The Proposed HIPAA Security Rule Overhaul Is Making HITRUST Certification More Relevant

The proposed HIPAA Security Rule overhaul represents the most significant regulatory shift in healthcare cybersecurity since the original Security Rule was enacted in 2003. For covered entities, business associates, and the compliance professionals who serve them, the proposal signals a decisive move away from flexible, principles-based guidance toward specific, auditable, and mandatory technical controls.

The healthcare sector has long operated at the intersection of sensitive data and operational urgency, making it a persistent target for ransomware, data breaches, and supply chain attacks. The U.S. Department of Health and Human Services recognised that the existing Security Rule, while foundational, was no longer adequate to address the threat environment that modern healthcare organisations face. The proposed changes reflect that recognition and they carry meaningful implications for how organisations structure their compliance programmes, allocate security resources, and demonstrate accountability to regulators, partners, and patients.

For CISOs and compliance officers navigating this landscape, the critical question is not simply whether to comply, but how to build a compliance infrastructure that is durable, defensible, and capable of scaling alongside future regulatory evolution. It is in this context that HITRUST certification has emerged not merely as a voluntary assurance credential, but as a strategically aligned framework that maps closely to where HIPAA requirements are heading. Understanding the relationship between the proposed HIPAA Security Rule changes and HITRUST is now essential to high-performance compliance planning.

Understanding the Proposed HIPAA Security Rule Changes

The  existing HIPAA Security Rule, issued in 2003 and last revised in 2013, was designed to be technology-neutral and scalable features that provide flexibility but have contributed to variation in implementation. The proposed rule, introduced by HHS, seeks to correct this by specifying concrete requirements rather than leaving implementation largely to organisational discretion. This shift is not cosmetic; it represents a philosophical change in how the federal government intends to hold the healthcare sector accountable for the protection of ePHI.

Core Proposed Changes at a Glance

Among the most consequential changes proposed are the following:

• Mandatory multi-factor authentication (MFA): The proposal would generally require MFA across technology assets in relevant electronic information systems, subject to specified exceptions and conditions.
• Explicit encryption requirements: The proposal would require encryption of ePHI at rest and in transit, except where a specified exception applies and the regulated entity documents that the conditions for the exception are met.

• Network segmentation: Organisations must demonstrate logical separation of systems that process ePHI from general network environments.
• Vulnerability scanning and penetration testing: Defined cadences for vulnerability identification and remediation are now expected, moving this from a best practice to a regulatory obligation.
• Asset inventory management: Covered entities must maintain accurate, current inventories of all technology assets that interact with ePHI.
• Elimination of addressable specifications: The proposed rule significantly narrows or removes the addressable category, making most safeguards unconditionally mandatory regardless of organisational size or complexity.

These changes collectively demand a level of security programme maturity that many mid-market and smaller organisations have not yet achieved. For compliance officers, the proposed rule is not an incremental update it is a structural elevation of expectations. Organisations that have relied on the flexibility of the existing framework to defer or minimise certain controls will face the most significant compliance gaps.

Practical Implications for Covered Entities and Business Associates

The scope of the proposed rule applies equally to covered entities and their business associates. This is a critical point for healthcare technology vendors, managed service providers, and any third party that handles ePHI. The proposed changes mean that business associate agreements will need to reflect higher technical standards, and covered entities will be expected to verify that their partners meet those standards not merely attest to them contractually. Business-associate oversight obligations are becoming broader and more detailed.

HITRUST and HIPAA Compliance: A Framework Built for This Moment

HITRUST has always maintained explicit mappings between its Common Security Framework and HIPAA’s administrative, physical, and technical safeguard requirements. As the proposed HIPAA Security Rule moves toward more prescriptive mandates, the areas of overlap between HITRUST control categories and the proposed rule’s requirements are expanding. Organisations pursuing HITRUST certification are, in many respects, already working through the same control domains that regulators are now attempting to codify into law.

How HITRUST Can Support Preparation for the Proposed HIPAA Security Rule?

For healthcare organisations that handle significant volumes of ePHI, serve large health plan populations, or operate as critical infrastructure partners to covered entities, HITRUST certification has historically served as a voluntary but highly credible signal of security maturity. The proposed HIPAA Security Rule changes are altering that calculus. As mandatory requirements converge on the technical depth already represented in the HITRUST CSF, the distinction between “voluntary best practice” and “regulatory expectation” is narrowing.

