̽»¨´óÉñ

If the proposed changes to the are approved, IT admins and compliance officers will face some of the biggest updates to healthcare cybersecurity in decades. 

These changes and introduce stricter requirements, forcing regulated entities to take a new approach to protecting electronic protected health information (ePHI). The new rules will require advanced technology, increased accountability, and a complete overhaul of current security practices. Here’s what IT teams need to know.

What’s Changing? 

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) has introduced a Notice of Proposed Rulemaking (NPRM). Focus areas include enforcing stronger encryption, concrete risk analyses, and alignment with National Institute of Standards and Technology (NIST) guidelines. Key proposed changes include:

1. Mandatory Encryption: Encryption for ePHI, both in transit and at rest, is now required to ensure sensitive data stays protected from unauthorized access. 
2. Clearer Standards: Addressable standards are being removed. All security standards will now be mandatory, leaving little room for interpretation. 
3. Mandatory Multi-Factor Authentication (MFA): MFA will be required for accessing systems with sensitive data, adding extra protection against stolen credentials. 
4. Expanded Risk Analysis: IT teams must perform ongoing, detailed risk assessments to proactively fix system vulnerabilities. 
5. Regular Vulnerability Scanning: Frequent vulnerability scans and penetration tests will be mandatory to identify and address security risks. 
6. Incident Response Requirements: New regulations outline how organizations must act quickly and effectively after a security incident. 
7. Alignment with NIST Guidelines: Security measures must now follow updated NIST Cybersecurity Framework recommendations. 
8. Stronger Penalties: Organizations with repeated breaches or neglecting HIPAA compliance will face tougher penalties.

The Timeline 

The 2025 HIPAA updates are still being finalized. Stakeholders have until March 7, 2025, to share their feedback during a year-long public comment period. After that, the OCR will review the input and issue a final rule. If there are no delays, enforcement could start by late 2026.

Solutions for IT Teams 

How can IT admins and compliance officers prepare for these major changes? By starting now, before deadlines make compliance mandatory. Here’s a straightforward guide to help you stay ahead as new regulations take shape.

Analyze Your Gaps 

Review your current infrastructure to spot weaknesses in your cybersecurity measures. Focus on areas like encryption, risk assessments, and vulnerability scanning. 

Upgrade Your Encryption 

Make sure all ePHI is encrypted both at rest and in transit. Set up key management systems to secure and monitor encryption keys. 

Deploy Multi-Factor Authentication (MFA) 

Roll out an enterprise-level MFA solution for systems containing ePHI. Simplify the process with end-user training to ensure a smooth transition. 

Layer MFA Everywhere

Safeguard user access to applications, devices, networks, and more

Learn How

Automate Risk Assessments 

Use automation tools to handle risk assessments and stay compliant with evolving regulations. Look for tools that provide continuous vulnerability scans and compliance checks. 

Follow NIST Guidelines 

Incorporate NIST Cybersecurity Framework recommendations into your security strategy. Align operations like identity management and incident response with these guidelines. 

Update Incident Response Plans 

Review and improve your incident response playbooks. Ensure they meet new standards and clearly outline actions to take during a security breach. 

Ensure Vendor Compliance 

Carefully vet your vendors. Make sure any third parties handling ePHI meet the same compliance standards to avoid vulnerabilities. 

Plan Your Budget Now 

Compliance comes with costs. Identify the tools, services, and personnel you’ll need, and start budgeting early to avoid last-minute expenses. 

IT Tools

Download this budget spreadsheet template to ensure you have the best visibility into what you can (and do) spend

Train Your Team 

Effective security starts with your people. Train employees on HIPAA updates and how to handle ePHI securely. Emphasize the risks and penalties for non-compliance. 

Use Unified Solutions 

Work smarter with tools that centralize compliance efforts. Platforms like ̽»¨´óÉñ can help enforce MFA, log events, analyze vulnerabilities, and align with NIST guidelines—all while reducing your administrative workload. 

Preparing now will save time, money, and stress as compliance deadlines approach.

Looking Forward With Confidence 

The proposed changes may be challenging, but they also give IT teams a chance to improve their cybersecurity infrastructure. 

Learn how ̽»¨´óÉñ can help you stay compliant and check out our free compliance quickstart guide with actionable steps for IT teams.