vacated most provisions." The surviving notice-of-privacy-practices modifications remain in effect, with compliance required by February 16, 2026.

So the landscape has at least four states: proposed, final, final-but-vacated, and final-with-surviving-fragments. Treating a proposal as settled is a budgeting error. Treating a vacated rule as dead in its entirety is a compliance error.

This post is general information about regulatory requirements, not legal advice. Rulemaking status changes, and state privacy and security laws may impose obligations beyond HIPAA; confirm your position with counsel.

Do This Week

The right posture is to do the things that are already required and that the proposal would only make more specific. None of this is wasted if the rule never finalizes.

1. Find your risk analysis and check its date. 164.308(a)(1)(ii)(A) is required today. An "accurate and thorough" assessment that predates your current phone system, your transcription vendor, or your remote intake staff is not accurate or thorough. This is still the single most common finding in OCR enforcement.
2. Write down where your addressable decisions live. For each control you have not implemented — unencrypted call recordings at rest is the classic one — can you produce the assessment and the equivalent alternative measure? If not, you do not have a technology gap, you have a documentation gap, and it is cheaper to fix.
3. List every system that touches a recorded call or transcript. Phone platform, recording storage, transcription or AI vendor, QA tool, CRM, ticketing. The proposal would require this inventory; you need it regardless to answer a breach question. Most agencies discover one or two systems nobody remembered.
4. Pull your BAAs for those systems and check the subcontractor chain. This is where the 1002 percent lives. We covered the mechanics in why your call recording vendor's AI subprocessor is a subcontractor, and the vendor diligence questions in the security questions to ask any healthcare SaaS vendor before signing.
5. Test one termination. Pick a staff member who left in the last 90 days. Time how long it actually took to revoke access to every system on your list. If the answer is more than a day, the proposed 24-hour standard would be a real change for you — and the current rule already expects you to have a process.
6. Check your retention settings against your policy. Not against what you think HIPAA requires — see what actually applies to call recording retention — but against the number your own policy states. Mismatches between policy and configuration are findings waiting to happen.

The Point

The proposal is a reasonable forecast of where OCR's expectations are heading, and the prescriptive controls in it are mostly things a careful operator would do anyway. But today's obligations are the 2013 ones, and they are more demanding than agencies assume — because "addressable" requires a documented decision, and most agencies never made one.

For organizations whose ePHI increasingly lives in call recordings and transcripts, SurfacerIQ operates in the category of healthcare conversation intelligence, where the relevant question is whether that data is inventoried, access-controlled, and retained on purpose rather than by default. The asset inventory in step three is the work either way.

If you want help scoping which of your call-related systems hold ePHI, talk to us.