Are you prepared for the possibilities ahead in 2027?
On January 6, 2025, HHS proposed the biggest changes to the HIPAA Security Rule in over a decade. Its regulatory agenda now lists July 2027 as the target for a final rule. This check shows where your practice stands against each proposed change. The changes are proposed, not final, and the current rule still applies today.
The 10 proposed changes this check covers
From the proposed rule in the Federal Register (90 FR 898). Proposed, not final.
- Written asset inventory and network mapEvery device, system and app that holds patient data, and how the data moves.
- A more detailed written risk analysisBuilt on that inventory. A risk analysis is already required today (45 CFR 164.308(a)(1)(ii)(A)).
- Encryption requiredPatient data at rest and in transit, with limited exceptions. Today it is addressable.
- Multi-factor authentication requiredFor access to systems with patient data.
- Vulnerability scans every 6 monthsProposed 45 CFR 164.312(h)(2)(i)(A).
- Penetration test every 12 monthsBy a qualified person. Proposed 45 CFR 164.312(h)(2)(iii).
- 72-hour restorationWritten plans to restore critical systems and data within 72 hours.
- Annual compliance auditA Security Rule compliance audit at least once every 12 months.
- Yearly vendor verificationWritten proof from each business associate that its safeguards are in place.
- Most of "addressable" goes awayNearly every safeguard becomes required, with narrow exceptions.
Are you prepared for the possibilities ahead in 2027?
Answer 10 yes, no or not sure questions, one for each change HHS proposed to the HIPAA Security Rule. No research needed. Your results, with a next step for each item, arrive by email.
Where should we send your results?
Enter your email and your 2027 readiness results will be on the way.
Check your inbox!
Your 2027 readiness results are on the way. Keep an eye out for an email from One Guy Consulting.
Free 30‑minute intro callWant to talk through your results? Book a free 30-minute intro call.
2027 readiness FAQ
Are these changes the law yet?+
No. HHS published them as a proposed rule on January 6, 2025. They are not final and OCR is not enforcing them. The current HIPAA Security Rule still applies today.
When could they take effect?+
HHS's regulatory agenda lists July 2027 as its target for a final rule. That is a planning date, not a deadline, and the final rule may differ from the proposal.
Is this check free?+
Yes. You get a results email with your score and a next step for each item. No sales calls unless you book a free 30-minute intro call yourself.
Are my answers confidential?+
Your answers go to One Guy Consulting's own system, and your results email goes only to the address you provide. We do not share your information.
This content is for educational and informational purposes only and should not be construed as legal advice.