Is the HIPAA Security Rule 2027 update already in effect?

No. As of this writing it is a proposed rule (NPRM) published by HHS OCR in January 2025. It has not been finalized. HHS's regulatory agenda currently targets a final rule around July 2027, after which regulated organizations would have roughly 240 days to comply. The timeline could still shift.

What changes the most compared to the current HIPAA Security Rule?

The proposal eliminates the distinction between "required" and "addressable" safeguards — nearly everything becomes mandatory, with limited exceptions. It also adds specific, auditable requirements like mandatory encryption, mandatory MFA, defined vulnerability-scanning and penetration-testing cadences, and annual written certification from business associates.

Does every question cite an actual HIPAA standard?

Yes. Each of the 35 questions is mapped to the specific HIPAA Security Rule standard (45 CFR §164.308, §164.310, §164.312, §164.314, or §164.316) it relates to, based on HHS’s NPRM fact sheet and legal-analysis summaries of the proposal — shown next to each question and included in the downloadable report.

Free self-assessment

HIPAA Security Rule 2027 Readiness Checklist

This rule is not final yet. HHS's Office for Civil Rights proposed these changes in January 2025. As of this writing, the final rule is targeted for around July 2027 on HHS's own regulatory agenda, with roughly 240 days to comply after that — and the timeline has already slipped once. Nothing here is legal advice; treat this as a directional self-check, not a compliance certification, and confirm current status atHHS.gov. Citations reference the standard each proposal amends — exact subparagraph numbering may shift before the rule is finalized.

35 questions across 14 HIPAA Security Rule categories, each citing the specific standard it maps to. Answer honestly; nothing here is saved or sent anywhere until you choose to download a report.

Security Management Process

45 CFR §164.308(a)(1)

We maintain a written inventory of every technology asset that touches ePHI (device, system, version, owner, location).45 CFR §164.308(a)(1) — Technology asset inventoryWe maintain a network map showing how ePHI moves through our systems, updated at least once a year.45 CFR §164.308(a)(1) — Network mappingOur risk analysis is formally reviewed and updated at least every 12 months.45 CFR §164.308(a)(1) — Risk analysisOur risk analysis includes threat identification, a vulnerability assessment, and a documented risk-rating methodology.45 CFR §164.308(a)(1) — Risk analysis contentWe have a written risk management plan with remediation timelines and named responsible parties for identified risks.45 CFR §164.308(a)(1) — Risk managementWe have a documented sanction policy for workforce members who violate security policies.45 CFR §164.308(a)(1) — Sanction policy

Assigned Security Responsibility

45 CFR §164.308(a)(2)

We have a designated security official formally responsible for HIPAA security compliance.45 CFR §164.308(a)(2) — Assigned responsibility

Workforce & Access Management

45 CFR §164.308(a)(3)–(a)(4)

Access to ePHI is granted on a least-privilege, role-based basis.45 CFR §164.308(a)(4) — Information access managementWe have formal procedures to revoke system access immediately when someone leaves or changes roles.45 CFR §164.308(a)(3) — Workforce securityWe periodically review who has access to ePHI and remove access that's no longer needed.45 CFR §164.308(a)(4) — Information access management

Security Awareness & Training

45 CFR §164.308(a)(5)

All workforce members with ePHI access receive regular security awareness training, including phishing awareness.45 CFR §164.308(a)(5) — Security awareness and training

Security Incident Procedures

45 CFR §164.308(a)(6)

We have a documented, tested security incident response plan.45 CFR §164.308(a)(6) — Security incident proceduresWe have documented, tested procedures to restore critical ePHI systems within 72 hours of a disruption.45 CFR §164.308(a)(6) — Proposed 72-hour restoration requirement

Contingency Planning

45 CFR §164.308(a)(7)

We've formally identified which of our electronic systems are critical to ePHI availability.45 CFR §164.308(a)(7) — Contingency planWe have a tested data backup plan for ePHI.45 CFR §164.308(a)(7) — Data backup planWe have a documented disaster recovery plan covering ePHI systems.45 CFR §164.308(a)(7) — Disaster recovery plan

Evaluation & Compliance Audits

45 CFR §164.308(a)(8)

We test the effectiveness of key security controls at least once every 12 months.45 CFR §164.308(a)(8) — EvaluationWe conduct a compliance audit of our security program at least once every 12 months.45 CFR §164.308(a)(8) — Proposed annual compliance audit

Physical Safeguards

45 CFR §164.310

We have documented physical access controls for facilities and rooms housing ePHI systems.45 CFR §164.310(a) — Facility access controlsWe have documented procedures for the secure disposal and reuse of devices or media that stored ePHI.45 CFR §164.310(d) — Device and media controls

Access Control

45 CFR §164.312(a)

Every user accessing ePHI systems has a unique login — no shared accounts.45 CFR §164.312(a) — Unique user identificationMulti-factor authentication is required for every system that accesses ePHI.45 CFR §164.312(a) — Proposed mandatory multi-factor authenticationSystems accessing ePHI automatically log users off after a period of inactivity.45 CFR §164.312(a) — Automatic logoffOur network is segmented, so a single compromised system cannot reach everything else.45 CFR §164.312(a) — Proposed network segmentation

Audit Controls & Integrity

45 CFR §164.312(b)–(c)

We continuously monitor systems handling ePHI for anomalous activity.45 CFR §164.312(b) — Proposed continuous monitoringAnti-malware protection is deployed across all systems that handle ePHI.45 CFR §164.312(c) — Proposed anti-malware requirement

Encryption

45 CFR §164.312(e) — proposed standalone encryption standard

ePHI is encrypted everywhere it is stored and everywhere it is transmitted, with no exceptions.45 CFR §164.312(e) — Proposed mandatory encryption at rest and in transit

Vulnerability & Patch Management

Proposed new technical safeguard requirement

We run vulnerability scans on our network at least every 6 months.Proposed §164.308 — Vulnerability scanning cadenceWe run a penetration test at least once every 12 months.Proposed §164.308 — Annual penetration testingWe have a documented patch management process with defined timelines, not an ad hoc one.Proposed §164.308 — Patch managementWe have documented configuration standards applied consistently across workstations and systems.Proposed §164.312 — Configuration management

Organizational Requirements & Business Associates

45 CFR §164.314

Our business associate agreements have been reviewed and updated to reflect current security requirements.45 CFR §164.314(a) — Business associate contractsWe obtain written, signed annual certification from every business associate confirming they've implemented required technical safeguards.45 CFR §164.314(a) — Proposed annual written BA certification

Policies, Procedures & Documentation

45 CFR §164.316

Our security policies and procedures are in writing, and are reviewed and tested regularly, not just filed away.45 CFR §164.316(a) — Policies and proceduresWe retain required security documentation (policies, risk analyses, certifications) for the legally required period and can produce it on request.45 CFR §164.316(b) — Documentation retention

Report attribution (optional)

Printed on your downloaded report only. Stays in your browser — never sent or stored anywhere.

Sources

HHS.gov — HIPAA Security Rule NPRM
HHS.gov — NPRM Fact Sheet
Federal Register — Full NPRM text