The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS’s proposed overhaul turned flexible safeguards into specific requirements. Sorted by difficulty, most were controls hospitals already had or evidence they could build. Recovery within 72 hours was different: it needed clinical sequencing, tested capacity and money few systems had budgeted.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On December 27, 2024, the HHS Office for Civil Rights announced a proposed rule to modify the HIPAA Security Rule, its first major update since 2013. The notice was published in the Federal Register on January 6, 2025, with comments due by March 7. The proposal would remove the distinction between “required” and “addressable” implementation specifications, making most safeguards mandatory with limited exceptions. It would require encryption of electronic protected health information at rest and in transit, and multi-factor authentication. It would also require a written technology asset inventory and network map, vulnerability scanning at least every six months and penetration testing at least annually. It would also require written procedures to restore certain relevant systems and data within 72 hours. Business associates would have to verify their safeguards to covered entities in writing at least annually and give prompt notice when they activated contingency plans. HHS cited the rise in large breaches and ransomware attacks in health care.
Early reactions focused on cost. Hospital groups argued that small and rural providers could not afford the proposal. Security practitioners noted that much of it codified what well-run organizations already did. Both points were true, and neither helped a health system decide where to start. Sorting the proposal’s requirements by the kind of effort each demands is more useful. There are four groups, and every requirement falls into one: controls most systems already had, evidence most lacked, recovery capability few could demonstrate, and obligations reaching into business associates. The third group was the hardest by a wide margin.
Controls most systems already had
Multi-factor authentication, encryption, anti-malware, patching and access controls were standard in most large health systems by 2024. HHS’s voluntary cybersecurity performance goals, released earlier that year, pointed the same way. Removing the “addressable” category would turn them from judgment calls into explicit obligations.
The work in this group is coverage. Legacy clinical systems, medical devices and affiliated practices often lack multi-factor authentication or encryption because the technology cannot support it. The proposal allowed limited exceptions, but each would need documentation: the gap, the reason and the compensating control. A register of exceptions, reviewed each quarter by a named owner, turns that from an audit scramble into routine work.
Evidence most lacked
The second group concerns proof. A written asset inventory and a network map showing how electronic protected health information moves are foundations of any security program. Many health systems did not keep them complete and current. The proposal also called for regular compliance audits and risk analyses with specified content.
This is a discipline problem more than a technology purchase. Inventories decay quickly in hospitals, where departments acquire devices and software on their own. Keeping them current needs biomedical engineering, clinical departments and procurement, with a rule that nothing connects to the network without an inventory record. The network map forces conversations about data flows that many organizations have never had, such as which research databases, analytics platforms and vendor portals receive patient data.
The risk analysis belongs in this group as well. OCR had long cited missing or superficial risk analyses as the most common failure in its investigations, and in late 2024 it launched an enforcement initiative focused on them. A risk analysis built on an incomplete inventory inherits its gaps. The order of work is therefore inventory, then map, then analysis, each feeding the next.
Recovery capability few could demonstrate
The most demanding element required written procedures to restore relevant systems and data within 72 hours, backed by a criticality analysis and testing. Ransomware recoveries at large health systems in 2024 had taken weeks. The Change Healthcare outage and the Ascension attack had each disrupted operations for much longer than three days.
The proposal required procedures aimed at that timeframe, not a guarantee that every system would return. Procedures never tested at scale are not credible, so in practice the requirement meant a recovery program with three parts. First, a clinically agreed restore sequence. Which systems come back first depends on how care is delivered: the electronic health record, laboratory and imaging, pharmacy dispensing, and the identity and network services they all need. IT cannot set that order alone. Second, recovery infrastructure. Immutable, isolated backups, clean build environments and enough compute and staff to rebuild many systems at once are expensive and rarely sized for a full-estate event. Third, tests at realistic scale, timed and repeated, with results reported to the board.
Downtime procedures fill the gap between outage and restoration, which can differ by system by days. They need the same clinical ownership as the restore sequence. Read-only downtime viewers, which hold recent medication administration records, allergies and active orders on isolated hardware, let clinicians work safely for days without the main record. Paper forms and runners cover the rest. Each unit should know how to switch over without waiting for instructions from IT. For many health systems, the honest first output of this work is a measured restore time far above 72 hours and a funded plan to close the gap.
Obligations reaching into business associates
The fourth group addressed the supply chain. Business associates would verify their technical safeguards in writing each year and tell covered entities promptly when they activated contingency plans. Change Healthcare had shown how one business associate’s outage could halt claims and payments nationwide.
For covered entities, oversight would shift from a contract signed once to an annual evidence process. That creates a basis to request recovery test results and restore times from critical vendors, which ties this group back to the third. A health system cannot meet its own 72-hour objective if the vendor running its revenue cycle or imaging archive cannot. Where a vendor cannot show a credible restore time, the health system needs its own fallback for that workflow. Counsel should review how existing business associate agreements would need to change.
With hindsight
The proposal drew thousands of comments. A coalition of more than 100 provider organizations asked HHS to withdraw it, citing cost and burden. The change of administration in January 2025 slowed its path. A final rule targeted on the regulatory agenda for May 2026 did not appear, and the 2026 agenda moved final action further out, to around 2027. As of this writing the existing Security Rule remains in force, and OCR has kept risk analysis failures at the center of its enforcement, with a series of settlements under its risk analysis initiative. The difficulty ranking has held. Controls kept spreading, with help from cyber insurers. Inventories and network maps stayed hard. Recovery capability remained the widest gap, and long ransomware outages at health care organizations continued through 2025, keeping restore time a board-level question whether or not the 72-hour line becomes law.