Modernizing HIPAA: Are You Ready?

Key Challenges in the Proposed HIPAA Security Rule Update Tom Walsh • March 6, 2026

The HIPAA Security Rule may soon undergo its first major overhaul in over two decades. Although finalization could come as early as May 2026, timelines remain uncertain. Regardless, the proposed changes introduce significant new requirements grounded in modern cybersecurity practices and established frameworks.

See Also: Why HSMs Are Critical to Digital Asset Security

In January 2025, the U.S. Department of Health and Human Services' Office for Civil Rights issued a Notice of Proposed Rulemaking to strengthen the HIPAA Security Rule in response to rising cyberthreats and widespread healthcare breaches. If finalized, the update would shift HIPAA from a flexible, risk-based model to a more prescriptive compliance framework.

Key Challenges

• Implementation specifications become required. The distinction between "required" and "addressable" implementation specifications would be eliminated;
• New citations. Control mappings will need updates, as many ...