The HIPAA Security Rule was written for a very different technology environment than the one your medical practice operates in today.

Your employees access cloud-based EHRs. Staff may work remotely. Your practice depends on email, patient portals, mobile devices, telehealth applications and third-party vendors. Meanwhile, cybercriminals have become increasingly sophisticated at exploiting those systems and the people who use them.

HHS responded by proposing a major overhaul of the HIPAA Security Rule. But there is one critical distinction your practice needs to understand: these proposed changes are not yet the current HIPAA Security Rule.

HHS states that the existing Security Rule remains in effect while the rulemaking process continues. That doesn’t mean you should ignore the proposals. Many of them identify security measures that are worth evaluating now.

1. Start With Your HIPAA Security Risk Analysis

A security risk analysis isn’t merely something being proposed for the future. The current HIPAA Security Rule already requires covered entities and business associates to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI).

Your risk analysis should reflect your actual practice—not a generic HIPAA template you purchased years ago. Consider where your ePHI resides, who can access it, what systems connect to it, what happens when employees work remotely and which outside vendors create, receive, maintain or transmit it.

Once you identify vulnerabilities, document what you will do about them. A risk assessment that identifies serious weaknesses without an accompanying risk-management process leaves your practice exposed.

2. Build an Accurate Technology Inventory

One proposed Security Rule requirement would make asset inventories and network maps more explicit. Even before that becomes a requirement, you cannot adequately protect systems and devices you don’t know exist.

Create an inventory of computers, servers, mobile devices and other technology that may create, receive, maintain or transmit ePHI. Then map how ePHI moves between your practice, EHR, billing company, laboratories, clearinghouses, cloud applications and other vendors.

For a small practice, this does not need to become a complicated IT project. A well-maintained spreadsheet and a simple diagram may be enough to give you and your IT provider a much clearer picture of your security environment.

3. Don’t Wait to Strengthen Multi-Factor Authentication

HHS has proposed requiring multi-factor authentication (MFA), with limited exceptions. MFA adds another authentication factor beyond a username and password, making stolen credentials less useful to an attacker.

Even though the proposed requirement is not yet final, review your most important systems now. Pay particular attention to email, remote access, cloud applications, administrator accounts and systems containing ePHI.

Ask each vendor whether MFA is available, whether it is turned on, and whether it can be required for every appropriate user. A feature that exists but is optional does not protect your practice if employees aren’t actually using it.

4. Reassess How You Encrypt ePHI

The proposed rule would strengthen encryption requirements for ePHI at rest and in transit. This deserves attention because ePHI can exist in far more places than your EHR.

Look for patient information saved on employee desktops, laptops, shared network folders, portable drives, email accounts and other applications. Remote workers can create additional risk if PHI is downloaded or stored locally instead of remaining within secured practice systems.

Work with qualified IT professionals to determine where ePHI exists and how it is protected. The goal should be to reduce unnecessary local storage and make appropriate encryption part of your technology architecture rather than relying on employees to make security decisions one file at a time.

5. Put Vulnerability Testing on Your Radar

HHS has proposed requiring vulnerability scanning at least every six months and penetration testing at least annually. These requirements are particularly important to distinguish as proposed, because practices should not mistakenly assume the NPRM itself created a current federal mandate to perform annual penetration tests.

Still, your IT team should have a process for identifying vulnerabilities before attackers exploit them. Ask how systems are patched, how vulnerabilities are detected, who reviews the results and how quickly critical findings are corrected.

The appropriate cybersecurity program should reflect your practice’s size, systems and risks. The current Security Rule remains risk-based, so work with competent IT and security professionals to determine what measures are reasonable and appropriate for your environment.

6. Review Your Business Associates—Not Just Your Own Practice

Your HIPAA security risk does not stop at your office door. Billing companies, EHR companies, IT providers, cloud services and other business associates may create, receive, maintain or transmit ePHI on your behalf.

Start by confirming that you know who your business associates are and that appropriate Business Associate Agreements are in place. Then go further: ask vendors meaningful security questions, including how they conduct risk analyses, protect ePHI, control access, respond to security incidents and notify customers about problems.

The proposed Security Rule would impose additional requirements involving business associates and cybersecurity verification. You do not need to wait for those provisions to become final before taking vendor security seriously.

7. Tighten Employee Termination and Access Procedures

Former employees and contractors should not retain access to your EHR, email, cloud applications or other systems containing patient information. Yet access termination becomes complicated when one person has accounts across numerous internal and third-party platforms.

Create an offboarding checklist that identifies every system from which access must be removed. Coordinate HR, management and IT so access termination isn’t dependent on someone remembering to send an email several days after an employee leaves.

The proposed Security Rule contains more specific provisions related to access changes and notification involving other regulated entities. Regardless of what ultimately appears in a final rule, rapid termination of unnecessary access is basic security hygiene.

8. Review Your Security Policies Regularly

Your HIPAA security policies should describe the practice you actually operate today. If your policies were written before your current EHR, remote-work arrangements, cloud applications or cybersecurity tools were implemented, they may no longer match reality.

HHS has proposed more explicit requirements to document, review, test and update security policies and procedures. That direction reinforces an important point: HIPAA compliance should operate as a continuing security-management process rather than a binder that is completed once and forgotten.

Schedule a recurring review and document the results. When your technology or business processes change significantly, reassess the affected policies rather than waiting for the next scheduled review.

Don’t Wait for a Final Rule to Fix an Obvious Risk

Your practice does not need to treat every proposal in the HIPAA Security Rule NPRM as if it were already law. In fact, doing so could lead to inaccurate compliance advice and unnecessary spending.

But waiting for a final regulation is equally risky when your assessment has already uncovered vulnerabilities. MFA, effective access controls, risk analysis, appropriate encryption, backups, security training and competent IT management can reduce your exposure today.

HHS provides a Security Risk Assessment Tool specifically designed to help small and medium-sized healthcare practices and business associates with the risk-assessment process.

Keep Your Team Ready for the Next HIPAA Change HIPAA rules and cybersecurity threats continue to evolve, and your practice needs more than a one-time compliance update. You need to know when a requirement actually changes, what applies to your practice and what your staff should do differently. Healthcare Training Leader’s All-Access Pass gives your entire team access to practical, expert-led training on HIPAA, compliance, billing, reimbursement, credentialing and other regulatory changes affecting medical practices. Stay ahead of new requirements and give your staff the guidance they need to turn complicated regulations into everyday procedures. Learn more about the All-Access Pass

---