HIPAA Security Rule Update: Proposal vs Current Duties
The HIPAA Security Rule update is a proposal on HHS’s rulemaking page, rather than a reason to assume every proposed safeguard is already a new legal deadline. Startups and business associates should continue meeting the current rule while assessing the proposed changes against their systems, responsibilities, and documented risk analysis.
Key Takeaways
- •Keep proposed safeguards separate from current legal requirements.
- •Maintain a risk analysis tied to actual electronic health information flows.
- •Document the responsibility split with customers and service providers.
For implementation support, review HIPAA compliance support and business associate agreement definition. Confirm scope and operating responsibilities before choosing an engagement.
Is the proposed Security Rule already the current rule?
HHS explicitly says the current Security Rule remains in effect during the rulemaking. Read a proposed requirement as a proposal until a final rule, its effective date, and any compliance dates establish otherwise.
Before making a deadline commitment, check the current Federal Register docket and the latest HHS guidance. Distinguish the Security Rule from separate privacy, breach notification, or substance-use record requirements; they do not share a single interchangeable timeline.
What would the proposal change for operating teams?
The HHS fact sheet describes proposed changes concerning inventories and network mapping, more specific safeguards, documentation, testing, and contingency planning. These are proposal details, not claims that each provision already applies as written.
| Workstream | Useful readiness question |
|---|---|
| System inventory | Which applications and suppliers handle electronic protected health information? |
| Risk analysis | Does the analysis reflect actual data flows and threats? |
| Access and protection | Which safeguards operate, and what evidence demonstrates them? |
| Continuity | Who tests restoration and coordinates incident response? |
| Third parties | Which responsibilities are addressed in the business associate agreement? |
What should a health-tech startup do now?
Identify whether and how it acts as a business associate or covered entity, apply the current requirements, and maintain the supporting risk analysis and safeguards. The HHS Security Rule summary explains the administrative, physical, and technical safeguard framework.
Use the proposed changes to find operational weaknesses worth addressing now, while documenting which work supports current obligations and which anticipates a possible future rule. A tool purchase or certification label alone does not establish that responsibilities have been met.
How should customers and vendors discuss the proposal?
State the current requirement, the proposed change, and the source checked. Confirm contractual commitments independently: a customer may request controls in a contract even where a proposal has not become a regulation.
For practical implementation, review HIPAA support for startups and the HIPAA service scope. Ask who owns risk analysis, remediation, operating evidence, and incident coordination before signing.
Frequently Asked Questions
Is the proposed rule a new certification program?
Should a startup stop work while waiting for a final rule?
Where should we verify new deadlines?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
