Last reviewed: October 27, 2026. The current HIPAA Security Rule remains in effect. The changes discussed below are proposed requirements unless specifically identified as part of the current rule. This distinction matters: a medical practice should prepare without presenting a proposal as settled law.
The short answer
The proposed rule would replace much of the Security Rule's flexible approach with more specific requirements. Among other changes, HHS proposes requiring multi-factor authentication in most circumstances, encryption of electronic protected health information at rest and in transit, more detailed technology inventories and network maps, annual compliance audits, vulnerability scanning at least every six months, annual penetration testing, and more prescriptive backup and recovery controls.
Medical practices do not need to wait to reduce obvious risk. Stolen passwords, unavailable systems, untested backups, unknown vendor access, and incomplete documentation already create operational and compliance exposure. The practical goal is to make sensible improvements now, retain evidence of the work, and adjust once HHS publishes a final rule.
Current HIPAA requirements versus the proposed changes
Risk analysis
Current: covered entities and business associates must conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. Proposed: the analysis would become more prescriptive, including a written assessment of specific threats, vulnerabilities, controls, likelihood, and impact.
Multi-factor authentication
Current: the rule requires person or entity authentication, and risk analysis may support stronger authentication. It does not contain a blanket MFA mandate for every system. Proposed: MFA would be required, with limited exceptions.
Backups and recovery
Current: a data backup plan and disaster recovery plan are already required implementation specifications under the contingency-plan standard. Proposed: regulated entities would need separate technical controls for backup and recovery of ePHI and relevant systems, along with clearer testing and restoration expectations.
Encryption
Current: encryption is an addressable implementation specification, which requires a documented assessment and reasonable alternative when not implemented. Proposed: encryption of ePHI at rest and in transit would generally be required, subject to limited exceptions.
Technology visibility
Current: practices must understand and manage risks to ePHI. Proposed: HHS would expressly require a technology asset inventory and network map, reviewed and updated on a defined schedule and after qualifying changes.
Why California medical practices should pay attention
California's public breach-notification records continue to include healthcare providers, health plans, and healthcare vendors. Recent reports have involved medical information, unauthorized account access, third-party incidents, and information sent outside approved systems. The lesson for an independent practice is not that every breach can be prevented. It is that email, vendors, access, backups, and incident response must be managed as one program.
Medical practices in Orange County, Los Angeles, the Inland Empire, and San Diego often depend on many connected organizations: EHR and billing vendors, labs, imaging platforms, phone providers, copiers, cloud applications, and outside support teams. A practice remains responsible for understanding where protected information moves and how access is controlled.
Seven actions a medical practice can take now
- Build an accurate inventory. List systems, devices, cloud services, vendors, locations, important accounts, and the information each one stores or can reach.
- Protect the highest-risk sign-ins first. Start with email, remote access, administrative accounts, billing, EHR access where supported, and any system that can expose many records.
- Confirm what is actually backed up. Do not assume the EHR vendor protects local files, email, scanned documents, images, workstations, or other business systems.
- Test recovery. Restore representative information and document the result. A successful backup job is not the same as a usable recovery.
- Map vendor access. Record who can connect, why access is needed, how it is approved, and how quickly it can be removed.
- Update the risk-management plan. Give each important gap an owner, target date, priority, and documented decision.
- Practice an incident. Run a short tabletop exercise that covers patient schedules, communications, downtime documentation, vendor contacts, insurance notification, and leadership decisions.
What MFA should look like in a medical practice
MFA asks a user for more than a password. It can stop many account takeovers when a password is stolen through phishing, reuse, or a vendor breach. The best method and rollout depend on the system, workforce, emergency-access needs, and patient-care workflow.
Begin where one stolen account could do the most damage. Give special attention to email, administrator access, remote connections, financial systems, cloud storage, and clinical platforms that support MFA. Document exceptions and compensating safeguards instead of leaving unsupported systems invisible. Read our detailed guide to HIPAA and MFA for medical practices.
What a defensible backup program includes
A backup plan should identify the information and systems needed to continue patient care and business operations. It should define how frequently copies are created, how failures are monitored, how copies are protected from ordinary account compromise, who can initiate recovery, and how often restoration is tested.
The practice should also decide how long it can operate without each important system. That decision helps set recovery priorities and reveals whether the current design can meet leadership's expectations. See our guide to HIPAA backup and disaster-recovery requirements.
How managed IT supports HIPAA readiness
A managed IT provider does not make a practice compliant by itself. Compliance also involves leadership, policies, workforce behavior, legal obligations, vendors, facilities, and clinical operations. A capable provider can, however, make the technical program far easier to operate and prove.
Moore IT Services helps medical practices organize support, accounts, devices, networks, backups, vendors, projects, documentation, and improvement plans. We connect technical decisions to downtime, staff time, patient care, and cost, then work with the practice's legal, compliance, insurance, and clinical advisors as needed.
Frequently asked questions
Are the proposed HIPAA Security Rule changes final?
No. HHS states that the current Security Rule remains in effect while rulemaking continues. Practices should monitor HHS for the final rule and compliance dates.
Does HIPAA currently require backups?
Yes. The current contingency-plan standard includes required data backup and disaster recovery implementation specifications. The proposal would add more explicit technical and testing expectations.
Does HIPAA currently require MFA?
HIPAA currently requires authentication and risk-based safeguards, but not a blanket MFA requirement for every system. The proposed rule would generally require MFA with limited exceptions.
Should a small practice wait for the final rule?
Waiting leaves common risks unresolved. Inventory, access control, stronger sign-in protection, backup testing, vendor review, documentation, and incident preparation are valuable under today's rule and useful preparation for future requirements.
See where your practice stands
Use our readiness assessment to identify practical gaps, then schedule a conversation about a prioritized improvement plan for your medical practice.
Authoritative sources
- HHS: HIPAA Security Rule NPRM
- HHS: proposed rule fact sheet
- HHS: current Security Rule summary
- California Department of Justice: data breach notifications
This article provides general educational information and is not legal or compliance advice. Confirm requirements with HHS and qualified counsel.