Compliance
HIPAA Security Rule update: what is proposed for business associates and where the rule stands
As of October 10, 2026, the HIPAA Security Rule update proposed on January 6, 2025 is still a proposed rule, and the current Security Rule remains in effect. The federal Unified Agenda lists the rule as a long-term action with a final action date of July 2027. If it were finalized as proposed, a business associate would have to give the covered entity written verification of its technical safeguards at least once a year and report activation of its contingency plan within 24 hours. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
Status
Where the rule stands, with dates
| Event | Date or listing | Source |
|---|---|---|
| Event: Proposed rule published | Date or listing: January 6, 2025, at 90 FR 898; comments closed March 7, 2025 | Source: Federal Register |
| Event: Unified Agenda, Spring 2025 edition | Date or listing: Final rule stage; final action listed for May 2026 | Source: reginfo.gov |
| Event: Unified Agenda, edition labelled 2026 | Date or listing: Long-term actions; final action listed for July 2027 | Source: reginfo.gov |
The agenda defines long-term actions as items the agency does not expect to act on within 12 months of that edition (Federal Register, August 14, 2026). Agenda dates are targets, not commitments. HHS’s own page says that while the rulemaking is under way the current Security Rule remains in effect (HHS). Whether the rule will be finalized as proposed, changed or withdrawn is not known from these sources.
The proposal
What it would require of business associates, if finalized as proposed
| Proposal | What it would require | Where |
|---|---|---|
| Proposal: Written verification | What it would require: A covered entity could let a business associate handle electronic protected health information only if it also verifies that the business associate has deployed the technical safeguards, and obtains written verification at least once a year. The verification would be a written analysis by a person with appropriate knowledge and a written certification of its accuracy by a person with authority to act for the business associate. | Where: 90 FR 1016 |
| Proposal: Who does the analysis | What it would require: HHS says it may be a member of the covered entity's or business associate's workforce or an external party. | Where: 90 FR 956 |
| Proposal: Contingency plan notice | What it would require: A business associate would report activation of its contingency plan to the covered entity without unreasonable delay and in no case later than 24 hours after activation. Existing business associate agreements would need a new clause. | Where: 90 FR 1019 |
| Proposal: Restoration | What it would require: Written procedures to restore critical systems and data within 72 hours of a loss. | Where: 90 FR 1015 |
| Proposal: Encryption and authentication | What it would require: Encryption of electronic protected health information at rest and in transit, and multi-factor authentication on relevant technology assets, with limited exceptions. | Where: 90 FR 1017 |
| Proposal: Audit | What it would require: A compliance audit of each standard at least once a year. HHS does not propose to specify whether the regulated entity or an external party performs it. | Where: 90 FR 955 |
| Proposal: Subcontractors | What it would require: A covered entity would not have to verify a business associate's subcontractor. The business associate would verify its own. | Where: 90 FR 1016 |
The proposed effective date is 60 days after a final rule is published, with 180 days after that to comply, and the proposal describes a transition for certain existing business associate agreements (90 FR 900 and 986).
What is not proposed
No outside report is required by the proposal
The proposal does not name SOC 2, ISO 27001 or HITRUST, and because the analysis could be done by the business associate’s own workforce, it does not require an outside report. It also does not say that such a report would satisfy the verification. How the three frameworks relate to the current rule is on the SOC 2, ISO 27001 and HITRUST page.
In practice
What to do while it is only a proposal
- Treat the current rule as the one that applies: a written contract and satisfactory assurances, with a business associate that safeguards the information and reports incidents.
- Put the questions the proposal points to into vendor reviews now: what technical safeguards are deployed, who verifies them and how often, how quickly a contingency plan activation would be reported, and how fast critical systems can be restored.
- Write incident and contingency notice periods into the contract in terms the vendor can meet today, as the current rule already requires a business associate to report security incidents and breaches (who must notify after a vendor breach).
- Check the access and training standards each person is already bound by; they are on the HIPAA training and access rules page.
- Re-check the agenda entry before relying on any date on this page.
The contract terms are on the business associate agreement page, the question list is in offshore medical billing vendor questions, and the wider position on offshore work is in HIPAA compliant offshore medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- SOC 2, ISO 27001 and HITRUST
What HIPAA requires, what each of the three frameworks proves, where they stop and what evidence to ask a vendor for.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- Vendor data breach: liability and notice
Who notifies the practice, individuals, HHS and the media, who is liable for what, and the current penalty tiers.
- HIPAA training and access rules
The access and training standards that attach to each person, which parts are required, and what the 2025 proposal would add.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.