The HIPAA Security Rule update is a proposed overhaul of the rules that govern how healthcare organizations protect electronic patient information. HHS published the proposal in January 2025, and final action is now targeted for July 2027.
That timeline has left many practice managers unsure what to do. Some have heard the new rules could arrive any day. Others assume a delay means nothing needs attention yet.
Neither is quite right. The current Security Rule still applies today, and many of the steps worth taking now make sense no matter what the final version includes.
Know What Is Proposed and What Is Required Today
The proposed update is not final. It could change before it is published, and it is not yet clear which parts will survive. What practices must do today is set by the existing Security Rule, which includes conducting a risk analysis and putting reasonable safeguards in place for electronic patient information. Keeping those two things separate helps leadership make calm decisions instead of reacting to headlines.
Update Your Inventory of Systems That Touch Patient Data
Start by listing every system that stores or accesses patient information. That usually includes the EHR or practice management system, Microsoft 365 email, imaging or lab interfaces, the patient portal, the fax service, and any laptops or phones staff use for work. The list often grows once billing, scheduling, and referral tools are included. You cannot protect what you have not identified. Note who manages each system, whether that is the EHR vendor, your IT provider, or someone on staff.
Confirm Who Has Access to Patient Information
Front desk staff, billing staff, nurses, and providers all need different levels of access. Review who can see what in the EHR and in shared folders, and remove access that no longer fits someone’s role. Pay close attention to employees who changed positions, part-time staff, and former employees whose accounts may still be active. A medical assistant who moved to billing six months ago may still have clinical access that no longer fits the role.
Document Your Vendors and Business Associates
Practices rely on outside vendors for billing, transcription, IT support, cloud storage, and the EHR itself. Keep a current list of which vendors handle patient information, what they can access, and whether a business associate agreement is on file. If a vendor connects remotely to your systems, know how that access is controlled and who approves it.
Review How Patient Information Actually Moves
Patient information moves through email, faxes, text messages, patient portals, and referrals to other practices. Look at how staff actually send records day to day, not just how the policy says they should. If a nurse texts a photo of a chart to a provider because it is faster, that workflow needs a better option, not just a reminder.
Test Your Backups and Downtime Plan
If the EHR or network goes down on a full clinic day, staff need to know how to check in patients, view the schedule, and document care. Confirm that backups are running and that a restore has actually been tested. Walk through the downtime plan with the front desk and clinical leads so it reflects how the practice really operates.
Make Security Training Part of the Routine
Front desk staff answer calls, open attachments, and handle patient requests all day. Short, regular training on recognizing phishing emails, verifying callers, and reporting something unusual helps more than a single annual session. A two-minute reminder at a monthly staff meeting can be enough to keep it top of mind. Training works best when staff know exactly who to contact when something feels wrong.
Keep an Eye on the Final HIPAA Security Rule Update
Assign someone to watch for updates as the 2027 target approaches. When a final rule is published, the practice will need to understand which changes apply and how much time it has to comply. Current documentation of systems, access, and vendors will make that review much faster.
Start With What Helps Today
Preparing for the HIPAA Security Rule update does not require guessing what the final version will say. The steps that help most are the same ones that improve security and day-to-day operations right now.
A practice that knows its systems, controls access, and understands its vendors will be in a better position whatever the final rule includes.
If you are not sure where your practice stands, RBS IT can help you review your systems, access, and vendors and decide what to address first, with a clear understanding of how your clinic actually runs.
Not sure where your practice stands today? Schedule a time to talk with our team.