The HITRUST i1 (Implemented, 1-Year) certification is valid for one year. The HITRUST r2 (Risk-based, 2-Year) certification is valid for two years, subject to an interim assessment at the one-year point.

The Dual Compliance Dividend

One of the most strategically important aspects of the HITRUST and HIPAA compliance relationship is that HITRUST certification does not merely satisfy HIPAA requirements it typically exceeds them while simultaneously addressing requirements from other frameworks including NIST CSF, ISO 27001, and state-level privacy regulations. For compliance officers managing multiple regulatory obligations, this consolidation effect represents a meaningful efficiency. Rather than maintaining parallel compliance programmes for each applicable framework, HITRUST provides a single, comprehensive control environment that satisfies obligations across domains.

This efficiency is particularly valuable in the context of the proposed HIPAA Security Rule, where the compliance burden is expected to increase significantly. Organisations that invest in HITRUST certification are not simply meeting a single regulatory threshold  they are building a compliance infrastructure with the structural integrity to accommodate ongoing regulatory evolution, including future HIPAA amendments, without requiring wholesale programme redesign.

Strategic Positioning: What Compliance Leaders Should Do Now

The window between a Notice of Proposed Rulemaking and a final rule is not a period for inaction it is the appropriate time for preparation. Organisations that wait for a final rule before beginning gap assessments will find themselves with compressed timelines, elevated remediation costs, and limited capacity to course-correct without operational disruption. The proposed HIPAA Security Rule changes are sufficiently detailed to support meaningful gap analysis today, and the directional intent of the rule is clear even if specific implementation deadlines have not yet been established.

Recommended Actions for CISOs and Compliance Officers

• Conduct a current-state gap assessment: Map existing security controls against the proposed rule’s requirements, with particular attention to MFA, encryption, network segmentation, and asset inventory. Identify where controls are absent, partially implemented, or rely on the addressable flexibility that the proposed rule is likely to eliminate.
• Evaluate HITRUST certification scope and type: Determine whether an r2 or i1 certification is appropriate given organisational size, complexity, and the scope of ePHI environments. Engage a HITRUST-authorised assessor early to understand readiness and remediation requirements.
• Strengthen business associate oversight: Begin reviewing existing business associate agreements and due diligence processes in light of the proposed rule’s expanded expectations. Identify third parties whose security posture may fall short of the incoming standards.
• Document remediation progress: Regardless of whether a formal certification is pursued immediately, building a documented record of control implementation and improvement activity is valuable both for regulatory defensibility and for internal governance accountability.
• Align security investment with compliance priorities: The proposed rule provides a defensible basis for securing budget and leadership support for security programme improvements. Compliance officers should use this regulatory momentum to advance control initiatives that may have previously struggled for organisational prioritisation.

The proposed HIPAA Security Rule, in this context, is not only a compliance obligation  it is an opportunity to elevate the security maturity of the organisation with regulatory authority as a supporting rationale. CISOs who frame the proposed changes in terms of risk reduction and organisational resilience, rather than purely as compliance costs, are more likely to secure the resources and executive engagement necessary to respond effectively.

Conclusion

The proposed HIPAA Security Rule overhaul is a regulatory signal that the healthcare sector’s compliance obligations are maturing in both scope and specificity. For organisations that have operated within the flexibility of the existing framework, the proposed changes represent a meaningful increase in the baseline security standard — one that demands proactive, evidence-based programme development rather than reactive compliance. The convergence of the proposed rule’s requirements with the control domains already embedded in the HITRUST CSF is not coincidental; it reflects the broader industry consensus on what effective healthcare cybersecurity looks like in the current threat environment. Organisations that approach this moment strategically  by conducting rigorous gap assessments, investing in HITRUST certification where appropriate, and strengthening their third-party oversight programmes will be far better positioned to meet both the incoming regulatory requirements and the expectations of their business partners. Navigating the proposed HIPAA Security Rule changes requires more than awareness; it requires a structured compliance strategy built on defensible controls and expert guidance. Visit ValueMentor to explore how our cybersecurity and compliance professionals can help your organisation conduct a gap assessment, evaluate HITRUST certification readiness, and build a resilient compliance programme designed for the regulatory environment ahead.

FAQs