Cyber Security Compliance · HIPAA & HITECH
HIPAA and HITECH Compliance Services
Risk Analysis, Gap Assessment and Security Rule Readiness
Risk analysis is the single most cited deficiency in OCR enforcement, and it has appeared in every action brought under the Risk Analysis Initiative since October 2024. That is the obligation to get right, and it is the one already in force. A proposed overhaul of the HIPAA Security Rule would go considerably further, mandating multi-factor authentication, encryption, asset inventory and network segmentation, but it remains a proposal: no final rule has been issued and the target date has moved to 2027. Elevate Consult builds against the rule in force while preparing organizations for the one that is coming.
2026 UPDATE
Where the Security Rule actually stands
The overhaul is proposed, not final
HHS published the Notice of Proposed Rulemaking in the Federal Register on 6 January 2025 and the comment period closed on 7 March 2025. No final rule has been issued. The regulatory agenda originally targeted spring 2026 and now targets July 2027 under RIN 0945-AA22, and a coalition of more than a hundred hospital and provider associations has petitioned HHS to withdraw the proposal. The current Security Rule remains in force and is what OCR enforces today.
Anyone presenting the proposal as current requirement is wrong
Compliance material describing mandatory MFA and mandatory encryption as present obligations under the Security Rule is describing a proposal. That distinction matters for budget decisions and for what an organization tells its board.
The proposal would remove the addressable versus required distinction
Today many implementation specifications are addressable, meaning an organization can implement a reasonable alternative with documented justification. The NPRM proposes making nearly all of them required. That is the structural change with the largest practical consequence, because it removes the documented-justification path organizations have relied on for two decades.
What the proposal would mandate
Technology asset inventory and network map reviewed at least every 12 months, encryption of ePHI at rest and in transit, multi-factor authentication, network segmentation, annual penetration testing, biannual vulnerability scanning, 72 hour restoration of certain systems, and verification rather than contractual assurance that business associates have implemented their safeguards.
Preparation is still rational
If finalized, the rule is expected to take effect 60 days after publication with compliance required 180 days later, roughly 240 days total, and business associate agreements updated within a year. That is not enough time to build an asset inventory and a segmentation program from nothing. Organizations that treat the proposal as a planning signal rather than as a requirement are in the right position.
What HIPAA and HITECH require
Two statutes, one operating obligation
The Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act are the federal laws governing protection of electronic protected health information. Together they establish the requirements for safeguarding patient data and the enforcement structure behind them.
The Security Rule requires administrative, physical and technical safeguards. The Privacy Rule governs use and disclosure. The Breach Notification Rule sets what happens when protection fails. HITECH expanded enforcement, including authority for state attorneys general to bring civil actions
Risk analysis
The most enforced requirement in HIPAA
The Security Risk Analysis required by 45 CFR 164.308(a)(1)(ii)(A) is where OCR concentrates. Risk analysis failures appear in essentially every major enforcement action, and every action under the Risk Analysis Initiative since October 2024 includes a finding under that provision.
Elevate follows the HHS Office for Civil Rights guidance document on risk analysis requirements under the HIPAA Security Rule, which describes the nine essential elements a risk analysis must incorporate regardless of methodology. The analysis is conducted in accordance with NIST SP 800-30 as OCR recommends, with implementation guidance from NIST SP 800-66 Revision 2, published in February 2024 and superseding Revision
Scope of the analysis
All ePHI
Every instance of ePHI the organization creates, receives, maintains or transmits, regardless of the media or the location.
Data collection
Where ePHI lives
Documented identification of where ePHI is stored, received, maintained and transmitted, which is what the proposed asset inventory requirement formalizes.
Threats and vulnerabilities
Identified and documented
Reasonably anticipated threats and the vulnerabilities that would allow them to be exploited, documented rather than assumed.
