HIPAA Risk Assessment ToolHIPAA Security Rule update: current status
Checked 1 October 2026. The current Security Rule applies; the January 2025 proposal is not final.
Rule status, checked 1 October 2026: a risk analysis is required today under 45 CFR 164.308(a)(1)(ii)(A). HHS's proposed Security Rule update (January 2025) is not final; the current rule applies. Details and dates.
Timeline
| Date | Event |
|---|---|
| 6 January 2025 | HHS publishes the proposed rule, "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information" (Federal Register, 6 January 2025: HIPAA Security Rule proposed rule (90 FR 898)). |
| 7 March 2025 | Public comment period closes. |
| 1 October 2026 | No final rule. The Security Rule text in the 45 CFR Part 164, Subpart C: the Security Rule (eCFR) is unchanged by the proposal. HHS's Unified Agenda entry for RIN 0945-AA22 shows the timing HHS currently expects. |
What the proposal would change for risk assessments
- A written technology asset inventory and network map, reviewed at least every 12 months.
- More specific contents for the risk analysis, reviewed at least every 12 months.
- Most addressable specifications becoming required, including encryption and multi-factor authentication, with limited exceptions.
Read the proposal itself for the exact wording; details can change before a final rule.
What to do now
Comply with the rule in force: an accurate and thorough risk analysis (45 CFR 164.308: administrative safeguards (a)(1)(ii)(A)) and risk management. Work that the proposal would require, such as an asset inventory, encryption and multi-factor authentication, is good practice under the current rule anyway.
Find your gaps and build a risk register in about 15 minutes: Start the free HIPAA risk assessment
Questions
Is the new HIPAA Security Rule final?
No. HHS proposed it on 6 January 2025 and, as of 1 October 2026, has not published a final rule. The current Security Rule remains in force.
Do I need to follow the proposed HIPAA Security Rule now?
No; the proposal has no legal effect until a final rule is published and takes effect. The current rule's risk analysis and risk management requirements apply today.
Not legal advice. This is a free self-assessment aid, not an audit, a certification or legal advice, and it isn't affiliated with or endorsed by HHS. A quick check is not a full risk analysis: HHS expects an accurate and thorough assessment of the risks to all the ePHI you hold.