Hot Take: Stop Waiting on HIPAA
The Security Rule overhaul keeps slipping. Attackers already check for everything in it.
Executive Summary
· A proposed rewrite of the HIPAA Security Rule would make encryption, multifactor authentication, and other controls explicit requirements. It keeps slipping, and many practices read that as permission to wait.
· That misreads today’s rule. “Addressable” never meant optional, and attackers already test for every item on the proposed list.
· Treat the proposal as a free checklist and start closing the gaps now.
Addressable Never Meant Optional
The current Security Rule sorts its safeguards into “required” and “addressable.” Plenty of owners, and even some IT providers,hear the second word as “nice to have.” It isn’t. Addressable means you assess whether the safeguard is reasonable for your organization. If it is, you implement it. If it isn’t, you write down why and use an equivalent measure where one makes sense. Shrugging is not an option.
Encryption shows what rides on that. It is addressable today, yet a lost laptop that was properly encrypted generally is not a reportable breach. Lose the same laptop unencrypted and you are mailing letters to patients and reporting to regulators. With encryption built into nearly every device, “not reasonable” is a hard case to make. And the one thing that was always required, a current risk analysis, is exactly where regulators have focused enforcement.
The Draft Rule Reads Like a Breach Report
The proposed overhaul asks for encryption, multifactor authentication, a written inventory and map of the systems that handle patient data, restoring critical systems within 72 hours, and more proof that business associates protect what you share. None of it is exotic. It reads like a list of what was missing in breach after breach.
Verizon’s 2026 Data Breach Investigations Report, which examined 1,438 confirmed healthcare breaches, found that exploiting software flaws was the most common way in for that sector (20% of breaches), ahead of phishing and stolen passwords. A third party was involved in 32% of them. Across all industries, organizations fully fixed only 26% of the critical flaws on the federal government’s known-exploited list.
Attackers don’t care which version of the rule is in force. They care whether your billing company is an easy side door. And if you handle billing, IT, legal, or accounting for healthcare Clients, you are likely a business associate and directly responsible for the Security Rule yourself.
What to Do While the Rule Waits
1. Refresh the risk analysis. If yours is over a year old, or nobody can find it, start here.
2. Encrypt every laptop, phone, and backup that holds patient data. Usually that means switching on what the device already has.
3. Require multifactor authentication for email, remote access, and anything that stores patient records.
4. List the systems holding patient data and the vendors that touch it.
5. Test a restore, and ask your business associates for evidence, not reassurances.
The Takeaway
The final rule will land eventually, and the proposal gives organizations months, not years, to comply. Practices that used it as a to-do list will spend that window confirming paperwork, not scrambling.
How Simulint Helps: vCISO Leadership
Simulint’s vCISO practice gives healthcare organizations and their business associates senior security leadership without a full-time hire. We own the risk analysis, measure you against the current and proposed rule, and turn gaps into a prioritized plan. Learn more at https://www.simulint.com/vcio-vciso-vcto-services.