Current security measures
Assessed, not listed
The security measures in use and whether they are configured and used correctly, which is a different question from whether they were purchased
Likelihood and impact
Per threat and vulnerability pair
Likelihood of occurrence and potential impact assigned at the pair level rather than as a general rating.
Risk level and documentation
Assigned and recorded
Risk level determined for each pair, with the analysis documented and the determination traceable, then reviewed and updated on a periodic basis.
Our approach
Gap analysis, risk analysis, remediation, sustainment
Elevate works from OCR’s own audit protocols and the HHS and CMS guidance, rather than from a generic security checklist relabeled for healthcare.
Gap analysis
Security Rule, Breach Notification Rule and Privacy Rule gap analysis against the mandated standards, using OCR audit protocols alongside CMS and HHS guidance.
Security risk analysis
Conducted against the nine essential elements, aligned to NIST SP 800-30 and NIST SP 800-66 Revision 2, correlated with applicable state and federal requirements beyond HIPAA itself.
Customized action plans
A compliance roadmap sized to the organization’s environment and operating reality, sequenced so the most enforced gaps close first.
Staff training
In-person and remote training covering current HIPAA and HITECH obligations, aimed at the human error that drives a substantial share of reportable incidents.
Business associate management
Review of business associate agreements and, increasingly, verification that associates have actually implemented the safeguards they agreed to, which the proposed rule would make explicit.
Implementation and monitoring
Support implementing safeguards and ongoing monitoring, including readiness work against the proposed Security Rule requirements that would be hardest to build under a 240 day clock.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to fix the requirement OCR actually enforces?
Elevate Consult conducts the risk analysis against the nine essential elements, runs the Security, Breach Notification and Privacy Rule gap analysis using OCR’s own protocols, and builds the remediation plan that closes enforcement exposure first.
FAQ
Common Questions
Is the new HIPAA Security Rule in effect?
No. HHS published the Notice of Proposed Rulemaking on 6 January 2025 and the comment period closed on 7 March 2025, but no final rule has been issued. The target for final action has moved to July 2027 under RIN 0945-AA22, and more than a hundred industry associations have asked HHS to withdraw the proposal. The current Security Rule remains in force and is what OCR enforces.
What would the proposed rule change?
Most significantly it would remove the distinction between addressable and required implementation specifications, making nearly all of them required. It would mandate a technology asset inventory and network map reviewed at least every 12 months, encryption of ePHI at rest and in transit, multi-factor authentication, network segmentation, annual penetration testing, biannual vulnerability scanning, 72 hour restoration of certain systems, and verification that business associates implemented their safeguards rather than only contracting for them.
What does OCR actually enforce today?
The current Security Rule, and within it the risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A) more than anything else. Risk analysis failures appear in essentially every major enforcement action, and every action under the Risk Analysis Initiative since October 2024 includes a finding under that provision. An organization with one thing to fix should fix the risk analysis.
What makes a risk analysis compliant?
OCR’s guidance describes nine essential elements that must be present regardless of methodology: scope covering all ePHI, data collection identifying where it lives, identification of threats and vulnerabilities, assessment of current security measures, determination of likelihood and impact, assignment of risk level, documentation, and periodic review and update. A vulnerability scan is not a risk analysis, and a policy stating that risks are assessed is not one either.
Should we prepare for the proposed rule now?
Selectively. If finalized, compliance would be required roughly 240 days after publication, which is not enough time to build an asset inventory, network map and segmentation program from nothing. Those are the items worth starting because they have long lead times and because they improve the current risk analysis regardless of whether the rule finalizes. Purchasing tooling against a proposal that may be withdrawn is a different decision.
Do business associates have the same obligations?
Business associates are directly liable under the Security Rule and for certain Privacy Rule provisions, and HITECH extended enforcement authority accordingly. The proposed rule would go further by requiring covered entities to verify that business associates have actually implemented appropriate technical safeguards, rather than relying on the business associate agreement alone. Organizations on either side of that relationship should expect the verification question sooner than the rule arrives.