The HIPAA Security Rule changes HHS proposed in January 2025 would make encryption of electronic protected health information (ePHI, meaning patient health data a practice stores or sends electronically) required at rest and in transit, with limited exceptions, but the proposal is not final. Until it is, practices follow the current Security Rule, the federal safeguards for ePHI, in which encryption is addressable (the practice must assess it, then adopt it, adopt an equivalent, or document why neither is reasonable) and audit controls are required.
What HIPAA Security Rule changes has HHS proposed?
HHS’s Office for Civil Rights published a notice of proposed rulemaking on January 6, 2025, titled “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information” (90 FR 898, RIN 0945-AA22). It proposes to remove the distinction between required and addressable specifications and to require encryption, multi-factor authentication (MFA, meaning sign-in that requires two or more proofs of identity, such as a password plus a trusted device) and other specific controls.
The HHS fact sheet on the proposed rule lists the main proposals, including to:
- “Remove the distinction between ‘required’ and ‘addressable’ implementation specifications and make all implementation specifications required with specific, limited exceptions.”
- “Require encryption of ePHI at rest and in transit, with limited exceptions.”
- “Require the use of multi-factor authentication, with limited exceptions.”
- Require a technology asset inventory and a network map, revised at least once every 12 months.
- Require a compliance audit at least once every 12 months.
- Require business associates to verify at least once every 12 months, through a written analysis and a written certification, that they have deployed the required technical safeguards.
- Require notice within 24 hours when a workforce member’s access to ePHI is changed or terminated.
- Establish written procedures to restore certain systems and data within 72 hours.
- Require vulnerability scanning at least every six months and penetration testing at least once every 12 months.
The public comment period on the Federal Register notice closed March 7, 2025.
Is the proposed HIPAA Security Rule update final?
No. As of November 2026, HHS has not published a final rule; the January 2025 Federal Register notice remains the proposal. The latest Unified Agenda lists the rule under long-term actions, with final action targeted for July 2027.
Agenda dates are targets and do not bind HHS. The Spring 2025 Unified Agenda had placed the rule at the final rule stage with a nearer target, and the later move to long-term actions means a practice should not plan around a specific effective date.
How would the HIPAA Security Rule changes affect email encryption?
Today, encryption of stored and transmitted ePHI is addressable under 45 CFR 164.312(a)(2)(iv) and (e)(2)(ii), so a practice can document why encryption is not reasonable and adopt an equivalent alternative. Under the proposal, encryption at rest and in transit would become required, with limited exceptions, and that documented-alternative route would narrow.
The table compares the current rule with the proposal for the items that touch email and file sharing.
Do the HIPAA Security Rule changes affect the breach notification safe harbor?
The Security Rule proposal does not rewrite the Breach Notification Rule’s definition of unsecured PHI. Under 45 CFR 164.402, PHI encrypted consistent with HHS guidance is not unsecured, so its loss does not trigger patient notification. That safe harbor applies now, whether or not encryption becomes required.
The HHS Breach Notification Rule page states that entities that secure information as its guidance specifies “are relieved from providing notifications following the breach of such information.” The HHS guidance to render unsecured PHI unusable, unreadable, or indecipherable adds that decryption tools “should be stored on a device or at a location separate from the data they are used to encrypt or decrypt.”
What should a practice do while the HIPAA Security Rule changes are pending?
A practice should follow the current Security Rule, which already requires audit controls, activity review, a risk analysis and a documented decision on encryption. A practice that encrypts email and files consistent with HHS guidance can rely on the breach notification safe harbor today, and it would be closer to the proposal if HHS finalizes it.
The current rule also expects practices to revisit their decisions. Section 164.308(a)(8) requires periodic technical and nontechnical evaluation, and documentation must be kept for six years under 164.316(b)(2)(i). A practice whose risk analysis documented an alternative to encryption can re-examine that choice at its next evaluation, and the HIPAA encryption requirements guide explains what the current addressable standard asks.
How does PreVeil support the current rule and the proposal?
PreVeil encrypts message contents and attachments end to end on the sender’s device, inside Outlook, Gmail or Apple Mail, and encrypts PreVeil Drive files the same way, which supports the addressable encryption specifications now. PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices.
PreVeil signs a BAA, uses FIPS 140-3 validated cryptographic modules (certificate #5145), and gives administrators an admin console and system logs on the Business plan that support the required audit controls standard. For the proposed multi-factor authentication requirement, device-bound keys with native device authentication support multi-factor authentication requirements.
With PreVeil, outside providers, payers, business associates and patients read and reply for free from their browser after a one-time sign-up, and their replies stay encrypted. A practice deploys PreVeil in hours, and PreVeil lets a solo practice start with a single Business license.
Frequently asked questions
Has the new HIPAA Security Rule been finalized?
No. HHS proposed the HIPAA Security Rule changes on January 6, 2025 (90 FR 898). As of November 2026, no final rule has been published, and the latest Unified Agenda lists it under long-term actions with final action targeted for July 2027.
Will encryption become required under HIPAA?
Under HHS’s January 2025 proposal, encryption of ePHI at rest and in transit would be required with limited exceptions. Under the current HIPAA Security Rule, encryption is addressable, not required.
Does the proposal require multi-factor authentication?
HHS’s January 2025 proposal would require multi-factor authentication, with limited exceptions. The current HIPAA Security Rule does not name it as a specification.
Should a practice wait for the final rule before encrypting email?
The current HIPAA Security Rule already requires a documented decision on encryption, and encrypted PHI that is lost does not trigger breach notification today. Waiting does not change current obligations.
Can PreVeil read a practice’s email?
No. PreVeil cannot access or decrypt message contents, attachments or files, because the encryption keys stay on users’ devices.
How can a practice prepare under the current rule?
A demo shows how PreVeil encrypts email and files inside the inbox your practice already uses, so encryption is in place before any final rule. Request a demo
